I'm wondering if what I'm experiencing is intended behavior or a bug with SQL Server Audits. I'm leaning towards bug.

I set up an audit to monitor updates, inserts, & deletes to two tables. I immediately started seeing all three events captured every minute, happening through a stored proc call. After a little research I discovered that the audit is triggering from an SSIS package running a metadata check against the stored proc, not actually executing it. Even when the proc is called the table data in question only gets modified in rare situations.

When I modified to SSIS package and set DelayValidation to "true", the false positives stopped showing up in the audit log.

So, is my understanding of what an audit is supposed to do just wrong, or should it only capture events when data is truly modified in the tables being watched?

  • Did you use trace or Extended Events to capture what SSIS is actually doing? – Max Vernon Jan 10 at 17:15
  • Yes. I set up an extended event to watch for executions of the proc. It was not picking it up every minute like the audit was. But did when the package actually executed the proc. – MrTCS Jan 10 at 17:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.