create-database-audit-specification-transact-sql.md

title	CREATE DATABASE AUDIT SPECIFICATION
description	Create a database audit specification object using the SQL Server audit feature.
titleSuffix	SQL Server (Transact-SQL)
ms.custom	seo-lt-2019
ms.date	01/03/2020
ms.prod	sql
ms.prod_service	sql-database
ms.reviewer
ms.technology	t-sql
ms.topic	language-reference
f1_keywords	CREATE DATABASE AUDIT DATABASE_AUDIT_SPECIFICATION_TSQL DATABASE AUDIT SPECIFICATION CREATE_DATABASE_AUDIT_SPECIFICATION_TSQL CREATE_DATABASE_AUDIT_TSQL CREATE DATABASE AUDIT SPECIFICATION
dev_langs	TSQL
helpviewer_keywords	database audit specification CREATE DATABASE AUDIT SPECIFICATION statement
ms.assetid	0544da48-0ca3-4a01-ba4c-940e23dc315b
author	VanMSFT
ms.author	vanto

CREATE DATABASE AUDIT SPECIFICATION (Transact-SQL)

[!INCLUDEtsql-appliesto-ss2008-xxxx-xxxx-xxx-md]

Creates a database audit specification object using the [!INCLUDEssNoVersion] audit feature. For more information, see SQL Server Audit (Database Engine).

Transact-SQL Syntax Conventions

Syntax

  
CREATE DATABASE AUDIT SPECIFICATION audit_specification_name  
{  
    FOR SERVER AUDIT audit_name   
        [ { ADD ( { <audit_action_specification> | audit_action_group_name } )   
      } [, ...n] ]  
    [ WITH ( STATE = { ON | OFF } ) ]  
}  
[ ; ]  
<audit_action_specification>::=  
{  
      action [ ,...n ]ON [ class :: ] securable BY principal [ ,...n ]  
}  

Arguments

audit_specification_name
Is the name of the audit specification.

audit_name
Is the name of the audit to which this specification is applied.

audit_action_specification
Is the specification of actions on securables by principals that should be recorded in the audit.

action
Is the name of one or more database-level auditable actions. For a list of audit actions, see SQL Server Audit Action Groups and Actions.

audit_action_group_name
Is the name of one or more groups of database-level auditable actions. For a list of audit action groups, see SQL Server Audit Action Groups and Actions.

class
Is the class name (if applicable) on the securable.

securable
Is the table, view, or other securable object in the database on which to apply the audit action or audit action group. For more information, see Securables.

principal
Is the name of database principal on which to apply the audit action or audit action group. To audit all database principals use the database principal public. For more information, see Principals (Database Engine).

WITH ( STATE = { ON | OFF } )
Enables or disables the audit from collecting records for this audit specification.

Remarks

Database audit specifications are non-securable objects that reside in a given database. When a database audit specification is created, it is in a disabled state.

Permissions

Users with the ALTER ANY DATABASE AUDIT permission can create database audit specifications and bind them to any audit.

After a database audit specification is created, it can be viewed by principals with the CONTROL SERVER, ALTER ANY DATABASE AUDIT permissions, or the sysadmin account.

Examples

A. Audit SELECT and INSERT on a table for any database principal

The following example creates a server audit called Payrole_Security_Audit and then a database audit specification called Payrole_Security_Audit that audits SELECT and INSERT statements by the dbo user, for the HumanResources.EmployeePayHistory table in the AdventureWorks2012 database.

USE master ;  
GO  
-- Create the server audit.  
CREATE SERVER AUDIT Payrole_Security_Audit  
    TO FILE ( FILEPATH =   
'C:\Program Files\Microsoft SQL Server\MSSQL13.MSSQLSERVER\MSSQL\DATA' ) ;  
GO  
-- Enable the server audit.  
ALTER SERVER AUDIT Payrole_Security_Audit   
WITH (STATE = ON) ;  
GO  
-- Move to the target database.  
USE AdventureWorks2012 ;  
GO  
-- Create the database audit specification.  
CREATE DATABASE AUDIT SPECIFICATION Audit_Pay_Tables  
FOR SERVER AUDIT Payrole_Security_Audit  
ADD (SELECT , INSERT  
     ON HumanResources.EmployeePayHistory BY dbo )  
WITH (STATE = ON) ;  
GO  

B. Audit any DML (INSERT, UPDATE or DELETE) on all objects in the sales schema for a specific database role

The following example creates a server audit called DataModification_Security_Audit and then a database audit specification called Audit_Data_Modification_On_All_Sales_Tables that audits INSERT, UPDATE and DELETE statements by users in a new database role SalesUK, for all objects in the Sales schema in the AdventureWorks2012 database.

USE master ;  
GO  
-- Create the server audit.
-- Change the path to a path that the SQLServer Service has access to. 
CREATE SERVER AUDIT DataModification_Security_Audit  
    TO FILE ( FILEPATH = 
'C:\Program Files\Microsoft SQL Server\MSSQL13.MSSQLSERVER\MSSQL\DATA' ) ; 
GO  
-- Enable the server audit.  
ALTER SERVER AUDIT DataModification_Security_Audit   
WITH (STATE = ON) ;  
GO  
-- Move to the target database.  
USE AdventureWorks2012 ;  
GO  
CREATE ROLE SalesUK
GO
-- Create the database audit specification.  
CREATE DATABASE AUDIT SPECIFICATION Audit_Data_Modification_On_All_Sales_Tables  
FOR SERVER AUDIT DataModification_Security_Audit  
ADD ( INSERT, UPDATE, DELETE  
     ON Schema::Sales BY SalesUK )  
WITH (STATE = ON) ;    
GO  

See Also

CREATE SERVER AUDIT (Transact-SQL)
ALTER SERVER AUDIT (Transact-SQL)
DROP SERVER AUDIT (Transact-SQL)
CREATE SERVER AUDIT SPECIFICATION (Transact-SQL)
ALTER SERVER AUDIT SPECIFICATION (Transact-SQL)
DROP SERVER AUDIT SPECIFICATION (Transact-SQL)
CREATE DATABASE AUDIT SPECIFICATION (Transact-SQL)
ALTER DATABASE AUDIT SPECIFICATION (Transact-SQL)
DROP DATABASE AUDIT SPECIFICATION (Transact-SQL)
ALTER AUTHORIZATION (Transact-SQL)
sys.fn_get_audit_file (Transact-SQL)
sys.server_audits (Transact-SQL)
sys.server_file_audits (Transact-SQL)
sys.server_audit_specifications (Transact-SQL)
sys.server_audit_specification_details (Transact-SQL)
sys.database_audit_specifications (Transact-SQL)
sys.database_audit_specification_details (Transact-SQL)
sys.dm_server_audit_status (Transact-SQL)
sys.dm_audit_actions (Transact-SQL)
Create a Server Audit and Server Audit Specification