Ms SQL Server C2 audit Mode

Some time ago, we found that there were a lot more trace log files in the database directory. TRC, each of which was 200 MB in size and filled up the server space ,,,

The C2 audit mode of ms SQL Server. below is the abstract of Ms technet.

You can use SQL Server Management studio orSp_configureInC2 audit ModeOption to configure the C2 audit mode. Select this option to configure the server to record the failure and successful access attempts to statements and objects. This information helps you understand system activities and track possible security policy conflicts.

C2 audit mode data is stored in a file in the default data directory of the instance. If the size of the audit log file reaches 200 MB, SQL Server creates a new file, closes the old file, and writes all new audit records to the new file. This process continues until the audit data directory is full or the audit is closed. To determine the status of the C2 trail, query the SYS. Traces directory view.

In the C2 audit mode, a large amount of event information is stored in the log file, which may cause a rapid increase in the log file. If the data directory space for saving logs is insufficient, SQL Server will disable it by itself. You must use-FFlag (skip Review) restart the instance or release more disk space for audit logs.

The following example enables the C2 audit mode.

Sp_configure 'show advanced options', 1;
Go
Reconfigure;
Go

Sp_configure 'c2 audit mode ', 1;
Go
Reconfigure;
Go