MSSQL Audit Log

Question

I renamed sa account and disabled. Why my audit log showing sa activities?

EventTime server_principal_name session_server_principal_name statement
14-11-20 0:56 sa

What is this entry for sa account because I don't have sa account

Answer 1

Good day,

Please execute the following query to check if the sa account you see is the real original sa account:

SELECT name
FROM sys.sql_logins
WHERE sid = 0x01;

The sa account always has 0x01

Ensure no other logins are named sa

SELECT sid, name
FROM sys.sql_logins
WHERE name = 'sa';

Next check in the audit log what this sa account is doing (maybe simply an attempt to connect by someone and it failed ?)

Answer 2

from the above log only some fields contain values all other fields are empty