0

A consultant has come and gone to do some audit on our SQL server, and has left a bit of a mess here. The problem is that he did things that we don't know anything about.

In the C:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\DATA we get a few GB of .trc files, and they keep appearing and growing.

A SELECT * FROM ::fn_trace_getinfo(default) where property = 2 returns 2 lines:

1   2   \\?\C:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\DATA\audittrace20130910192403_347.trc
2   2   C:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\Log\log_589.trc

EXEC sp_trace_setstatus 1 ,0 says that we are not allowed to execute sp_trace_setstatus, even when logged as sa.

We have tried this:

sp_configure 'show advanced options', 1 ;
GO
RECONFIGURE ;
GO
sp_configure 'c2 audit mode', 0 ;
GO
RECONFIGURE ;
GO

It says that "the configuration option 'c2 audit mode' has gone from 0 to 0", but exec sp_configure tells us that the run_value of c2 audit mode is still 1.

We're a bit lost as to what we should do to stop the trace files to appear and grow.

thomasb
  • 103
  • 6
  • 1
    Looks like we need to restart the SQL server to take the new config value into account. We'll see tomorrow, as we can't restart the server now. – thomasb Sep 17 '13 at 08:53

1 Answers1

0

After setting the c2 audit mode to 0, we had to restart the server... RECONFIGURE wasn't enough.

thomasb
  • 103
  • 6