1.4 Querying a Ring Buffer Using T-SQL
Finally, this section consolidates what
you’ve just seen in the previous two sections to query an in-memory
target — in this case, a ring buffer — using T-SQL. The most likely
reason you’d want to do this is because the ring buffer stores its
results only in an XML format, so they have to be turned into
relational data before you can analyze them further.
Ring buffers are stored in a DMV called sys.dm_xe_session_targets, and it’s from here you query their content. This final example has created a session called Logins_rb to write its data to a ring buffer target. To create this yourself, create a new session with the options highlighted in Figure 8 and Figure 9.
Once you have started the session and the ring
buffer has started having event data written to it, it’s possible to
query its content using a DMV to extract its content in a meaningful
format, as shown in the following query:
select events.value('(event/@timestamp)[1]', 'datetime2') as [Event_Time_UTC],
events.value('(event/action[@name="nt_username"]/value)[1]',
'varchar(100)') as [NT_Username],
events.value('(event/action[@name="client_hostname"]/value)[1]',
'varchar(100)') as [Client_Hostname],
events.value('(event/action[@name="client_app_name"]/value)[1]',
'varchar(100)') as [Client_Appname]
from (select event_data.query('.') as events
from
(select cast(target_data as xml) as target_data
from sys.dm_xe_session_targets xt
join sys.dm_xe_sessions xs
on xs.address = xt.event_session_address
where xs.name = 'Logins_rb'
and xt.target_name = 'ring_buffer' ) as data
cross apply target_data.nodes ('RingBufferTarget/event') as
results(event_data)) as tab (events)
order by [Event_Time_UTC]
The results the query returns are the
same as those for the other targets you’ve previously queried; the
difference is their source isn’t a physical file anymore.
As you can see from the preceding query, you’re
now getting to levels of complexity far beyond what a newcomer to
Extended Events would be dealing with. However, if that’s something
you’re interested in investigating further, then I recommend reading
the blog posts of the SQL Server community’s Extended Events expert
Jonathan Kehayias. Not only has Jonathan published some great detailed
articles about Extended Events but also some invaluable scripts as
well; in fact the previous query was based on one of Jonathan’s.
http://sqlskills.com/blogs/jonathan/category/Extended-Events.aspx