Hi everyone,

I created sqlserver audit specification which should audit events to a file. However, now I want to open it and review the file and I do not know how to open it or where to import it. Any ideas?

Thanks in advance,

Kal

Kal,

You do it using T-SQL and the fn_get_audit_file table function. Here are a few examples:

SELECT AuditFile.*
FROM sys.dm_server_audit_status AS AuditStatus
 CROSS APPLY
   sys.fn_get_audit_file (AuditStatus.audit_file_path, default, default) AS AuditFile
WHERE AuditStatus.name = 'ExampleAudit';

SELECT * FROM fn_get_audit_file('C:\x\SQL_Audit\ExampleAudit*', default, default)

SELECT * FROM fn_get_audit_file('C:\x\SQL_Audit\*', default, default)

In SQL Server Management Studio:

Expland your SQL Server Instance,

Go to Security -> Audits -> and it should be in there.

Hi,

I know is really old question but just for the record, for people looking for the answer.

On the instance level go to Security -> Audits -> [Select the audit you want]->[right click] and select "View Audit Logs"

• Proposed as answer by Srinivasan Srisailam 9 minutes ago
• Unproposed as answer by Srinivasan Srisailam 9 minutes ago

Hi,

By doing this On the instance level go to Security -> Audits -> [Select the audit you want]->[right click] and select "View Audit Logs" you can see only the current audit log file but if you can't to read other SQLAUDIT files other than the current file then we need to use these Select statements from sys.Fn_get_audit tables to view the results.

SELECT * FROM sys.dm_server_audit_status AS AuditStatus
CROSS APPLY
sys.fn_get_audit_file ('E:\Program Files\Microsoft SQL Server\MSSQL10_50.SGAYDBSQL803\MSSQL\Log\DB_AUDIT_*.sqlaudit', default, default)
where event_time > '2015-03-01 01:00:01.4645079' and statement not like 'RESTORE %';
GO