Post reply

SQL Server 2008 R2 Audit Log

  • March 26, 2021 at 3:51 am

    #3862284

    In my sql server instance I renamed 'sa' account and disabled. I confirmed no sa account.  I configured server side audit log and I can see some sa activities. How is it possible?

     

    Attachments:
    You must be logged in to view attached files.

  • March 27, 2021 at 4:10 am

    #3862622

    Thanks for posting your issue and hopefully someone will answer soon.

    This is an automated bump to increase visibility of your question.

  • March 27, 2021 at 1:58 pm

    #3862706

    veeramani-408723 wrote:

    In my sql server instance I renamed 'sa' account and disabled. I confirmed no sa account.  I configured server side audit log and I can see some sa activities. How is it possible?

    Do you have something like some monitoring or other software on another box that has an "sa" user on it for its own database that's accessing the box with the audit on it?  I recently ran into a similar problem.  Unfortunately, the infrastructure group fixed the other box before I could study it, so that's about the only hint I can provide on this.

    --Jeff Moden

    RBAR is pronounced "ree-bar" and is a "Modenism" for Row-By-Agonizing-Row.
    First step towards the paradigm shift of writing Set Based code:
    ________Stop thinking about what you want to do to a ROW... think, instead, of what you want to do to a COLUMN.

    Change is inevitable... Change for the better is not.

    Helpful Links:
    How to post code problems
    How to Post Performance Problems
    Create a Tally Function (fnTally)

Viewing 3 posts - 1 through 2 (of 2 total)

You must be logged in to reply to this topic. Login to reply