Auditing in a SQL Server Docker Container

Question

I'm currently using a SQL Server docker container, setup according to the following: Run the SQL Server 2017 container image on Docker on Linux, Mac, or Windows .

I'm unfamiliar with Auditing within SQL Server, but all the documentation I can find for it appear to be using SSMS to configure the process. I am unable to use SSMS in my particular context.

Is there a way to setup SQL Server Auditing within the SQL Server docker container?

Answer 1

There are ways to connect your sqlserver from outside using SSMS..like i mentioned in this answer: Connect to Remote MSSQL db from Linux Docker container

This link has SSMS equivalent scripts for auditing..

first you need to try creating server level audit on

USE master ;  
GO  
-- Create the server audit.   
CREATE SERVER AUDIT Payrole_Security_Audit  
    TO FILE ( FILEPATH =   
linux file path) ;   
GO  
-- Enable the server audit.   
ALTER SERVER AUDIT Payrole_Security_Audit   
WITH (STATE = ON) ;

then you could individual databases as well or server level events as well.Below is one small example for database level audit

USE AdventureWorks2012 ;   
GO  
-- Create the database audit specification.   
CREATE DATABASE AUDIT SPECIFICATION Audit_Pay_Tables  
FOR SERVER AUDIT Payrole_Security_Audit  
ADD (SELECT , INSERT  
     ON HumanResources.EmployeePayHistory BY dbo )   
WITH (STATE = ON) ;   
GO

you can run above scripts through sqlcmd,my answer i mentioned has more details on how to do this

further i think VSCODE is more flexible to run ssms scripts than sqlcmd.you can download it for free and configure mssql extension

Answer 2

You can create a SQL script to setup SQL Server audit and audit specification and then execute it with the sqlcmd command usint the -i option.

You can use the LOGbinder SQL Audit Policy Wizard to help you creating the script.