Which edition of SQL Server have the granular audit capability?

All of that changed with SQL Server 2008 – depending on your edition. SQL Server 2008 introduced a comprehensive, granular and high performance audit capability simply called SQL Audit.

What auditing capabilities are available in SQL Server?

SQL Server audit lets you create server audits, which can contain server audit specifications for server level events, and database audit specifications for database level events. Audited events can be written to the event logs or to audit files.

How do I enable SQL auditing?

Enabling SQL Server Audit

In the Object Explorer panel on the left, expand Security.
Right-click Audits and select New Audit… from the menu.
In the Create Audit window, give the audit settings a name in the Audit name.

How do I audit SQL Server?

An audit can be created either by using SQL Server Management Studio, by using transact SQL or SQL Server Management Objects (SMO). In SQL Server Management Studio an audit can be created under Audit node which resides under the Security node in the Object Explorer.

Where are SQL Server audit logs?

To view a SQL Server audit log In Object Explorer, expand the Security folder. Expand the Audits folder. Right-click the audit log that you want to view and select View Audit Logs.

What is server audit specification?

A Server Audit Specification defines which Audit Action Groups will be audited for the entire server (or “instance”). Some audit action groups comprise server level actions like the creation of a database or modification of a server role and hence are only applicable to the server itself.

How do you audit a SQL query?

To audit the execution of SELECT statements on a specific database:

Expand the Security folder.
Select New Audit and set the Audit name (e.g. AuditSELECTsServerSpecification) and the File path (e.g. C:\AUDITs) in the Create Audit dialog.
Confirm the SQL Server audit object creation by clicking OK.

How do I find SQL audit logs?

To view a SQL Server audit log

In Object Explorer, expand the Security folder.
Expand the Audits folder.
Right-click the audit log that you want to view and select View Audit Logs. This opens the Log File Viewer -server_name dialog box. For more information, see Log File Viewer F1 Help.
When finished, click Close.

How do I find database audit specification?

Implement Database Level Audit The process is relatively the same to create a database level audit specification, the main difference is that the option is located under the Security folder on each database. Right click on the Database Audit Specification folder and then New Database Audit Specification…

How do I open a .sqlaudit file?

Which components are part of SQL Server audit?

The SQL Server Audit feature consists of three main components that combine together to produce a complete SQL Server Audit solution….These components are:

The SQL Server Audit feature (required)
The Database Audit Specification (optional)
The Server Audit Specification (optional)

What is SQL auditing in SQL Server 2012 standard edition?

In SQL Server 2012 server level auditing is now also available to Standard Edition users. The auditing feature was designed to provide a secure auditing platform with a minimal performance impact, which is easy to manage and able to satisfy all audit queries. In order to user SQL Auditing, 3 components may be configured:

What is the best way to facilitate SQL Server auditing?

SQL Server has a host of features to facilitate auditing. Depending on your auditing requirements one or a combination of these features may be the best way to achieve your goal. SQL Server has offered C2 auditing since SQL Server 2000 in order to be classified under the C2 auditing criteria prescribed by the Department of Defence.

What are SQL Server audit action groups and audit actions?

Database-level audit action groups and audit actions are described in the topic SQL Server Audit Action Groups and Actions. The results of an audit are sent to a target, which can be a file, the Windows Security event log, or the Windows Application event log.

Can multiple database audit specifications be linked to a single server audit?

Multiple database audit specifications can be linked to a single Server Audit. The information recorded in the audit logs can be read by using the fn_get_audit_file function, as indicated below.