Read-SqlXEvent

Reads SQL Server XEvents from XEL file or live SQL XEvent session.

Syntax

Read-SqlXEvent
    [-FileName] <String>
    [<CommonParameters>]
Read-SqlXEvent
    -ConnectionString <String>
    -SessionName <String>
    [<CommonParameters>]

Description

The Read-SqlXEvent reads SQL Server XEvents from a file or live SQL XEvent session. XEvent sessions are created by the CREATE EVENT SESSION Transact-SQL API. SQL XEvent files usually have the .XEL or .sqlaudit extensions and contain a stream of XEvents. The structure of the XEvents is defined in the session configuration. SQL live streams are available via the SQL TDS protocol and require authetication against the server that produced them.

Examples

Example 1

PS C:\> Read-SqlXEvent -FileName C:\audits\Audit-20190529-132659.sqlaudit

Name      : audit_event
UUID      : c6479a6f-f1bd-4759-9881-fcb493821aff
Timestamp : 6/13/2019 7:49:42 AM +00:00
Fields    : {[audit_schema_version, 1], [event_time, 6/13/2019 7:49:42 AM +00:00], [sequence_number, 1], [action_id,
            1129534785]...}
Actions   : {}

Name      : audit_event
UUID      : c6479a6f-f1bd-4759-9881-fcb493821aff
Timestamp : 6/13/2019 12:42:28 PM +00:00
Fields    : {[audit_schema_version, 1], [event_time, 6/13/2019 12:42:28 PM +00:00], [sequence_number, 1], [action_id,
            1129534785]...}
Actions   : {}

Read & parse the sqlaudit file. Each object returned will contain all the information from a single audit record.

Example 2

PS C:\> Read-SQLXEvent -ConnectionString "Server=.;Database=master;Trusted_Connection=True;" -SessionName perf_session

Name      : sql_statement_completed
UUID      : cdfd84f9-184e-49a4-bb71-1614a9d30416
Timestamp : 6/20/2019 6:49:50 AM +00:00
Fields    : {[duration, 7], [cpu_time, 0], [physical_reads, 0], [logical_reads, 0]...}
Actions   : {[sql_text, SELECT @@SPID; ]}

Name      : sql_statement_completed
UUID      : cdfd84f9-184e-49a4-bb71-1614a9d30416
Timestamp : 6/20/2019 6:49:50 AM +00:00
Fields    : {[duration, 13], [cpu_time, 0], [physical_reads, 0], [logical_reads, 0]...}
Actions   : {[sql_text, select 42
             ]}

Read & parse the live stream of XEvents from the SQL Server running on the same machine connected with Windows authentication. Each object returned will contain all the information from a single XEvent record.

Parameters

-ConnectionString

SQL Server connection string.

Type:String
Position:Named
Default value:None
Accept pipeline input:False
Accept wildcard characters:False
-FileName

File name of a XEvent file to read.

Type:String
Position:0
Default value:None
Accept pipeline input:True (ByValue)
Accept wildcard characters:False
-SessionName

The SQL Server XEvent session name as defined by the CREATE EVENT SESSION Transact-SQL.

Type:String
Position:Named
Default value:None
Accept pipeline input:False
Accept wildcard characters:False

Inputs

System.String

Outputs

Microsoft.SqlServer.XEvent.XELite.IXEvent