SQL Audits stopped working

We recently noticed that SQL auditing had stopped working on 3 of 4 servers that we had turned on audits.  When I would view the audit, it contained entries related to the startup of the audit but not anything about items the audit should contain. We are writing the audits to a file, parsing the information and storing it in another database using a stored proc.

We have 3 separate audits.  Once for failed logons, one for instance permission changes and another for database permissions changes.  None of these audits were generating entries when I simulated failed logon or if I changed permissions.  I had a failed logon audit in the logs on 8/21. We patched the instances with July's SQL security update and applied August Windows patches on 8/23.  I didn't see anything as I did an internet search referencing patches breaking the audits.

The fix was easy, I had to remove and re-enable the audit and audit specification for each of the three audit types.  I'm not clear either why one of the 4 servers continues to work.  All the OSs are 2008R2.  Two of the instances are 2012 STD with SP2 and two of the instances are 2008 R2 ENT w/ SP3.  Audits kept working on one of the SQL 2012 boxes.

August 31st, 2015 4:30pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics