SQL Audit - Can you tie an audit entry back to it's "Audit Action type"

• AbrahamLeftJoin

  SSC-Addicted

  Points: 441

  More actions

  February 25, 2014 at 2:47 pm

  #396324

  I'm running some tests to see what is returned by the various "Audit Action Types" on a SQL 2012 Server. I use a query to read the Audit file into a table and analyze them. So far I cannot find an ID, etc that tells me what "Audit Action Type" produced the audit entry. Is there a way to determine this?

• Jack Corbett

  SSC Guru

  Points: 184394

  More actions

  February 26, 2014 at 12:33 pm

  #1692405

  I can't find "AUdit Action Type" in an audit. I see an action and a class. Here's a query I'd potentially use:

  SELECT *

  FROM sys.fn_get_audit_file([Path],

  DEFAULT, DEFAULT) AS fgaf

  JOIN sys.dm_audit_actions AS daa ON daa.action_id = fgaf.action_id

  JOIN sys.dm_audit_class_type_map AS dactm ON dactm.class_type = fgaf.class_type

  JOIN sys.dm_audit_actions AS daa2 ON dactm.class_type_desc = daa2.class_desc

  Jack Corbett
  Consultant - Straight Path Solutions
  Check out these links on how to get faster and more accurate answers:
  Forum Etiquette: How to post data/code on a forum to get the best help
  Need an Answer? Actually, No ... You Need a Question