Post reply

Time in an Audit log is displayed in UTC format

  • September 22, 2011 at 7:44 pm

    #245255

    Hi,

    I've successfully created a Server Audit as follows:

    [font="Courier New"]USE [master]

    CREATE SERVER AUDIT [Audit-SecurityLog]

    TO FILE

    ( FILEPATH = N'D:\temp\AuditFiles\'

    ,MAXSIZE = 2048 MB

    ,MAX_ROLLOVER_FILES = 2147483647

    ,RESERVE_DISK_SPACE = OFF

    )

    WITH( QUEUE_DELAY = 0 ,ON_FAILURE = CONTINUE)[/font]

    Then I successfully created an Audit Specficiations as follows:

    [font="Courier New"]USE [MYDB]

    GO

    CREATE DATABASE AUDIT SPECIFICATION [AuditOrders]

    FOR SERVER AUDIT [Audit-SecurityLog]

    ADD (DELETE ON OBJECT::[SA].[ORDERS] BY [public]),

    ...

    WITH (STATE = ON)

    GO[/font]

    Then the Auditing works just fine.

    When I viewed the Auditing logs (instance> Security> Audits> right-Click created audit and select View Audit Logs), I've seen the logs and noticed that the Date is filled incorrectly... there is exactly 10 hours difference. Windows Server hosting the SQL Server is set to Sydney time zone which is currently +10 GMT.

    So, does that mean SQL Server always registers the log entries in UTC?

  • September 22, 2011 at 10:20 pm

    #1385523

    Yes - audit records are registered in UTC.

    Jason...AKA CirqueDeSQLeil
    _______________________________________________
    I have given a name to my pain...MCM SQL Server, MVP
    SQL RNNR
    Posting Performance Based Questions - Gail Shaw[/url]
    Learn Extended Events

  • September 22, 2011 at 10:28 pm

    #1385525

    Thanks for your reply.

    Have a nice weekend.

Viewing 3 posts - 1 through 2 (of 2 total)

You must be logged in to reply to this topic. Login to reply