Skip to content

Commit 670e026

Browse files
authored
Merge pull request #98320 from JasonWHowell/patch-9
Update sql-database-audit-log-format.md
2 parents 850aa30 + 4e8d57d commit 670e026

File tree

1 file changed

+3
-5
lines changed

1 file changed

+3
-5
lines changed

articles/sql-database/sql-database-audit-log-format.md

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,6 @@ description: Understand how SQL Database audit logs are structured.
44
services: sql-database
55
ms.service: sql-database
66
ms.subservice: security
7-
ms.custom:
8-
ms.devlang:
97
ms.topic: conceptual
108
author: barmichal
119
ms.author: mibar
@@ -26,16 +24,16 @@ For example, for database `Database1` on `Server1` the following is a possible v
2624

2725
Server1/Database1/SqlDbAuditing_ServerAudit_NoRetention/2019-02-03/12_23_30_794_0.xel
2826

29-
[Read-only Replicas](https://docs.microsoft.com/en-us/azure/sql-database/sql-database-read-scale-out) Audit logs are stored in the same container. The directory hierarchy within the container is of the form `<ServerName>/<DatabaseName>/<AuditName>/<Date>/RO/`. The Blob filename shares the same format. The Audit Logs of Read-only Replicas are stored in the same container.
27+
[Read-only Replicas](sql-database-read-scale-out.md) Audit logs are stored in the same container. The directory hierarchy within the container is of the form `<ServerName>/<DatabaseName>/<AuditName>/<Date>/RO/`. The Blob filename shares the same format. The Audit Logs of Read-only Replicas are stored in the same container.
3028

3129

3230
### Event Hub
3331

34-
Audit events are written to the namespace and event hub that was defined during auditing configuration, and are captured in the body of [Apache Avro](https://avro.apache.org/) events and stored using JSON formatting with UTF-8 encoding. To read the audit logs, you can use [Avro Tools](https://docs.microsoft.com/azure/event-hubs/event-hubs-capture-overview#use-avro-tools) or similar tools that process this format.
32+
Audit events are written to the namespace and event hub that was defined during auditing configuration, and are captured in the body of [Apache Avro](https://avro.apache.org/) events and stored using JSON formatting with UTF-8 encoding. To read the audit logs, you can use [Avro Tools](../event-hubs/event-hubs-capture-overview.md#use-avro-tools) or similar tools that process this format.
3533

3634
### Log Analytics
3735

38-
Audit events are written to Log Analytics workspace defined during auditing configuration, to the `AzureDiagnostics` table with the category `SQLSecurityAuditEvents`. For additional useful information about Log Analytics search language and commands, see [Log Analytics search reference](https://docs.microsoft.com/azure/log-analytics/log-analytics-log-search).
36+
Audit events are written to Log Analytics workspace defined during auditing configuration, to the `AzureDiagnostics` table with the category `SQLSecurityAuditEvents`. For additional useful information about Log Analytics search language and commands, see [Log Analytics search reference](../log-analytics/log-analytics-log-search.md).
3937

4038
## <a id="subheading-1"></a>Audit Log Fields
4139

0 commit comments

Comments
 (0)