sql-serverazureazure-managed-database

Azure Database Auditing not capturing login failures


I'm looking to capture login failures against our Azure Database. I've set up auditing on my Azure Database as such

enter image description here

After running some queries, I can see login successes for the principal in question, shown by the action_id DBAS eg

enter image description here

However, when generating failures both from SSMS and our application, the auditing doesnt capture any failures, which I expect to be shown with action_id DBAF

The info box for this auditing option does say its supposed to capture login failures. Is this a bug or am I doing something wrong here?

enter image description here


Solution

  • Make sure you have given correct file path. Try with below query:

    select event_time,server_instance_name,database_name,action_id,server_principal_name,application_name from sys.fn_get_audit_file
    ('https://banuadls.blob.core.windows.net/sqldbauditlogs/dbservere/db/SqlDbAuditing_Audit_NoRetention/2024-05-31/08_44_54_724_0.xel',default,default)  
    where event_time <=  '2024-05-31T09:11:00.5349194'
    

    It is giving login failed error audits as shown below:

    event_time server_instance_name database_name action_id server_principal_name application_name
    2024-05-31T08:44:55.3341817 dbservere AUSC NT AUTHORITY\SYSTEM Internal
    2024-05-31T08:45:13.8966156 dbservere db DBAF server Azure SQL Query Editor
    2024-05-31T08:45:14.7871436 dbservere db DBAF server Azure SQL Query Editor
    2024-05-31T08:45:21.8808280 dbservere db DBAF server Azure SQL Query Editor
    2024-05-31T08:54:55.4361409 dbservere db DBAF server Microsoft SQL Server Management Studio
    2024-05-31T08:55:18.9358867 dbservere db DBAF server Microsoft SQL Server Management Studio
    2024-05-31T09:11:00.5349194 dbservere db DBAS server Azure SQL Query Editor
    2024-05-31T09:11:00.5349194 dbservere db BCM server Azure SQL Query Editor

    For more information you refer to this SO answer.