Auditing Revisited, Makes No Sense To Me

Back in January, I did a series on simple auditing which walked through setting up an audit and creating a simple SSRS report.  I actually used the report and the query that I demonstrated for a couple of servers in my stack that require auditing.  The basis of this revolves around the following line of code:

SELECT * FROM fn_get_audit_file (‘g:\auditing\*’, DEFAULT, DEFAULT)

This line of code runs great for my login and I never gave it much thought because I am running it from a sysadmin account.  When asked for users to be able to run this report that is when things are getting sticky.  I cannot fathom why a simple query for log data cannot be attributed to a read-only account.  In order for you to run this select statement you either need a sysadmin level account or the CONTROL SERVER permission which pretty much gives you the keys to the kingdom.  Why would they do that?

I am sure there is a great technical reason, but why not allow it to filter down to read-only access to simply view the data?  With those permissions whoever is in charge of running the audit can manipulate the data however they see fit.  That makes no sense to me but then again who am I in the grand scheme of things?  Shortly I will post a few different scenarios in how to solve this problem.  Enjoy!

Advertisements

About SQLGator

Florida Gator and Microsoft Data Platform MVP, Star Wars fanatic and is there anything else...oh yeah PS4! I am a geek and SQL Server DBA who dabbles with VMWare, there are other technologies greater than these? Not so fast my friend! I also love to travel to new and exotic places.

Posted on May 9, 2013, in Auditing and tagged , . Bookmark the permalink. Leave a comment.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: