CREATE EVENT SESSION [alter_db] ON SERVER 
ADD EVENT sqlserver.sp_statement_starting(
ACTION(sqlserver.client_app_name,sqlserver.client_hostname,sqlserver.client_pid,sqlserver.database_name,sqlserver.nt_username,sqlserver.session_id,sqlserver.username)
    WHERE ([sqlserver].[like_i_sql_unicode_string]([statement],N'%READ_COMMITTED_SNAPSHOT%'))),
ADD EVENT sqlserver.sql_batch_starting(SET collect_batch_text=(1)
ACTION(sqlserver.client_app_name,sqlserver.client_hostname,sqlserver.client_pid,sqlserver.database_name,sqlserver.nt_username,sqlserver.session_id,sqlserver.username)
    WHERE ([sqlserver].[like_i_sql_unicode_string]([batch_text],N'%READ_COMMITTED_SNAPSHOT%')))
ADD TARGET package0.event_file(SET filename=N'alter_db')

USE [master]
GO

CREATE SERVER AUDIT [database_change]
TO FILE 
(	FILEPATH = N'C:\temp\'
	,MAXSIZE = 0 MB
	,MAX_ROLLOVER_FILES = 2147483647
	,RESERVE_DISK_SPACE = OFF
)
WITH
(	QUEUE_DELAY = 1000
	,ON_FAILURE = CONTINUE
	,AUDIT_GUID = 'f15cecba-8be3-44b5-aa7b-9b298db4847b'
)

ALTER SERVER AUDIT [database_change] WITH (STATE = ON)
GO

USE [master]
GO

CREATE SERVER AUDIT SPECIFICATION [database_change]
FOR SERVER AUDIT [database_change]
ADD (DATABASE_CHANGE_GROUP)
WITH (STATE = ON)
GO

SELECT * FROM sys.fn_get_audit_file ('c:\temp\*.sqlaudit',default,default);