I've come across an issue where SQL Server database audit specifications have stopped writing to the security event log. The audit object will write events to a SQL audit file or the Application event log but they won't write to the Security event log.

I'm not getting any error messages in any event logs or SQL logs and I've confirmed that permissions for the SQL Server service accounts have been configured correctly.

Some servers have multiple instances of SQL Server and there are server & database audits on all of the instances. Some of the SQL Instances are 2012 SP4 and the others are 2016 SP2 CU6.

Does anyone have any ideas on what might be causing this behaviour? Should I rollback the permissions and re-apply them?

  • Welcome to dba.se! Good first question :) You can improve it by adding sample code or a minimum reproduction if possible. If others can reproduce the problem for themselves, that makes it much easier to confirm the behaviour and come back with a great answer for you. – Peter Vandivier Jun 13 '19 at 8:21
  • Are you seeing any errors in the SQL Server error log when these events fail to write? Have you confirmed your SQL Server service account has the Generate Security Audit and Audit Object Access user rights on the machine? – HandyD Jun 14 '19 at 0:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.