How to start and set up SQL Server Audit

How to start and set up SQL Server Audit

SQL Server Audit, now native to SQL Server, is integrated into SQL Server Management Studio (SSMS). This provides an easy interface for detailed auditing, which facilitates the tracking and logging of events in the SQL Server database engine.
Although a detailed description of how to implement an audit in SQL Server is beyond the scope of this article, the following steps provide an overview of the SQL Server Audit process:

1. Create a server audit that defines the target.
2. Create the necessary server and database audit specifications.
3. Enable the server audit and the specifications.
4. Read the events once they've been recorded in the target.

You can read the events in Windows Event Viewer if you configured your server audit to point to the Windows Security or Application event log. You can also use Log File Viewer in SSMS to view the Windows event logs or to view the audit binary files, if you configured your SQL Server audit to use files as your target. In addition, you can use the sys.fn_get_audit_file system function to retrieve the event data from the binary files.