Microsoft® SQL Server® 2012 Bible

969

Chapter 42: SQL Audit

42

FIGURE 42-1

Use the Create Audit dialog to defi ne SLQ Server Audit objects, which collect events defi ned

by the Server Audit Specifi cation or the Database Audit Specifi cation.

Fortunately, all the SQL Server Audit attributes may be changed after the object is created.

Even the name can be changed; however, you must fi rst disable the audit.

If “audit is confi gured to shut down” is selected, and SQL Audit does indeed shut down the server, here’s what to do:

Start SQL Server with the minimal confi guration option using the -f fl ag. This starts SQL Server in single-user mode

and puts SQL Audit into Auditing failure=continue mode.

Defi ning the Target

The events can be sent to a fi le, the Windows Security event log (not available in

Windows XP), or the Windows Application event log. If the target is the log, there are no

other options.

If the target is a fi le, the receiving directory, the size of the fi le, and the number of roll-

over fi les may be defi ned. SQL Server automatically names the fi les and places them in the

specifi ed directory. Beginning with SQL Server 2012, an option has been added to enable

you to cap the number of audit fi les without rolling over. This allows users to control the

amount of audit information and avoid risking losing audit records. When the max_files

c42.indd 969c42.indd 969 7/31/2012 10:17:48 AM7/31/2012 10:17:48 AM

http://www.it-ebooks.info