Sql-server – SQL Auditing Functionality

auditsql serversql-server-2016

Can someone tell me what the cause of this alert is that's captured by our SQL Audit trace we have setup using the built-in auditing functionality? This alert is generated from time to time in the audit log and the audit log has not been disabled or the server has not restarted.

<action_info xmlns="http://schemas.microsoft.com/sqlserver/2008/sqlaudit_data">
  <session>
    <![CDATA[EDW Audit$A]]>
  </session>
  <action>event enabled</action>
  <startup_type>automatic</startup_type>
  <object><![CDATA[audit_event]]></object>
</action_info>

Best Answer

You need to set action disabled which is given in values.

<action_info xmlns="http://schemas.microsoft.com/sqlserver/2008/sqlaudit_data"><session><![CDATA[TestServerAudit$A]]></session><action>event disabled</action><object><![CDATA[audit_event]]></object></action_info>

For more information, see SQL Server Audit Log

Related Question