Documentation - V-213943

Title

SQL Server must be configurable to overwrite audit log records, oldest first (First-In-First-Out - FIFO), in the event of unavailability of space for more audit log records.

Description

<VulnDiscussion>It is critical that when SQL Server is at risk of failing to process audit logs as required, it take action to mitigate the failure. Audit processing failures include; software/hardware errors; failures in the audit capturing mechanisms; and audit storage capacity being reached or exceeded. Responses to audit failure depend upon the nature of the failure mode. When availability is an overriding concern, approved actions in response to an audit failure are as follows: (i) ...

Fix Text (Documentation Requirement)

If SQL Server Audit is in use, configure SQL Server Audit to continue to generate audit records, overwriting the oldest existing records, in the case of an auditing failure. Run this T-SQL script for each identified audit: ALTER SERVER AUDIT [AuditName] WITH (STATE = OFF); GO ALTER SERVER AUDIT [AuditName] to file (max_rollover_files = IntegerValue); GO ALTER SERVER AUDIT [AuditName] WITH (STATE = ON); GO