Post reply

SQL Audit Error "Server Audit could not write to the security log"+tempdb growth

  • February 19, 2020 at 9:47 pm

    #3727211

    Hello!

    We have setup Audit on SQL 2016 SP2, we are getting this alert from one server only:

    DESCRIPTION:   SQL Server Audit could not write to the security log.

    SQL Server Service Account does show up under registry and is added to generate audit scripts as well.

    I have changed the queue delay but still this error shows up periodically .

     

    Also, noticed that tempdb drive is getting full, does SQL Audit cause tempdb to get full?

     

    Thanks in advance.

     

    • This topic was modified 4 years, 9 months ago by  PJ_SQL.

  • February 20, 2020 at 10:10 pm

    #3727511

    Thanks for posting your issue and hopefully someone will answer soon.

    This is an automated bump to increase visibility of your question.

  • February 21, 2020 at 9:14 am

    #3727592

    What is the location of the security log?  Does the SQL Server service account have access to it?

    John

  • February 21, 2020 at 10:10 pm

    #3727838

    It writes to Windows Event and SQL Service account does have access.

  • March 2, 2020 at 9:00 am

    #3730059

    The only thing I can think of is maybe you've reached a size limit on your security event log?

    John

  • March 4, 2020 at 3:52 am

    #3730764

    I thought so too.

    But, do you know why it would fill up tempdb?

  • March 4, 2020 at 9:26 am

    #3730791

    No, I'm afraid don't.  Are you sure it's linked to the SQL Audit thing, or could it be just a coincidence?  Did you run sp_whoisactive or something like that during the incident to find out which processes are using the most tempdb?

    John

  • March 4, 2020 at 5:06 pm

    #3730970

    I was not able to run the command.

    But, I have been checking now and then and do not see any other databases using tempdb. Only think I can say is there is lot of traffic on that instance.

    The other thing I can try is just enable audit for few databases at a time and see how it goes.

     

    Thanks.

Viewing 8 posts - 1 through 7 (of 7 total)

You must be logged in to reply to this topic. Login to reply