because of GDPR we need a system that monitores all activities that administrators does on an SQL Server. First goal is to audit sysadmin activities (selects too), but if possible activities of DBowners too.
I think the ideal solution would be, that a DAM (Database activity monitoring) gets the activities directly from SQL Server Memory and write it to an syslog-server. And this ideal solution must recognize if a sysadmin with local admin rights trys to stop or manipulate the auditing.
One not so ideal solution is to audit sysamins trough sniffing (ergo separation of dutys because this is a network administrator work...), but because normaly a DBA is local admin too and they logins often with RDP sessions..., so thats not a perfect solution.
An other solution is maybe that DBAs cannot be more local admins on their SQL - Server and the solution writes in the security log and a local service gets the infos from security log and write to the syslog server.
But maybe i think to complicated and it exists easyer solutions...
We need it for SQL 2014 or higher. If SQL 2014 is to old than SQL 2017 or higher version.
What do you consider?