SQL Clone
SQLServerCentral is supported by Redgate
 
Log in  ::  Register  ::  Not logged in
 
 
 


SQL Server AUDIT does not register Audit-Actions (2)


SQL Server AUDIT does not register Audit-Actions (2)

Author
Message
gkramer 23701
gkramer 23701
SSC Journeyman
SSC Journeyman (82 reputation)SSC Journeyman (82 reputation)SSC Journeyman (82 reputation)SSC Journeyman (82 reputation)SSC Journeyman (82 reputation)SSC Journeyman (82 reputation)SSC Journeyman (82 reputation)SSC Journeyman (82 reputation)

Group: General Forum Members
Points: 82 Visits: 282
Hi all

becaus it still puzzles me e re-entry in this forum......

Using SQL server 2008 r2 I'm trying to setup SQL AUDIT.
I just wonder why there is no log-registration when setting up several AUDIT ACTION TYPES ??
The only thing what is registered is creating, altering and dropping the audit .....

What am I missing in this .....

Regards Guus

---------------------------------------------
See this example script;
---------------------------------------------

USE [master]
GO

CREATE SERVER AUDIT [Just_a_name_server]
TO FILE
( FILEPATH = N'P:\PATH\'
,MAXSIZE = 10 MB
,MAX_ROLLOVER_FILES = 40
,RESERVE_DISK_SPACE = OFF
)
WITH
( QUEUE_DELAY = 0
,ON_FAILURE = CONTINUE
,AUDIT_GUID = 'bd31df7f-y460-4724-9688-5fth4c2c1bd7'
)
ALTER SERVER AUDIT [Just_a_name_server] WITH (STATE = ON)
GO

--##########################################################

USE [anydatabase]
GO

CREATE DATABASE AUDIT SPECIFICATION [just_a_name_database]
FOR SERVER AUDIT [Just_a_name_server]
ADD (DATABASE_ROLE_MEMBER_CHANGE_GROUP)
WITH (STATE = ON)
GO

--##########################################################

USE [master]
GO
CREATE LOGIN [TEST_USER] WITH PASSWORD=N'&^%$#$%', DEFAULT_DATABASE=[master], CHECK_EXPIRATION=OFF, CHECK_POLICY=OFF
GO

USE [anydatabase]
GO
CREATE USER [TEST_USER] FOR LOGIN [TEST_USER]
GO
USE [anydatabase]
GO
EXEC sp_addrolemember N'db_owner', N'TEST_USER'
GO

--##########################################################

SELECT * FROM fn_get_audit_file('P:\PATH\*', default, default) order by 1 desc

--##########################################################




http://msdn.microsoft.com/en-us/library/cc280663(v=sql.105).aspx

DATABASE_ROLE_MEMBER_CHANGE_GROUP
This event is raised whenever a login is added to or removed from a database role. This event class is raised for the sp_addrolemember, sp_changegroup, and sp_droprolemember stored procedures. This event is raised on any Database role member change in any database.
gkramer 23701
gkramer 23701
SSC Journeyman
SSC Journeyman (82 reputation)SSC Journeyman (82 reputation)SSC Journeyman (82 reputation)SSC Journeyman (82 reputation)SSC Journeyman (82 reputation)SSC Journeyman (82 reputation)SSC Journeyman (82 reputation)SSC Journeyman (82 reputation)

Group: General Forum Members
Points: 82 Visits: 282
To All,

I probably found the issue as described above....

Using the SSMS 2012 running against a SQL server 2018r2 will not display any results.
Loging in on the server which hosts the SQL engine, opening SSMS (the servers version) will prompt the AUDIT results......

mvg Guus
Go


Permissions

You can't post new topics.
You can't post topic replies.
You can't post new polls.
You can't post replies to polls.
You can't edit your own topics.
You can't delete your own topics.
You can't edit other topics.
You can't delete other topics.
You can't edit your own posts.
You can't edit other posts.
You can't delete your own posts.
You can't delete other posts.
You can't post events.
You can't edit your own events.
You can't edit other events.
You can't delete your own events.
You can't delete other events.
You can't send private messages.
You can't send emails.
You can read topics.
You can't vote in polls.
You can't upload attachments.
You can download attachments.
You can't post HTML code.
You can't edit HTML code.
You can't post IFCode.
You can't post JavaScript.
You can post emoticons.
You can't post or upload images.

Select a forum

































































































































































SQLServerCentral


Search