We have to do information assurance remediation on our SQL Server 2012 and came across the following finding:
Check to see that all required events are being audited. So I ran these queries:
select DISTINCT traceid from ::fn_trace_getinfo('0') Select DISTINCT(eventid) FROM ::fn_trace_geteventinfo('1')
This returned about 34 different
eventids that I assume are being used for audit purposes. Most of the items returned are NOT to be audited and should be replaced with others. However, I have no idea how to remove eventids and how to add new ones. For instance I am missing
14,15,112,113,114,118,128,129 and many others. So my question is how to I remove these audits and add news ones? A way to script it would be best or at least run it as a query.