I have a server audit specification that track some actions (for PCI) including FAILED_LOGIN_GROUP, LOGIN_CHANGE_PASSWEORD_GROUP etc. I see in the audit file many recent login fails audits (which means the audit is active) but when changing a SQL Login password or creating \ changing properties of existing login, I see no new records in the audit destination (which is the security log). Any idea why? How should I generate test code to trigger this audit action group to verify it is active?
This is the script for the audit:
USE [master]
GO
/****** Object: Audit [Audit_SecurityLog] Script Date: 08/05/2013 03:45:04 ******/
CREATE SERVER AUDIT [Audit_SecurityLog]
TO SECURITY_LOG
WITH
( QUEUE_DELAY = 1000
,ON_FAILURE = CONTINUE
,AUDIT_GUID = '6de7f5e9-a926-46dc-b940-1049ed7e4f12'
)
GO
USE [master]
GO
CREATE SERVER AUDIT SPECIFICATION [ServerAudit_SecurityLog]
FOR SERVER AUDIT [Audit_SecurityLog]
ADD (SERVER_ROLE_MEMBER_CHANGE_GROUP),
ADD (AUDIT_CHANGE_GROUP),
ADD (SERVER_OBJECT_PERMISSION_CHANGE_GROUP),
ADD (SERVER_PERMISSION_CHANGE_GROUP),
ADD (SERVER_PRINCIPAL_IMPERSONATION_GROUP),
ADD (FAILED_LOGIN_GROUP),
ADD (SERVER_OBJECT_CHANGE_GROUP),
ADD (SERVER_PRINCIPAL_CHANGE_GROUP),
ADD (SERVER_OPERATION_GROUP),
ADD (LOGIN_CHANGE_PASSWORD_GROUP),
ADD (SERVER_STATE_CHANGE_GROUP),
ADD (SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP)
WITH (STATE = ON)
GO