Post reply

Using Auditing Logs

  • August 31, 2005 at 11:11 am

    #102758

    Hello,

    Are SQL Server Audit Logs different than SQL Server Logs or are they the same?

    Today I changed our Auditing Level from None to All, but I don't see any activity in the SQL Server Logs. I ran a SQL Profiler trace and I can see the activity there, as it's happening, but not past events.

    When I change the Auditing Level from All back to None, then startup another Trace, I can still see the activity. I'm confused.

    Is SQL Profiler the only way to view Audit Activity? Other than a third-party tool of course.

    In addition I do not see failed logins in the Windows Event Logs. Should I?

    Thanks,

    Steve DiDomenico

    Nashua, NH

  • August 31, 2005 at 2:12 pm

    #586650

    I am not sure if the change in security audit level will take effect right of way or after a reboot.  Obviously it would not show passed activity.  I would recommend that you set your audit security to on failure instead of all because your log will be so large that you won't be able to open it to read. 

    There is also the fact that you need to click on the errorlog property to refresh so that it shows you the most current log to view it.

    Good luck.

     

    mom

     

  • September 7, 2005 at 6:31 am

    #588052

    Steve,

    Changing this setting does not take affect until SQL is restarted (either the service or a server reboot)

    This is a real headache as I have set this and had to wait several weeks for the next outage to get any logging....

    HTH

    Glenn

  • September 8, 2005 at 9:17 am

    #588423

    Hi Glenn,

    Yes, this helps.

    Thanks, Steve

Viewing 4 posts - 1 through 3 (of 3 total)

You must be logged in to reply to this topic. Login to reply