Home / Azure / Fix Azure SQL Database Auditing Not Writing

Azure

Fix Azure SQL Database Auditing Not Writing

Resolve Azure SQL audit log issues by checking storage configuration, audit policy settings, and connectivity to log destinations.

Published: Apr 3, 20268 min readBy FixWikiHub Editorial Team

Abstract illustration for a troubleshooting knowledge base category.

Introduction

Azure SQL Database auditing tracks database events for compliance, security monitoring, and forensic analysis. When auditing stops writing logs, compliance requirements may be violated and security visibility is lost.

Symptoms

Audit logs missing:

```bash $ az storage blob list \ --account-name auditstorage \ --container-name sqldbsecuritylogs \ --query '[].name'

# Returns empty or missing recent logs ```

Audit policy error:

json

{
  "error": {
    "code": "AuditConfigurationInvalid",
    "message": "The storage account 'auditstorage' is not accessible for auditing"
  }
}

Query audit status:

```bash $ az sql server audit-policy show \ --resource-group my-rg \ --server my-server \ --query '{State:state,Storage:storageEndpoint}'

# Shows state: Disabled or storage endpoint missing ```

Common Causes

1.Audit policy disabled - Auditing turned off at server or database level
2.Storage account inaccessible - Firewall blocking SQL server access
3.Storage account deleted - Audit destination removed
4.Storage quota exceeded - Container full, cannot write new logs
5.Authentication failed - Storage access key expired or wrong
6.Audit retention expired - Logs deleted by retention policy
7.Network connectivity - SQL server cannot reach storage endpoint

Step-by-Step Fix

1.Check logs for specific error messages
2.Verify configuration settings
3.Test network connectivity
4.Review recent changes
5.Apply corrective action
6.Verify the fix

Step 1: Check Audit Policy Status

```bash # Check server-level audit policy az sql server audit-policy show \ --resource-group my-rg \ --server my-server \ --query '{State:state,StorageEndpoint:storageEndpoint,Retention:retentionDays}'

# Check database-level audit policy az sql db audit-policy show \ --resource-group my-rg \ --server my-server \ --name my-database \ --query '{State:state,Actions:auditActionsAndGroups}' ```

Step 2: Enable Audit Policy

```bash # Enable server-level auditing az sql server audit-policy update \ --resource-group my-rg \ --server my-server \ --state Enabled \ --storage-account auditstorage \ --retention-days 90

# Enable database-level auditing az sql db audit-policy update \ --resource-group my-rg \ --server my-server \ --name my-database \ --state Enabled \ --storage-account auditstorage

# Verify policy enabled az sql server audit-policy show \ --resource-group my-rg \ --server my-server \ --query 'state' ```

Step 3: Check Storage Account Access

```bash # Verify storage account exists az storage account show \ --name auditstorage \ --resource-group my-rg \ --query '{Name:name,Status:provisioningState,Kind:kind}'

# Check storage account firewall az storage account show \ --name auditstorage \ --resource-group my-rg \ --query 'networkAcls'

# Allow Azure services access az storage account update \ --name auditstorage \ --resource-group my-rg \ --bypass AzureServices

# Or add SQL server subnet to allowed list az storage account network-rule add \ --account-name auditstorage \ --resource-group my-rg \ --subnet /subscriptions/SUB/resourceGroups/my-rg/providers/Microsoft.Network/virtualNetworks/my-vnet/subnets/sql-subnet ```

Step 4: Verify Audit Container

```bash # Check audit container exists az storage container show \ --account-name auditstorage \ --name sqldbsecuritylogs \ --query '{Name:name,PublicAccess:publicAccess}'

# Create container if missing az storage container create \ --account-name auditstorage \ --name sqldbsecuritylogs

# Container naming: sqldbsecuritylogs for server-level # Or database-specific containers ```

Step 5: Check Storage Quota

```bash # Check storage account usage az storage account show \ --name auditstorage \ --resource-group my-rg \ --query 'statusOfPrimary'

# List blobs to check size az storage blob list \ --account-name auditstorage \ --container-name sqldbsecuritylogs \ --query 'length(@)'

# If approaching limits, increase storage capacity # Or clean up old audit logs az storage blob delete-batch \ --account-name auditstorage \ --container-name sqldbsecuritylogs \ --pattern "2022/*" # Delete old year logs ```

Step 6: Configure Log Analytics Auditing

```bash # Alternative: Use Log Analytics for audit logs az sql server audit-policy update \ --resource-group my-rg \ --server my-server \ --state Enabled \ --laws /subscriptions/SUB/resourcegroups/my-rg/providers/microsoft.operationalinsights/workspaces/my-workspace

Step 7: Test Audit Writing

```bash # Generate test activity az sql db show \ --resource-group my-rg \ --server my-server \ --name my-database

# Wait 5-10 minutes for audit propagation sleep 600

# Check for new audit logs az storage blob list \ --account-name auditstorage \ --container-name sqldbsecuritylogs \ --query "[?contains(name, '$(date -u +%Y/%m/%d)')].name" ```

Step 8: Check Audit Actions Configuration

```bash # Review audit action groups az sql server audit-policy show \ --resource-group my-rg \ --server my-server \ --query 'auditActionsAndGroups'

# Add missing action groups if needed az sql server audit-policy update \ --resource-group my-rg \ --server my-server \ --actions FAILED_DATABASE_AUTHENTICATION_GROUP,SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP,BATCH_COMPLETED_GROUP

# Default action groups: # - SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP # - FAILED_DATABASE_AUTHENTICATION_GROUP # - BATCH_COMPLETED_GROUP ```

Step 9: Set Up Monitoring for Audit Failures

```bash # Create alert for audit policy changes az monitor activity-log alert create \ --name audit-policy-change \ --resource-group my-rg \ --condition category='Security' and operationName='Microsoft.Sql/servers/auditingPolicies/write'

Step 10: Use Event Hub for Real-Time Auditing

```bash # Configure Event Hub for streaming audit logs az sql server audit-policy update \ --resource-group my-rg \ --server my-server \ --state Enabled \ --eh /subscriptions/SUB/resourceGroups/my-rg/providers/Microsoft.EventHub/namespaces/my-eh/eventhubs/sql-audit

# Benefits of Event Hub: # - Real-time audit stream # - Integration with SIEM systems # - Higher throughput than storage ```

Audit Storage Structure

bash

auditstorage/
  sqldbsecuritylogs/
    servername/
      dbname/
        2024/
          01/
            15/
              10_00_00_Audit_123456.xel

Verification

```bash # After enabling audit policy az sql server audit-policy show \ --resource-group my-rg \ --server my-server \ --query '{State:state,Storage:storageEndpoint,Retention:retentionDays}'

# Should show: # State: Enabled # Storage: https://auditstorage.blob.core.windows.net/

# Should show > 0 for recent activity ```

Prevention

To prevent Azure SQL auditing not writing issues from recurring, implement these proactive measures:

1. Monitor Audit Log Generation

yaml

groups:
- name: azure-sql-audit
  rules:
  - alert: AzureSQLAuditNotWriting
    expr: |
      rate(azure_sql_audit_events_total[1h]) == 0
    for: 1h
    labels:
      severity: warning
    annotations:
      summary: "Azure SQL audit logs not being generated"

2. Test Audit Logging Regularly

```bash # Weekly audit test script cat << 'EOF' > /usr/local/bin/test_sql_audit.sh #!/bin/bash SERVER="my-server" DB="my-database" RG="my-rg"

# Generate test audit event sqlcmd -S $SERVER.database.windows.net -d $DB -U admin -P $PASSWORD -Q "SELECT 1"

# Wait for audit log sleep 60

# Should show > 0 EOF

chmod +x /usr/local/bin/test_sql_audit.sh ```

3. Configure Audit Retention

```bash # Set appropriate retention az sql server audit-policy update \ --resource-group my-rg \ --server my-server \ --retention-days 90 # Keep 90 days

# Monitor storage capacity az storage account show \ --name auditstorage \ --resource-group my-rg \ --query '{Used:usage.capacity,Quota:usage.quota}' ```

Best Practices Checklist

[ ] Monitor audit log generation
[ ] Test audit logging regularly
[ ] Configure appropriate retention
[ ] Monitor storage capacity
[ ] Review audit configuration monthly
[ ] Document audit requirements

[Fix Azure SQL Database Deadlock](/articles/fix-azure-sql-database-deadlock)
[Fix Azure SQL Database DTU Limit](/articles/fix-azure-sql-database-dtu-limit)
[Fix Azure Storage Account Inaccessible](/articles/fix-azure-storage-account-inaccessible)

[Technical troubleshooting: Fix Azure Aks Pod Crashloopbackoff Issue in Azure](azure-aks-pod-crashloopbackoff)
[Technical troubleshooting: Fix Azure Api Management Policy Expression Runtime](azure-api-management-policy-expression-runtime-error)
[Technical troubleshooting: Fix Azure App Configuration Feature Flag Not Refre](azure-app-configuration-feature-flag-not-refreshing)
[Technical troubleshooting: Fix Azure App Service 503 Always On Disabled Issue](azure-app-service-503-always-on-disabled)
[Technical troubleshooting: Fix Azure Application Gateway Err SSL Unrecognized](azure-application-gateway-err-ssl-unrecognized-name-alert)

Was this guide helpful?

Related search paths

People also search for

If the symptom is close but not identical, these search paths usually surface the right neighboring fixes faster than scrolling the full archive.

Azure SQL Database Auditing Not Writing Azure SQL Database Auditing Not Writing Azure Azure SQL Database Auditing Not Writing troubleshooting Azure SQL Database Auditing Not Writing fix Resolve Azure SQL audit log issues by checking storage configuration, audit policy settings, and connectivity to log destinations Azure Resolve Azure SQL audit log issues by checking storage configuration, audit policy settings, and connectivity to log destinations

Explore Related Topics

Browse Guides from Other Categories

Discover troubleshooting guides from related categories to expand your knowledge.

FAQ

Azure Troubleshooting FAQs

Common questions about troubleshooting and preventing similar issues

How do I know if this azure-errors troubleshooting guide applies to my situation?

This guide is designed for azure-errors issues. If you're experiencing similar symptoms described in the article, follow the step-by-step instructions. Start with the most common causes and work through the diagnostic process.

Is it safe to follow these azure-errors troubleshooting steps?

Yes, all steps are designed to be safe and non-destructive. We recommend creating backups before making significant changes and testing each step before proceeding to the next.

How long does it typically take to resolve this type of azure-errors issue?

Most azure-errors issues can be resolved within 30 minutes to 2 hours, depending on the complexity and root cause. Follow the troubleshooting flow to identify and fix the problem efficiently.

How can I prevent this azure-errors issue from happening again?

Regular maintenance, monitoring, and following best practices for azure-errors configuration can help prevent recurrence. Consider implementing automated checks and alerts for early detection.

Written by

FixWikiHub Editorial Team

Our editorial team consists of experienced DevOps engineers, systems administrators, and cloud architects with hands-on experience in production environments across AWS, Azure, GCP, and on-premises infrastructure.

Every guide undergoes technical review for accuracy and is updated when software versions, commands, or best practices change.

Last updated: Apr 3, 2026

About our team

Important Notice

Disclaimer & Safety Guidelines

The troubleshooting steps in this guide are provided for educational and informational purposes. Before applying any changes to production systems:

Test in a staging environment first — Always verify commands and configurations in a non-production environment before deploying to live systems.
Create backups — Ensure you have current backups of databases, configurations, and critical files before making changes.
Understand the impact — Review how each step may affect your specific environment, dependencies, and users.
Consult official documentation — This guide supplements, but does not replace, official vendor documentation and best practices.

FixWikiHub is not responsible for any damages arising from the use of this content. See our Terms of Use for more information.

Resources

Official Documentation & Further Reading

For authoritative information, consult the official documentation for the technologies discussed in this guide. Our troubleshooting content supplements, but does not replace, vendor documentation.

AWS Documentation — Official Amazon Web Services guides and API references
Kubernetes Documentation — Official Kubernetes documentation
Nginx Documentation — Official Nginx web server documentation
Apache Documentation — Official Apache HTTP Server documentation
Docker Documentation — Official Docker container documentation

Fix Azure SQL Database Auditing Not Writing

Introduction

Symptoms

Common Causes

Step-by-Step Fix

Step 1: Check Audit Policy Status

Step 2: Enable Audit Policy

Step 3: Check Storage Account Access

Step 4: Verify Audit Container

Step 5: Check Storage Quota

Step 6: Configure Log Analytics Auditing

Step 7: Test Audit Writing

Step 8: Check Audit Actions Configuration

Step 9: Set Up Monitoring for Audit Failures

Step 10: Use Event Hub for Real-Time Auditing

Audit Storage Structure

Verification

Prevention

1. Monitor Audit Log Generation

2. Test Audit Logging Regularly

3. Configure Audit Retention

Best Practices Checklist

People also search for

Browse Guides from Other Categories

WordPress

SSL

DNS

Azure Troubleshooting FAQs

FixWikiHub Editorial Team

Disclaimer & Safety Guidelines

Official Documentation & Further Reading

Fix Azure SQL Database Auditing Not Writing

Introduction

Symptoms

Common Causes

Step-by-Step Fix

Step 1: Check Audit Policy Status

Step 2: Enable Audit Policy

Step 3: Check Storage Account Access

Step 4: Verify Audit Container

Step 5: Check Storage Quota

Step 6: Configure Log Analytics Auditing

Step 7: Test Audit Writing

Step 8: Check Audit Actions Configuration

Step 9: Set Up Monitoring for Audit Failures

Step 10: Use Event Hub for Real-Time Auditing

Audit Storage Structure

Verification

Prevention

1. Monitor Audit Log Generation

2. Test Audit Logging Regularly

3. Configure Audit Retention

Best Practices Checklist

Related Issues

Related Articles

People also search for

Share this guide

More Azure Troubleshooting Guides

Browse Guides from Other Categories

Azure Troubleshooting FAQs

FixWikiHub Editorial Team

Disclaimer & Safety Guidelines

Official Documentation & Further Reading