2

Can someone tell me what the cause of this alert is that's captured by our SQL Audit trace we have setup using the built-in auditing functionality? This alert is generated from time to time in the audit log and the audit log has not been disabled or the server has not restarted.

<action_info xmlns="http://schemas.microsoft.com/sqlserver/2008/sqlaudit_data">
  <session>
    <![CDATA[EDW Audit$A]]>
  </session>
  <action>event enabled</action>
  <startup_type>automatic</startup_type>
  <object><![CDATA[audit_event]]></object>
</action_info>

1 Answer 1

1

You need to set action disabled which is given in values.

<action_info xmlns="http://schemas.microsoft.com/sqlserver/2008/sqlaudit_data"><session><![CDATA[TestServerAudit$A]]></session><action>event disabled</action><object><![CDATA[audit_event]]></object></action_info>

For more information, see SQL Server Audit Log

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.