SQL SERVER – Error 33222, Level 16 – Audit ‘MyAudit’ Failed to Start

My learning is always fun. I strongly believe that unless you break something, you can’t learn how to fix them. While writing a new blog about auditing, I faced an interesting error. So, I thought of writing my findings before I write the actual blog. Let us learn about Audit failed to start Error 33222.

Here were the commands I was trying to run.

USE MASTER
GO
-- Create the server audit
CREATE SERVER AUDIT MyAudit
TO FILE (FILEPATH ='E:\Program Files\Microsoft SQL Server\MSSQL13.SQL2016\MSSQL\Audit');
GO
-- Enable the server audit
ALTER SERVER AUDIT MyAudit
WITH (STATE = ON);
GO

It’s a SQL Server 2016 instance and I created a folder called “Audit” in the default MSSQL directory. As soon as I executed second command, I got an error.

Msg 33222, Level 16, State 1, Line 8
Audit ‘MyAudit’ failed to start . For more information, see the SQL Server error log. You can also query sys.dm_os_ring_buffers where ring_buffer_type = ‘RING_BUFFER_XE_LOG’.

The thing I like about the error message is that it tells me what I need to do next. If you are new to SQL Server and don’t know about ERRORLOG, then follow below blog.

SQL SERVER – Where is ERRORLOG? Various Ways to Find ERRORLOG Location

Here

2017-03-07 05:20:53.36 spid54 Audit: Server Audit: 65537, State changed from: TARGET_CREATION_FAILED to: SHUTTING_DOWN
2017-03-07 05:20:53.36 spid54 Audit: Server Audit: 65537 Session has been closed
2017-03-07 05:20:53.36 spid54 Audit: Server Audit: 65537, Initialized and Assigned State: START_FAILED
2017-03-07 05:20:53.36 spid54 Audit: Server Audit: 65537, State changed from: START_FAILED to: TARGET_CREATION_FAILED
2017-03-07 05:20:53.36 spid54 Error: 33206, Severity: 17, State: 1.
2017-03-07 05:20:53.36 spid54 SQL Server Audit failed to create the audit file ‘E:\Program Files\Microsoft SQL Server\MSSQL13.SQL2016\MSSQL\Audit\MyAudit_F141FF1E-8041-48E9-BC2E-27FA3BA90213_0_131333178533700000.sqlaudit’. Make sure that the disk is not full and that the SQL Server service account has the required permissions to create and write to the file.
2017-03-07 05:20:53.37 spid54 Error: 33244, Severity: 17, State: 1.
2017-03-07 05:20:53.37 spid54 SQL Server Audit failed to create an audit file related to the audit ‘MyAudit’ in the directory ‘E:\Program Files\Microsoft SQL Server\MSSQL13.SQL2016\MSSQL\Audit’. Make sure that the disk is not full and that the SQL Server service account has the required permissions to create and write to the file.
2017-03-07 05:20:53.37 spid54 Audit: Server Audit: 65537, Initialized and Assigned State: TARGET_CREATION_FAILED

So, the message was very clear that service account needs permission to write to that folder. I also check ring buffer using query

SELECT *
FROM sys.dm_os_ring_buffers
WHERE ring_buffer_type = 'RING_BUFFER_XE_LOG'

and found below.

Error code 5 is access denied which is matching with ERRORLOG message.

SOLUTION/WORKAROUND

1. Make a note of service account of SQL Server service using configuration manager.
2. Provide full control to the folder where we want to write audit file. In my example, it was ‘E:\Program Files\Microsoft SQL Server\MSSQL13.SQL2016\MSSQL\Audit’. This can be done by Right click on the folder, going to properties, then security and adding service account there.

Reference: Pinal Dave (http://blog.SQLAuthority.com)

First appeared on SQL SERVER – Error 33222, Level 16 – Audit ‘MyAudit’ Failed to Start