SQL Server 2017 Administrator's Guide

Configuring server audit

Audit configuration has several components--two of them are primary audit and audit specifications. Audit is a configuration object where you have to select how to store the captured events, how resilient the audit will be, and so on.

The specification is another object that you have to create, and there you specify what events should be captured:

To create the audit on the server, you can use the following TSQL code:

CREATE SERVER AUDIT [LoginAudit]TO FILE ( FILEPATH = N'E:\Audits', MAXSIZE = 1024 MB ,MAX_FILES = 20,RESERVE_DISK_SPACE = OFF )WITH ( QUEUE_DELAY = 1000 ,ON_FAILURE = CONTINUE )

This query will create ...