- You create a server audit in Microsoft SQL Server 2012. The server audit uses a filter predicate, and the ON_FAILURE property is set to "FAIL_OPERATION."
- You create a server audit specification or a database audit specification for the server audit.
- You perform an operation against the database server.
- The operation triggers an audit event that is defined in the audit specification.
Note You can use the following query to determine whether the issue occurred:
SELECT NAME AS AUDITNAME FROM SYS.SERVER_AUDITS WHERE ON_FAILURE = 2 AND PREDICATE IS NOT NULL
If the error messages are logged in the SQL Server error log, the issue occurred.
Cumulative update information
SQL Server 2012The fix for this issue was first released in Cumulative Update 1. For more information about how to obtain this cumulative update package for SQL Server 2012, click the following article number to view the article in the Microsoft Knowledge Base:
- Do not use filter predicates.
- Set the ON_FAILURE property of the audit to "CONTINUE."
If you try to disable the audit, the disable operation may fail. This behavior may occur because the audit depends on the Audit Action groups that are specified in the server audit specification, such as SUCCESSFUL_LOGIN_GROUP, AUDIT _CHANGE_GROUP. These audits can be disabled or removed only when SQL Server is started under minimal configuration (that is, with the -f startup parameter). You can use the following query to identify the audits that can cause the problem that is described in the "Symptoms" section:
SELECT name as AuditName FROM sys.server_audits WHERE on_failure = 2 AND predicate IS NOT NULL
Article ID: 2678370 - Last Review: Nov 22, 2012 - Revision: 1