Diagnosing SQL Server 2012 Using Extended Events : Viewing Data Captured by Extended Events (part 3) - Querying a Ring Buffer Using T-SQL

1.4 Querying a Ring Buffer Using T-SQL

Finally, this section consolidates what you’ve just seen in the previous two sections to query an in-memory target — in this case, a ring buffer — using T-SQL. The most likely reason you’d want to do this is because the ring buffer stores its results only in an XML format, so they have to be turned into relational data before you can analyze them further.

Ring buffers are stored in a DMV called sys.dm_xe_session_targets, and it’s from here you query their content. This final example has created a session called Logins_rb to write its data to a ring buffer target. To create this yourself, create a new session with the options highlighted in Figure 8 and Figure 9.

FIGURE 8

FIGURE 9

Once you have started the session and the ring buffer has started having event data written to it, it’s possible to query its content using a DMV to extract its content in a meaningful format, as shown in the following query:

select events.value('(event/@timestamp)[1]', 'datetime2') as [Event_Time_UTC], 
        events.value('(event/action[@name="nt_username"]/value)[1]', 
        'varchar(100)') as [NT_Username],
        events.value('(event/action[@name="client_hostname"]/value)[1]', 
        'varchar(100)') as [Client_Hostname],
        events.value('(event/action[@name="client_app_name"]/value)[1]', 
        'varchar(100)') as [Client_Appname]
from    (select event_data.query('.') as events
         from 
         (select    cast(target_data as xml) as target_data 
          from sys.dm_xe_session_targets xt 
          join sys.dm_xe_sessions xs 
          on xs.address = xt.event_session_address 
          where xs.name = 'Logins_rb' 
          and xt.target_name = 'ring_buffer' ) as data 
          cross apply target_data.nodes ('RingBufferTarget/event') as 
          results(event_data)) as tab (events)
order by [Event_Time_UTC]

The results the query returns are the same as those for the other targets you’ve previously queried; the difference is their source isn’t a physical file anymore.

As you can see from the preceding query, you’re now getting to levels of complexity far beyond what a newcomer to Extended Events would be dealing with. However, if that’s something you’re interested in investigating further, then I recommend reading the blog posts of the SQL Server community’s Extended Events expert Jonathan Kehayias. Not only has Jonathan published some great detailed articles about Extended Events but also some invaluable scripts as well; in fact the previous query was based on one of Jonathan’s.

http://sqlskills.com/blogs/jonathan/category/Extended-Events.aspx