locked
how to see previous audit log files in sql server 2012 RRS feed

  • Question

  • how to see previous audit log files in sql server 2012

    Thanks

    Tuesday, October 15, 2013 7:54 AM

Answers

  • I have enable the login auditing using audit of Failed login Groups. When I click on view audit logs then it is showing logs of current file. But I have lots of previous file of back date. I want to read information of those files.


    Thanks

    • Marked as answer by Sofiya Li Monday, October 21, 2013 9:12 AM
    Tuesday, October 15, 2013 1:57 PM
  • I have enable the login auditing using audit of Failed login Groups. When I click on view audit logs then it is showing logs of current file. But I have lots of previous file of back date. I want to read information of those files.


    Thanks

    Hi ,

    While creating Audit , you might have specified Audit destination , go to that filepath and get the filename of the audit file which you want to read .

    Note that , each time you disable & enable Audit , new audit file will be created with filename -> Audit name + Audit guid + some long integer value .

    Try like this ,

    SELECT * FROM sys.fn_get_audit_file ('filename.sqlaudit',default,default);
    GO

    Reference link - http://technet.microsoft.com/en-us/library/cc280765.aspx

    sathya - www.allaboutmssql.com ** Mark as answered if my post solved your problem and Vote as helpful if my post was useful **.

    • Proposed as answer by Sofiya Li Wednesday, October 16, 2013 4:36 AM
    • Marked as answer by Sofiya Li Monday, October 21, 2013 9:12 AM
    Wednesday, October 16, 2013 2:59 AM

All replies

  • how to see previous audit log files in sql server 2012

    Which log file excatly do you mean, the ErrorLog file or ... ?

    Olaf Helper

    [ Blog] [ Xing] [ MVP]

    Tuesday, October 15, 2013 8:07 AM
  • how to see previous audit log files in sql server 2012

    Thanks

    Hello ,

    Can you be more clear with question. Do you want to see log files before the date on which SQL server recently started

    sp_readerrorlog 1


    Please mark this reply as the answer or vote as helpful, as appropriate, to make it useful for other readers

    Tuesday, October 15, 2013 8:09 AM
  • you need to be explain what is the exact requirement,where in 2012 you have extended events using that you can do an AUDIT incase if you have set up.

    By default the errorlogs will have what option that you have selected at the instance level, there other Audit as well like C2 audit  & you can also see in the event logs.

    so you need to explain what is the exact requirement for you.


    Thanks, Rama Udaya.K (http://rama38udaya.wordpress.com) ---------------------------------------- Please remember to mark the replies as answers if they help and UN-mark them if they provide no help,Vote if they gives you information.

    Tuesday, October 15, 2013 10:02 AM
  • I have enable the login auditing using audit of Failed login Groups. When I click on view audit logs then it is showing logs of current file. But I have lots of previous file of back date. I want to read information of those files.


    Thanks

    • Marked as answer by Sofiya Li Monday, October 21, 2013 9:12 AM
    Tuesday, October 15, 2013 1:57 PM
  • I have enable the login auditing using audit of Failed login Groups. When I click on view audit logs then it is showing logs of current file. But I have lots of previous file of back date. I want to read information of those files.


    Thanks

    Hi ,

    While creating Audit , you might have specified Audit destination , go to that filepath and get the filename of the audit file which you want to read .

    Note that , each time you disable & enable Audit , new audit file will be created with filename -> Audit name + Audit guid + some long integer value .

    Try like this ,

    SELECT * FROM sys.fn_get_audit_file ('filename.sqlaudit',default,default);
    GO

    Reference link - http://technet.microsoft.com/en-us/library/cc280765.aspx

    sathya - www.allaboutmssql.com ** Mark as answered if my post solved your problem and Vote as helpful if my post was useful **.

    • Proposed as answer by Sofiya Li Wednesday, October 16, 2013 4:36 AM
    • Marked as answer by Sofiya Li Monday, October 21, 2013 9:12 AM
    Wednesday, October 16, 2013 2:59 AM