1

I created an audit to audit only succesfull logons. But the problem is, I did it in a test environment and it's loging a connection every second

enter image description here

Did I do something wrong ? I only selected SUCCESFULL LOGIN GROUP in the specification.

also is there a way to know how many audits for each file created?

and, is there a way to reduce the ammount of fields being audited?

EDIT: damm 2 weeks and I didnt find an answer for this.

1

I feel like this is normalish behavior but can't find any information on why. The most I see is that Microsoft's docs state that specification also logs connection reuse from the connection pool:

Events in this class are raised by new connections or by connections that are reused from a connection pool.

It does seem to be a common issue for people trying to audit logins in the same sense as you are, e.g. this Reddit post.

You may want to try Tony Hinkle's accepted answer on this StackOverflow as a workaround and see if you stop getting redundant logs in your audit. (The drawback with this solution is you have to specify each Login name you want to audit, but maybe this is a plus depending on your end goal.)

3
  • 1
    Thanks gonna read it. I just would like to login like, developer x logged in the SQL Server for example, there would be a line there like "X - Login succesful - date' – Racer SQL Dec 10 '20 at 13:34
  • Yea I gotcha. Auditing is a feature I personally haven't used much of, or honestly hear much use of (surprisingly because it does sound useful). So unfortunately I don't think there's a lot of information out there on these kinds of issues. If you know the Login names of each developer though you should be able to use Tony Hinkle's solution to achieve what you're looking for (and hopefully fix the issue you're currently experiencing). – J.D. Dec 10 '20 at 13:52
  • damm unfortunatelly it didnt solve the problem. I'm still filling the audit records with "succesfull login user x' each second. even on a test environment with only me active. I'm not even loging, I'm just there doing nothing but connected. after 1 minute I have more then 100 succesfull logins. damm – Racer SQL Dec 17 '20 at 16:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.