June 7, 2018 at 7:25 am
We've been playing around with turning on sql auditing to meet requirements for monitoring activity. We are seeing a bizarre entry with a action_id = 'UP'. It occurs when a SELECT EXCEPT query is run (select ... from schema.table except select .. from linked_server.schema.table). The EXCEPT query works fine. But we see a bunch of entries in the audit file with a action_id = 'UP' and all rows have a succeeded value of 0 (meaning it failed). In addition, more than 1 row is being written even though the SELECT statement was executed once. The object_name is the table name that I was querying, but the statement shows a query being run against sys.spt_columns_view. Not my EXCEPT query.
The link server seems to be key here, we are only seeing these entries when a link server is involved in the query. Any idea on what these UP entries could be coming from?
June 7, 2018 at 7:40 pm
We ended up putting this filter on the audit specification:
WHERE ( ... AND NOT [statement] like '%sys.spt_columns_view%' ')
It kept the "UP" rows from getting written to the file.
Viewing 2 posts - 1 through 1 (of 1 total)
You must be logged in to reply to this topic. Login to reply