Has anyone encountered an error that Sql Server LocalDb cannot start an audit aimed at the application log (or security log)?
it seems like problem only for the localdb instance.
sys.dm_os_ring_buffers view contains the following information[
i try to use two approaches:
first one:
CREATE SERVER AUDIT [AUDIT_SELECT1]
TO APPLICATION_LOG WITH (QUEUE_DELAY = 1000, ON_FAILURE = CONTINUE, AUDIT_GUID = 'ae479947-14a9-452a-b65d-adef1efd0c7e')
ALTER SERVER AUDIT [AUDIT_SELECT1] WITH (STATE = ON)
GO
second:
CREATE SERVER AUDIT [AUDIT_SELECT2]
TO SECURITY_LOG WITH (QUEUE_DELAY = 1000, ON_FAILURE = CONTINUE, AUDIT_GUID = '97a09f27-00e1-4d01-b20c-ab9d307b112b')
ALTER SERVER AUDIT [AUDIT_SELECT2] WITH (STATE = ON)
GO
first audit started, but does not write any audit entry to the application log, and ring buffers contains info about it: applog: event write failed (last error:6)
second audit does not start, and has info about: seclog: event source installation failed (last error:1314) seclog: event source registration failed (last error: 0) Target 'asynchronous_security_audit_security_log_target' creation failed and did not call SetLastError()
I made all the settings according to the documentation https://learn.microsoft.com/en-us/sql/relational-databases/security/auditing/write-sql-server-audit-events-to-the-security-log?view=sql-server-ver16
but it does not help. audit when target is event file normally started and write event entries. what the hack with application/security logs?
