Audit Event - DML Transaction Events are Server Level

We recently started getting a large quantity of DML Begin/Commit/Rollback Transaction Audit Events recorded.  There is no database listed, the login is different for the events and the Application tends to be from three different main sources.  What would cause these to be reported at a server level, seeing as there is no database listed?

  • It's possible that you are collecting elements from the master database. Let me check and get back to you shortly.

  • Look at the Audit Events in SQLcm.  Between each Begin Tran and either Commit or Rollback, will list the queries that were run (provided we are capturing those).  The Begin Tran database will reflect what the first statement would have for the database, as the last statement would be used for either the commit or rollback.

    For example, I started a transaction on one database (TestDB1), and the last line before doing a rollback, I did a USE TestDB2 (this is a query command I dont capture).  When I captured the events, the rollback shows TestDB2.  Some events do not reference a database.  I suspect that is why there is no database shown for the transaction event.

  • Here is an example of one of the events being captured.  There are no SQL Scripts being captured between the begin and commit, only the random begin/commit/rollback.  I'm only tracking two databases, one of which we are tracking DML statements on.  The job captured in this event never touches any monitored databases, doesn't use explicit transactions, and runs against a specific database.  

  • I get things similar to this as well.  There should be a way of filtering out things when the target it blank.

    Example being: