1

I'm trying to remove all Select statements from Log Analytics of Microsoft Azure SQL server. I found in Microsoft docs that introducing PredicateExpression in Set-AzSQLServerAudit can help me to achieve this. I tried couple of expressions to disable the logs using Powershell Cmdlet, however I still see the logs with Select statements with the same pattern as in Predicate expression.

I tried with following predicate expression already, but it still I see Select statements.

Set-AzSqlServerAudit -ResourceGroupName "myresourcegroup" -ServerName "mysqlserver" -PredicateExpression "statement <> 'exec sp_executesql N%select%' or statement <> 'SELECT 1%'"

and also, with this one

Set-AzSqlServerAudit -ResourceGroupName "myresourcegroup" -ServerName "mysqlserver" –PredicateExpression “statement <> ‘exec sp_executesql N’select%’' or statement <> 'SELECT 1%'”

Anyone has idea where am I going wrong?

arthus
  • 13
  • 4

1 Answers1

0

Could you please try the following predicate expression to see if it meets your expectations?

Set-AzSqlServerAudit -ResourceGroupName "myresourcegroup" -ServerName "mysqlserver" -PredicateExpression "statement not like '%select%'"
Alberto Morillo
  • 13,893
  • 2
  • 24
  • 30
  • Thanks it seems to be working using proper escaping and using NOT LIKE `Set-AzSqlServerAudit -ResourceGroupName "myresourcegroup" -ServerName "mysqlserver" -PredicateExpression "statement NOT LIKE 'exec sp_executesql N''select%' AND statement NOT LIKE 'SELECT 1%'" ` – arthus Aug 07 '23 at 07:14
  • I am glad. Thank for sharing with the community the adjustments you made. – Alberto Morillo Aug 07 '23 at 12:32