SQL Server Audit Action Group: AUDIT_CHANGE_GROUP

Available in New to:
Database
Audit
Specification 		Server
Audit
Specification 		2012 2016
• (SQL 2012) •  

This important group allows you to track changes to audit and audit specification objects which have an impact of course on the audit trail within SQL Server. This group also tracks audit failures and audit session changes. If any auditing is enabled at all on a given server it follows then that this group should certainly be enabled in the server audit specification so that audit trail integrity can be insured.

If you enable this group at the server level, you will track changes to both audit objects and server audit specifications. It will also track changes to all database audit specifications.

If you enable this group in a database it will track changes to database audit specifications within that database.

LOGbinder for SQL Server events generated under this Audit Action Group:

Event ID Description
24043 Issued a change server audit command
24044 Issued a change server audit specification command
24045 Issued a change database audit specification command
24046 Issued a create server audit command
24047 Issued a create server audit specification command
24048 Issued a created database audit specification command
24049 Issued a delete server audit command
24050 Issued a delete server audit specification command
24051 Issued a delete database audit specification command
24052 Audit failure
24053 Audit session changed
24311 Issued a change database audit command
24312 Issued a create database audit command
24313 Issued a delete database audit command

 

Upcoming Webinars
    Additional Resources