Hi,
I have created 3 Server audits on a SQL 2012 Enterprise Server to capture Read, Change and Execute separately. Initially I created them with 'Max_Files' value of 10. The Change and Execute went on well however the Read audit filled up pretty quick and started throwing error : SQL Server Audit could not write to file 'D:\Server Audit Files\Data_Read_Audit_xxxxxxxxxx.sqlaudit'.
I dropped and recreated the Read audit with Max_Rollover_Files = 20 instead but it keeps throwing error: Audit 'Read_Audit' failed to start. For more information, see the SQL Server error log. You can also query sys.dm_os_ring_buffers where ring_buffer_type = 'RING_BUFFER_XE_LOG'.
There was no record in the SQL error log and the dmv reported the following:
ring_buffer_addressring_buffer_typetimestamprecord
0x000000207D073CF0RING_BUFFER_XE_LOG205465268<Record id = "3" type ="RING_BUFFER_XE_LOG" time ="205465268"><XE_LogRecord message="file: file create or open failed (last error: 0)"></XE_LogRecord></Record>
0x000000207D073CF0RING_BUFFER_XE_LOG205451035<Record id = "2" type ="RING_BUFFER_XE_LOG" time ="205451035"><XE_LogRecord message="file: file create or open failed (last error: 0)"></XE_LogRecord></Record>
0x000000207D073CF0RING_BUFFER_XE_LOG201852211<Record id = "1" type ="RING_BUFFER_XE_LOG" time ="201852211"><XE_LogRecord message="file: file create or open failed (last error: 0)"></XE_LogRecord></Record>
0x000000207D073CF0RING_BUFFER_XE_LOG31185<Record id = "0" type ="RING_BUFFER_XE_LOG" time ="31185"><XE_LogRecord message="XE engine initialized"></XE_LogRecord></Record>
To check if this happens to other audits, I dropped and recreated the other two audits but they started without any problem.
What could possibly go wrong with the Read audit? How could it be started clean?
Thanks in advance.
Nirupam
