I was browsing through the Connect RSS feed recently and saw this item:SQL Server 2008 Auditing shutdown on error not working properly. It caught my eye since the changes to the auditing systems built into SQL Server 2008 seem to be well thought out and built to provide a robust, easy to use auditing process that satisfies requirements for many companies.
However if the auditing system can fill up, like with a USB device, and someone perform actions that aren't audited, that's a big deal.
But, Steve, why would anyone audit to a USB stick? I don't think they would, but I could easily see security groups auditing to a USB drive that they just "add" to a server and maintain physical access. If that's the case, and someone will do it, then as a BOFH, I can write a script to check the disk space on that device. When it's full, I can go ahead and run a few choice scripts on the server.
I'm sure this is a bug that will get fixed, but it seems like something that shouldn't have been overlooked in the first place.
Steve Jones
The Voice of the DBA Podcasts
The podcast feeds are available at sqlservercentral.mevio.com. Comments are definitely appreciated and wanted, and you can get feeds from there.
You can also follow Steve Jones on Twitter:
or now on iTunes!
- Windows Media Podcast - 19.2MB WMV
- iPod Video Podcast - 14.0MB MP4
- MP3 Audio Podcast - 3.3MB MP3
Today's podcast features music by Everyday Jones. No relation, but I stumbled on to them and really like the music. Support this great duo at www.everydayjones.com.
