When the script is generated in Profiler 2005, the default value saved for the logical operator is 1='OR', so the trace will capture more information than we initially intended.
exec sp_trace_setfilter @TraceID, 8, 1, 0, N'HOSTNAME1' -- OR
exec sp_trace_setfilter @TraceID, 8, 1, 0, N'HOSTNAME2'
exec sp_trace_setfilter @TraceID, 8, 1, 0, N'HOSTNAME3'
set @bigintfilter = 10 -- reads >= 10
exec sp_trace_setfilter @TraceID, 16, 0, 4, @bigintfilter -- AND
exec sp_trace_setfilter @TraceID, 35, 1, 6, N'DB' -- OR
In Profiler >=2008, the script has 0(AND) for the first occurrence of the column being filtered.
exec sp_trace_setfilter @TraceID, 8, 0, 0, N'HOSTNAME1' -- AND
exec sp_trace_setfilter @TraceID, 8, 1, 0, N'HOSTNAME2'
exec sp_trace_setfilter @TraceID, 8, 1, 0, N'HOSTNAME3'
exec sp_trace_setfilter @TraceID, 35,0, 6, N'DB' -- AND
set @bigintfilter = 10 -- reads
exec sp_trace_setfilter @TraceID, 16, 0, 4, @bigintfilter -- AND
This looks like a bug in Profiler 2005.
The "Security Audit>Audit Add Login to Server Role Event" will capture role drops as well, not just role adds. However, that one alone might not give you the information you're looking for, depending on what you need (such as the specific statement executed if necessary). So you could also add the Stored Procedure>RPC: Completed event, and if you want to get really granular add the SP: StmtCompleted as well.
An alternative could also be to use a server-level DDL trigger. I use a trigger on the ADD_SERVER_ROLE_MEMBER event so I can catch if one of my admins decides to throw someone into the sysadmin role without my knowledge. In my case I have an admin database with a table designed to store DDL event info and I insert a record for this type of event, among others. The full list of events you can create a trigger on is here: http://msdn.microsoft.com/en-us/library/bb522542.aspx and there are good basic examples of how to use these events in T-SQL in the trigger body here: http://msdn.microsoft.com/en-us/library/ms175941.aspx
Best Answer
Event Classes cannot be filtered, instead you select which Event Classes to include in your trace and then filter events based on the properties of each Event Class.
For example, to exclude "RPC:Completed" from your trace, on the Events Selection tab, expand Stored Procedures and uncheck the box on the left-hand side of RPC:Completed.
To only "RPC:Completed" for a particular stored procedure, you click Column Filters, locate ObjectName and add your procedure name under Like.