The distributed processor is processing session files in bulks and discrete intervals. To troubleshoot such issues and check if all permission requirements are met, see the article: ApexSQL Audit – Permissions and requirements.For example, if there are session files that means that the auditing session is active but if there are no package files, that could mean that the distributed processer doesn’t have access to either temporary location or SQL Server. If there is no occurred event found in the auditing reports it is possible to check if the elements in this chain are out of order. This data workflow can be easily used for troubleshooting SQL auditing issues. The schematic representation would look like this: These package files will be saved in the Packages subfolder, located in the same temporary files location as the session subfolders. It will read the data from the session files and will query the SQL Server in order to process them – to filter out unnecessary information, compact it to correspond to applied filtering, and pack them in package files that are encrypted by AES256 encryption. Now the distributed processor will begin with its activities again. The session file names will have a GUID type of format and, for example, a trace session files would look like this: Note that the level of encryption in those session files is based on SQL Server native mechanisms. one of the aforementioned subfolders, based on what data collection method is used for that kind of event. If an audited event occurs, the SQL server will write it in a session file and save the file in the corresponding location, i.e. So, in case there are no objects with this name in these locations after auditing configuration is deployed from GUI there could be some issues with communication with the target SQL Server or with filtering setup.
One of the parameters would be the temporary or session files location and can be recognized in the screenshot below: It is initiated as a native SQL Server auditing session, only configured automatically instead of manually.įor example, the session based on SQL Audit technology can be seen from the SSMS’ Object Explorer as ApexSQLAudit object in the Audits folder and its filter configuration as the object in the Server Audit Specification (both are located under the Security folder). This includes initial session parameters and filtering by events. One of the initial actions of the distributed processor is to deploy the auditing session settings on the target SQL Server. This structure will be created by the process or, simply the distributed processor, which will be initiated upon applying the SQL auditing configuration from the GUI: ActiveTraces – for the session files from the Trace data collection method.ActiveSQLAudits – for the session files from the SQL Audit data collection method.ActiveSessions – for the session files from the Extended Events data collection method.When the SQL Server auditing is configured and confirmed, a set of subfolders will be created on the designated temporary files location:īased on the chosen SQL auditing data collection method the corresponding subfolder will be populated with session files: This option is labeled as the Files location within the Data storage section: The location for the session files is custom-defined within the auditing agent configuration dialogue when adding a SQL Server for auditing using the ApexSQL Audit application. When SQL auditing is deployed and running, the audited SQL Server will write audited events on the file system in form of a session file. The article will explain what happens on the file system and how the central repository communicates with an instance from the moment the auditing is applied against it. Understanding the SQL auditing mechanisms that enable data flow throughout the environment and file system, provided by ApexSQL Audit, might help in better management and prevention of unintended issues and easy troubleshooting when an issue occurs. This article will explain SQL auditing activities and the data flow through the file system and network when the activities are on the run.
0 kommentar(er)
