SQL Clone
SQLServerCentral is supported by Redgate
Log in  ::  Register  ::  Not logged in

The Future of Auditing

By Steve Jones,

This editorial was originally published on Dec 5, 2013. Is it being re-run as Steve is on holiday.

I was reading Captain's Share the other day and enjoying a quiet afternoon at home. It's a science fiction book about one man's journey in the future as a captain of a space freighter. It's an interesting series from Nathan Lowell that I've enjoyed and recommended to other science fiction fans. In the book, there's a scene where the main character is leaving his old ship as first mate and moving to a new ship as the captain. However he notes that the formal process is to deactivate his records on the old ship and ensuring they will be read only forever. The book notes they can't be deleted because they are a part of the ship's records, log entries, etc.

That seems to be a far cry from the way auditing takes place in current computer systems. Auditing of systems is under the control of the sysadmins (who are sometimes hackers) and can be altered, changed, etc. We, as software designers, haven't done a good job of ensuring the integrity and longevity of log records. In some sense, it seems to be a fundamental flaw in OS and software design to not have separated out the auditing and recording of actions from the administration and rights of the rest of the system.

I'd hope that we would recognize that auditing actions and preserving this data is something that ought to be tightly linked to, but separate from, the rest of system operation. I'd like to think that fundamental changes and actions taken on the system should be written separately to an area that is easily marked as readable by non-sysadmins that are designated to review the information. I know we have the challenges of managing the space and the problems of spurious actions being generated to fill (or rollover) logs, but I'd think after 50+ years of computing we would have considered some sort of event log that isn't under the control of the people whose actions it is recording.

SQL Server has improved its auditing features and capabilities, but far too much is still linked invariably to the sysadmin, often the same person the auditing should be watching. This is certainly one area that I hope matures in future versions as the need grows to track and review actions taken by privileged accounts.

Total article views: 268 | Views in the last 30 days: 1
Related Articles

Audit systems: a good idea or a mess to maintain?

Audit systems can be a good idea, but they can also be a mess to maintain.


Architecture for Auditing

The way in which auditing is build into our systems isn't the best way to implement the practice.


Can Auditing Fail?

It doesn't seem to be a feature that an auditing system can fail, but the application being audited ...


SQL Server System Audit Report

Ensuring that your SQL Server is secure is the job of every Database Administrator. In this article ...


History actions

History actions