Create an Extended Events session: capture slow queries to file and read them

Command

SET QUOTED_IDENTIFIER ON;
CREATE EVENT SESSION [dba_long_queries] ON SERVER
ADD EVENT sqlserver.sql_statement_completed (
    ACTION (sqlserver.client_app_name, sqlserver.client_hostname, sqlserver.database_name,
            sqlserver.session_id, sqlserver.sql_text, sqlserver.username, sqlserver.query_hash)
    WHERE (duration >= 1000000 AND sqlserver.is_system = 0)),   -- 1 s (microseconds)
ADD EVENT sqlserver.rpc_completed (
    ACTION (sqlserver.client_app_name, sqlserver.client_hostname, sqlserver.database_name,
            sqlserver.session_id, sqlserver.sql_text, sqlserver.username, sqlserver.query_hash)
    WHERE (duration >= 1000000 AND sqlserver.is_system = 0))
ADD TARGET package0.event_file (SET filename = N'D:\XE\dba_long_queries.xel',
                                    max_file_size = 256, max_rollover_files = 4)
WITH (MAX_MEMORY = 8 MB, EVENT_RETENTION_MODE = ALLOW_SINGLE_EVENT_LOSS,
      MAX_DISPATCH_LATENCY = 15 SECONDS, STARTUP_STATE = OFF);

ALTER EVENT SESSION [dba_long_queries] ON SERVER STATE = START;

-- Read:
SELECT x.value('(event/@name)[1]', 'sysname')                                AS event_name,
       x.value('(event/@timestamp)[1]', 'datetime2')                         AS utc_time,
       x.value('(event/data[@name="duration"]/value)[1]', 'bigint') / 1000   AS duration_ms,
       x.value('(event/data[@name="cpu_time"]/value)[1]', 'bigint') / 1000   AS cpu_ms,
       x.value('(event/data[@name="logical_reads"]/value)[1]', 'bigint')     AS logical_reads,
       x.value('(event/action[@name="database_name"]/value)[1]', 'sysname')  AS db,
       x.value('(event/action[@name="client_app_name"]/value)[1]', 'nvarchar(256)') AS app,
       x.value('(event/action[@name="sql_text"]/value)[1]', 'nvarchar(max)') AS sql_text
FROM  (SELECT CAST(event_data AS XML) AS x
       FROM sys.fn_xe_file_target_read_file(N'D:\XE\dba_long_queries*.xel', NULL, NULL, NULL)) t
ORDER BY duration_ms DESC;

-- When done:
-- ALTER EVENT SESSION [dba_long_queries] ON SERVER STATE = STOP;
-- DROP EVENT SESSION [dba_long_queries] ON SERVER;

What it does

Creates a lightweight Extended Events session that writes statements and RPC calls longer than 1 second to disk with application, host, user, database and SQL text; turns the .xel files into rows with T-SQL.

When to use it

For intermittent slowness complaints, when you need client details (app/host) that Query Store does not show, and as a replacement for SQL Trace/Profiler.

Caution

A very low threshold (e.g. 0) fills files quickly and adds overhead on a busy server; filter in the WHERE predicate, not afterwards. The sql_text action is expensive at high volume. The folder must be writable by the SQL Server service account. duration and cpu_time are in microseconds. Stop/drop the session when done; with STARTUP_STATE = OFF it does not start after a restart.