I've come across an issue where SQL Server database audit specifications have stopped writing to the security event log. The audit object will write events to a SQL audit file or the Application event log but they won't write to the Security event log.
I'm not getting any error messages in any event logs or SQL logs and I've confirmed that permissions for the SQL Server service accounts have been configured correctly.
Some servers have multiple instances of SQL Server and there are server & database audits on all of the instances. Some of the SQL Instances are 2012 SP4 and the others are 2016 SP2 CU6.
Does anyone have any ideas on what might be causing this behaviour? Should I rollback the permissions and re-apply them?