0

I have server level auditing on SQL Server 2014. Why am I receiving database-level audit events (such as SELECT, INSERT, UPDATE, DELETE, etc.), even though there are no database audit specifications?

I see these, for example running the following command:

SELECT *
FROM fn_get_audit_file('\Audit\*', DEFAULT, DEFAULT)
WHERE [action_id] = 'SL'

But I have not specified database auditing. The following commands come back with no results:

SELECT * FROM sys.database_audit_specifications
SELECT * FROM sys.database_audit_specification_details

It's on Microsoft SQL Server 2014 Standard (SP1-GDR) - 12.0.4237.0

1

1 Answer 1

0

You probably defined the SCHEMA_OBJECT_ACCESS_GROUP for the server audit.

You can capture database level events at the server level, like above. This will then be applied for all databases. Above captures all SELECT etc on all tables and views on the entire instance.

This explains why you see SELECT events without having a database audit specification.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.