On my Mssql 2008r2 I created a server audit for all login and logout:
USE MASTER GO CREATE SERVER AUDIT audit_test TO FILE (FILEPATH = 'D:\Audit') GO CREATE SERVER AUDIT SPECIFICATION audit_test_spec FOR SERVER AUDIT [audit_test] ADD (FAILED_LOGIN_GROUP), ADD (SUCCESSFUL_LOGIN_GROUP), ADD (LOGOUT_GROUP) WITH (STATE=ON) GO
For maximum file space I have set 1024 MB, more than enough.
However, when from the SQL Server Management Studio I go to security/audits/audit_test/view audit logs it only displays exactly the latest 1.000 rows. On the other hand, the file produced by the audit is 317 MB, so I guess it has more than 1.000 rows.
I even tried setting a filter, but it did not help: no line appear outside the latest 1.000.
How do I read the audit log file?