I'm wondering if what I'm experiencing is intended behavior or a bug with SQL Server Audits. I'm leaning towards bug.
I set up an audit to monitor updates, inserts, & deletes to two tables. I immediately started seeing all three events captured every minute, happening through a stored proc call. After a little research I discovered that the audit is triggering from an SSIS package running a metadata check against the stored proc, not actually executing it. Even when the proc is called the table data in question only gets modified in rare situations.
When I modified to SSIS package and set DelayValidation to "true", the false positives stopped showing up in the audit log.
So, is my understanding of what an audit is supposed to do just wrong, or should it only capture events when data is truly modified in the tables being watched?