Explanation/Reference:
Note:
* An audit must exist before creating a server audit specification for it. When a server audit specification is created, it is in a disabled state.
* The general process for creating and using an audit is as follows.
1. Create an audit and define the target.
2. Create either a server audit specification or database audit specification that maps to the audit. Enable the audit specification.
3. Enable the audit.
4. Read the audit events by using the Windows Event Viewer, Log File Viewer, or the fn_get_audit_file function.
* (Box 2) Example:
Creating a server audit with a Windows Application log target with options CREATE SERVER AUDIT HIPAA_Audit
TO APPLICATION_LOG
WITH ( QUEUE_DELAY = 1000, ON_FAILURE = SHUTDOWN);
* Box 4 Example:
/*Creates a server audit specification called "HIPPA_Audit_Specification" that audits failed logins for the SQL Server audit "HIPPA_Audit" created above.
*/
CREATE SERVER AUDIT SPECIFICATION HIPPA_Audit_Specification
FOR SERVER AUDIT HIPPA_Audit
ADD (FAILED_LOGIN_GROUP);
GO
-- Enables the audit.
ALTER SERVER AUDIT HIPAA_Audit
WITH (STATE = ON);
GO