I need to audit the few SQL Server Logins, I have used filters while creating Server Audit by using
CREATE SERVER AUDIT [audit123] TO FILE ( FILEPATH = N'D:\' ,MAXSIZE = 2048 MB ,MAX_ROLLOVER_FILES = 6 ,RESERVE_DISK_SPACE = OFF ) WITH ( QUEUE_DELAY = 5000 ,ON_FAILURE = CONTINUE ) WHERE ([server_principal_name]='AAA')
But when I am including more SQL logins using
where ([server_principal_name] in ('AAA','BBB','CCC')) it's giving error. I have tried using below but failed to create audit for 2 or more logins.
ALTER SERVER AUDIT audit123 WHERE server_principal_name ='BBB'; ALTER SERVER AUDIT audit123 WHERE server_principal_name ='CCC';