Blitz Result: Server Audits Running

Microsoft SQL Server 2008 introduced new compliance features in the form of Server Audits.  They’re like traces, but they’re tuned to go faster and only track a minimum number of events.

In theory.

In practice, people can set up audits to cover a crazy number of events, like every select statement, and write all these events to file.  Performance can come to a crawl, or even worse, you can fill up the C drive with audit files.

There’s nothing wrong with auditing – but just make sure you know it’s running, and you’re actually doing something with the auditing output.

To Fix the Problem

Check with the business users to make sure they didn’t enable auditing for a good reason.  If you’ve got a company security team, ask them too.  (And take some antacid, because you’ve got a tough job.)  If nobody needs auditing, shut it off.

Return to sp_Blitz or Ask Us Questions