1.2 Viewing Saved Data
If you’ve configured your session to
use an event file as its target, then the captured events will also be
written to disk. You can read the event file’s content from disk while
the session is still running, or after the session has been stopped,
you might copy it from the server to your laptop.
To open the file, select File ? Open ? File
within SQL Server Management Studio, from where you can then browse to
wherever you keep your event files. By default, they are in the
following path:
C:\Program Files\Microsoft SQL Server\MSSQL11.x\MSSQL\Log
and have a default file extension of .xel. Opening one of these files presents you with the same data you saw when live data was being shown.
Event files can also be queried using T-SQL. Like SQL Trace, the function sys.fn_xe_file_target_read_file
reads an operating system file and returns it as XML-based table data.
Writing queries to handle XML is something you’ll become good at if you
want to perform a lot of analysis on Extended Events data; but for now,
the following query shows an example of how you can read the event file
to see the login events you captured:
select event_data.value('(event/@timestamp)[1]', 'datetime2') as
[Event_Time_UTC],
event_data.value('(event/action[@name="nt_username"]/value)[1]',
'varchar(100)') as [NT_Username],
event_data.value('(event/action[@name="client_hostname"]/value)[1]',
'varchar(100)') as [Client_Hostname],
event_data.value('(event/action[@name="client_app_name"]/value)[1]',
'varchar(100)') as [Client_Appname]
from (select cast(event_data as xml)
from sys.fn_xe_file_target_read_file('C:\Program
Files\Microsoft SQL Server\MSSQL11.SQL2012\MSSQL\Log
Logins_0_129805987593580000.xel', null, null, null)
) as results(event_data)
order by [Event_Time_UTC]
The preceding returns the following results:
Event_Time_UTC NT_Username Client_Hostname Client_Appname
--------------------------- ---------------- --------------- -------------------
2012-05-04 09:55:06.6850000 Gavin-VAIO\Gavin GAVIN-VAIO Microsoft SQL Server Management Studio
2012-05-04 09:55:06.7000000 Gavin-VAIO\Gavin GAVIN-VAIO Microsoft SQL Server Management Studio
2012-05-04 09:55:06.7100000 Gavin-VAIO\Gavin GAVIN-VAIO Microsoft SQL Server Management Studio
2012-05-04 09:55:06.7690000 Gavin-VAIO\Gavin GAVIN-VAIO Microsoft SQL Server Management Studio
The timestamp used by Extended Events is always stored in a UTC format; you may want to use the dateadd
or similar functions to format the timestamp for your time zone.
Whether or not you choose to do that depends on why you’re collecting
the data and whether local time information is important.
1.3 Viewing In-Memory Targets
Some of the targets are the result of
calculations being performed on captured data, rather than a dump of
the raw data itself — for example, the event counter. The results of
these targets are still available for viewing in SQL Server Management
Studio, but whereas the event file target was updated in almost real
time, the in-memory targets have to be manually refreshed or scheduled
to be refreshed. This is not as big a problem as it sounds, as they can
still be refreshed every few seconds; you just have to configure it
first.
For this example, the login session from the
previous section has been reconfigured and an event counter target
added. You can see this in the list of targets in SQL Server Management
Studio, as shown in Figure 6.
Once the session is running, you can right-click on the event counter target and select View Target Data. As shown in Figure 7,
this will display the event counter’s data as well as a message saying
“The target data will not be refreshed. Right click the table to
manually refresh or set the automatic refresh interval.” Right-clicking
will show that you can have it auto-refresh anywhere between every five
seconds and every hour.
You can view the results from the histogram
target in the same way that you viewed the event counter just shown;
however, because these are in-memory data structures, their results
aren’t written to the event file or in fact kept anywhere once the
session is stopped. This is perhaps where analysis of an event file
using T-SQL after testing may be more appropriate.
