Microsoft SQL Server 2012 Bible

SQL Audit Technology Overview

It takes several SQL Audit components working together to create a functioning Audit. A SQL Server Audit object is a bucket that collects the audit events defined by a Server Audit Specification and the Database Audit Specification and sends the audited events to a target. Following are the facts:

• A SQL Server Audit object can be written to by one Server Audit Specification and one Database Audit Specification per database.
• A SQL Server Audit can belong to only one SQL Server instance, but there may be several SQL Server Audits within an instance.
• A Server Audit Specification defines which server-level events will be captured and passed to the SQL Audit.
• A Database Audit Specification defines which database-level events are captured and passed to the SQL Audit.
• Both Server Audit Specifications and Database Audit Specifications can define sets of events or groups to be captured. Event groups encapsulate a number of related events. Database actions include select, insert, update, and delete, and they capture the user context and the entire DML query.
• The audited data includes user context information.
• The SQL Server Audit sends all the captured events to a single target: a file, the Windows Security event log (not in Windows XP), or the Windows Application event log. The Management Studio SQL Audit UI includes a tool for browsing the audit logs.
• SQL Server Audits, Server Audit Specifications, and Database Audit Specifications can all be created and ...