USE master

-- 建立一個名為 "SQL_Audit" 的伺服器稽核
CREATE SERVER AUDIT SQL_Audit
    TO FILE (FILEPATH = 'D:\SQLAudit\');
GO

-- 建立一個名為 "SQL_Audit_Specification" 的伺服器稽核規範，記錄了登陸失敗情況到上述 "SQL_Audit" 稽核中
CREATE SERVER AUDIT SPECIFICATION SQL_Audit_Specification
    FOR SERVER AUDIT SQL_Audit
        ADD (FAILED_LOGIN_GROUP);
 
GO

-- 啟用稽核
ALTER SERVER AUDIT SQL_Audit
    WITH (STATE = ON);
GO

-- 切換到資料庫
USE AuditTestDB;
GO

-- 建立資料庫稽核規範
CREATE DATABASE AUDIT SPECIFICATION Audit_User_Tables
    FOR SERVER AUDIT SQL_Audit
        ADD (SELECT , INSERT , UPDATE , DELETE ON tbl_sysUserInfo BY dbo )
WITH (STATE = ON);
GO

-- 查詢稽核檔案
 

SELECT * FROM sys.fn_get_audit_file ('D:\SQLAudit\SQL_Audit_xxxxx.sqlaudit',default,default);  
GO

參考：https://docs.microsoft.com/zh-cn/sql/relational-databases/security/auditing/create-a-server-audit-and-server-audit-specification?view=sql-server-linux-ver15

https://docs.microsoft.com/zh-cn/sql/relational-databases/security/auditing/create-a-server-audit-and-database-audit-specification?view=sql-server-linux-ver15

https://docs.microsoft.com/zh-cn/sql/relational-databases/system-functions/sys-fn-get-audit-file-transact-sql?view=sql-server-linux-ver15