Azure SQL Server auditing failure

Question

error.png

Hello All, I received this alert and I re-enabled the Azure SQL Auditing. So is my issue solved or I still need to be cautious about it. Also I need to need to know the reason of this alert arising and if this comes again then what are the steps that I should follow.

Answer 1

@Om Bhosle
Thank you for the question ad for using Microsoft Q&A platform.

Enabling Azure SQL Auditing is a good step, but it's important to ensure that the underlying issue causing the alert is fully resolved. Here are some steps and considerations to help you address the alert and prevent it from recurring:

1)If the storage account key was regenerated, the auditing settings would need to be updated to reflect the new key. By re-saving the auditing settings in the Azure Portal, you should have resolved this issue.
2) If the storage account has specific network rules or firewall settings that prevent the SQL server from writing logs, you would need to ensure that the SQL server is allowed to access the storage account. Check the network settings and ensure that the SQL server's IP address or service endpoint is allowed.
3) If the subscription associated with the storage account is disabled, the storage account would be read-only, and auditing would fail. Ensure that your subscription is active.

To resolve the issue, you can follow these steps:

• Review the audit logs in the Azure Portal to identify any specific errors or issues that might have caused the alert.
• Ensure that the storage account is accessible and that there are no issues with its configuration.
• Verify that your subscription is active and not in a read-only state. If there are any issues with the subscription, contact Azure support for assistance.
• If you are having an issue because of the firewall rules, follow the mitigation steps given here https://techcommunity.microsoft.com/blog/azuredbsupport/azure-sql-database-auditing-not-writing-to-storage-account-behind-firewall/1813153

By following these steps, you should be able to address the alert and prevent it from recurring.

For more information, please refer to the below links:
https://learn.microsoft.com/en-us/azure/azure-sql/database/auditing-overview?view=azuresql&source=recommendations
https://learn.microsoft.com/en-us/azure/azure-sql/database/audit-write-storage-account-behind-vnet-firewall?view=azuresql
https://learn.microsoft.com/en-us/azure/azure-sql/database/auditing-best-practices?view=azuresql

Hope this helps. Do let us know if you have any further queries.

---

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.