Hi,I've successfully created a Server Audit as follows:USE [master]CREATE SERVER AUDIT [Audit-SecurityLog]TO FILE ( FILEPATH = N'D:\temp\AuditFiles\',MAXSIZE = 2048 MB,MAX_ROLLOVER_FILES = 2147483647,RESERVE_DISK_SPACE = OFF)WITH( QUEUE_DELAY = 0 ,ON_FAILURE = CONTINUE)
Then I successfully created an Audit Specficiations to audit operations on a single table.Then the Auditing works just fine.When I viewed the Auditing logs (instance> Security> Audits> right-Click created audit and select View Audit Logs), I've seen the logs and noticed that the Event Time is filled with exactly 10 hours difference from the actual operation times.Windows Server hosting the SQL Server is set to Sydney time zone which is currently +10 GMT.So, does that mean SQL Server always registers the log entries in UTC? Cheers,ozSQL