I'm looking to capture login failures against our Azure Database. I've set up auditing on my Azure Database as such
After running some queries, I can see login successes for the principal in question, shown by the action_id DBAS
eg
However, when generating failures both from SSMS and our application, the auditing doesnt capture any failures, which I expect to be shown with action_id DBAF
The info box for this auditing option does say its supposed to capture login failures. Is this a bug or am I doing something wrong here?
Make sure you have given correct file path. Try with below query:
select event_time,server_instance_name,database_name,action_id,server_principal_name,application_name from sys.fn_get_audit_file
('https://banuadls.blob.core.windows.net/sqldbauditlogs/dbservere/db/SqlDbAuditing_Audit_NoRetention/2024-05-31/08_44_54_724_0.xel',default,default)
where event_time <= '2024-05-31T09:11:00.5349194'
It is giving login failed error audits as shown below:
event_time | server_instance_name | database_name | action_id | server_principal_name | application_name |
---|---|---|---|---|---|
2024-05-31T08:44:55.3341817 | dbservere | AUSC | NT AUTHORITY\SYSTEM | Internal | |
2024-05-31T08:45:13.8966156 | dbservere | db | DBAF | server | Azure SQL Query Editor |
2024-05-31T08:45:14.7871436 | dbservere | db | DBAF | server | Azure SQL Query Editor |
2024-05-31T08:45:21.8808280 | dbservere | db | DBAF | server | Azure SQL Query Editor |
2024-05-31T08:54:55.4361409 | dbservere | db | DBAF | server | Microsoft SQL Server Management Studio |
2024-05-31T08:55:18.9358867 | dbservere | db | DBAF | server | Microsoft SQL Server Management Studio |
2024-05-31T09:11:00.5349194 | dbservere | db | DBAS | server | Azure SQL Query Editor |
2024-05-31T09:11:00.5349194 | dbservere | db | BCM | server | Azure SQL Query Editor |
For more information you refer to this SO answer.