Audit

Get-DbaInstanceAudit

Garry Bargsley (@gbargsley), blog.garrybargsley.com

Get-DbaInstanceAudit View Source Garry Bargsley (@gbargsley), blog.garrybargsley.com Windows, Linux, macOS Synopsis Retrieves SQL Server audit objects from instance-level security auditing configurations. Description Retrieves all configured SQL Server audit objects at the instance level, which define where security audit events are stored and how they’re managed. These audits capture login attempts, permission changes, and other security-related activities across the entire SQL Server instance. The function returns detailed information including audit file paths, size limits, rollover settings, and current status, helping DBAs monitor compliance and troubleshoot security configurations without manually querying system views.

Get-DbaInstanceAuditSpecification

Garry Bargsley (@gbargsley), blog.garrybargsley.com

Get-DbaInstanceAuditSpecification View Source Garry Bargsley (@gbargsley), blog.garrybargsley.com Windows, Linux, macOS Synopsis Retrieves server-level audit specifications from SQL Server instances for compliance and security monitoring Description Returns all server-level audit specifications configured on SQL Server instances, including their enabled status, associated audit names, and configuration details. This helps DBAs inventory audit configurations for compliance reporting, security assessments, and ensuring proper event monitoring is in place. Server audit specifications define which events are captured by SQL Server Audit at the instance level, such as login attempts, permission changes, and database access patterns.

Read-DbaAuditFile

Chrissy LeMaire (@cl), netnerds.net

Read-DbaAuditFile View Source Chrissy LeMaire (@cl), netnerds.net Windows, Linux, macOS Synopsis Parses SQL Server audit files (.sqlaudit) into structured event data for security analysis and compliance reporting. Description Reads and parses SQL Server audit files (.sqlaudit) created by SQL Server Audit functionality, converting binary audit data into readable PowerShell objects. Each audit event is returned with its timestamp, event details, fields, and actions in a structured format that’s easy to filter, export, or analyze.