up vote 0 down vote favorite
share [g+] share [fb]

Background: I'm a .NET developer who wants to use SQL Profiler to help develop and debug applications. The instance I'm using is for my department only - we have full access to all databases (which are only ours anyhow). Our DBA says we can't have access to ALTER TRACE because of the security risks, but I can't find any relevant information to back his claims. Using SQL Server 2005.

Only reference I found regarding security implications was here, but none of the risks there apply (the only relevant one seems to be the ability to see every event on every database, which doesn't matter since I'm already owner of all of them.).

Is there any reason we shouldn't be able to use TRACE?

EDIT: On a side note, that MSFT article says: "In previous versions of SQL Server, SQL Trace automatically blanked out a query event if the string sp_password was found anywhere in the text of the query. This feature has been removed in SQL Server 2005, and you should not depend on it to protect your intellectual capital." I'm a bit confused about this, as I just ran sp_password and it did in fact block out the password.

link|improve this question
You might get a better answer on stackoverflow.com, then on serverfault. – Josh Brower Jul 2 '10 at 13:27
"...if a user can start a trace, he or she can retrieve event data no matter what database the event was generated in..." You might be the owner, but is there anyone who can get access to the TRC files you generate? Perhaps that is the angle your DBA is taking. He may also be concerned about having to track that ALTER TRACE. I am the DBA at my employer and understand that sometimes this is needed in a production environment (often with the vendor software we run). – jl. Jul 14 '10 at 13:58
feedback

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer

 
or
required, but never shown
discard