September 22, 2011 at 7:44 pm
Hi,
I've successfully created a Server Audit as follows:
[font="Courier New"]USE [master]
CREATE SERVER AUDIT [Audit-SecurityLog]
TO FILE
(FILEPATH = N'D:\temp\AuditFiles\'
,MAXSIZE = 2048 MB
,MAX_ROLLOVER_FILES = 2147483647
,RESERVE_DISK_SPACE = OFF
)
WITH(QUEUE_DELAY = 0,ON_FAILURE = CONTINUE)[/font]
Then I successfully created an Audit Specficiations as follows:
[font="Courier New"]USE [MYDB]
GO
CREATE DATABASE AUDIT SPECIFICATION [AuditOrders]
FOR SERVER AUDIT [Audit-SecurityLog]
ADD (DELETE ON OBJECT::[SA].[ORDERS] BY [public]),
...
WITH (STATE = ON)
GO[/font]
Then the Auditing works just fine.
When I viewed the Auditing logs (instance> Security> Audits> right-Click created audit and select View Audit Logs), I've seen the logs and noticed that the Date is filled incorrectly... there is exactly 10 hours difference. Windows Server hosting the SQL Server is set to Sydney time zone which is currently +10 GMT.
So, does that mean SQL Server always registers the log entries in UTC?
September 22, 2011 at 10:20 pm
Yes - audit records are registered in UTC.
Jason...AKA CirqueDeSQLeil
_______________________________________________
I have given a name to my pain...MCM SQL Server, MVP
SQL RNNR
Posting Performance Based Questions - Gail Shaw[/url]
Learn Extended Events
September 22, 2011 at 10:28 pm
Thanks for your reply.
Have a nice weekend.
Viewing 3 posts - 1 through 2 (of 2 total)
You must be logged in to reply to this topic. Login to reply