A database audit specification defines which activities to record inside one database and attaches those rules to an audit object. It supports fine-grained auditing, down to SELECT statements, unlike instance-focused auditing. section 14.5
Mistake: enabling every available action type. Auditing unnecessary low-level events can affect performance on a busy server, so reserve detailed database auditing for compliance requirements or specific investigations. section 14.5
Apply these rules when planning database-level auditing:
- Create a separate database audit specification in each database that requires coverage. section 14.5
- Select only the action types required by the compliance need or investigation, then review the performance impact. section 14.5
- Pair database-level coverage with instance-level auditing when administrative activity and nonrepudiation matter. section 14.5
Table 14.2 Audit action types (view table figure)
| Audit action type |
Description |
|---|---|
| AUDIT_CHANGE_GROUP |
The event is raised when an audit is created, dropped, or altered. Adding this will ensure nonrepudiation if an administrative user tries to shut down an audit, perform a nefarious activity, and then reenable it. |
| DBCC_GROUP |
The event is raised when a DBCC statement is run. |
| SERVER_OBJECT_CHANGE_GROUP |
The event is raised when an instance-level object is created, dropped, or altered. |
| SERVER_OBJECT_PERMISSION_CHANGE_GROUP |
The event is raised when permissions are assigned to or revoked from a schema-bound object. |
| SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP |
The event is raised when the owner of an instance-level object is changed. |
| SERVER_OPERATION_GROUP |
The event is raised when instance configuration changes are made. |
| SERVER_PERMISSION_CHANGE_GROUP |
The event is raised when permissions are assigned to or revoked from instance-level permissions. |
| SERVER_PRINCIPAL_CHANGE_GROUP |
The event is fired when instance-level principals are created, dropped, or altered. |
| SERVER_PRINCIPAL_IMPERSONATION_GROUP |
The event is raised when impersonation of an instance-level principal occurs. |
| SERVER_ROLE_MEMBER_CHANGE_GROUP |
The event is raised when the membership of a server role is changed. |
| SERVER_STATE_CHANGE_GROUP |
The event is raised when the state of the instance is modified. |
Use the audit action-type reference to identify the events appropriate for the required auditing scope. section 14.5
