When a new trace is created, it is defined with a set of default event classes. You can remove these event classes and add others when you create new traces. Unless removed explicitly, the default event classes are present each time a new trace is created.
These are the default event classes for a new trace.
| Default event class | Description |
|---|---|
| Audit Login Event | Collects all new connection events (for example, a client requesting a connection to a server running an instance of Microsoft® SQL Server™) since the trace was started. |
| Audit Logout Event | Collects all new disconnect events (for example, a client issues a disconnect command) since the trace was started. |
| ExistingConnection | Detects activity by all users connected to an instance of SQL Server before the trace was started. |
| RPC:Completed | Indicates that a remote procedure call (RPC) has completed. |
| SQL:BatchCompleted | Indicates that a transact-SQL batch has completed. |