I'm currently removing an old Event based Auditing tool and replacing it with a SQL Audit. I'm having problems capturing events that are associated with the execution of certain stored procs.......for example
ALTER_INSTANCE which would be related to someone executing sp_configure
or
CREATE_EXTENDED_PROPERTY (Applies to sp_addextendedproperty.)
does anyone know the best way of capturing this?
Is there an audit group i can add to the SQL audit that will capture the execution of sp_configure or sp_addextendedproperty? and the command that was actually run?