For reading audit files for reporting Failed login attempts .
Need the connection event info including instance_name, database_name, client IP etc, store in table . as the audit logs are going to be recycled
Currently tried two approaches
a. fn_get_audit_file
b. xp_readerrorlog
Both are giving different number of rows in result.
Which is preferred. Have SQL Server 2008 R2 and SQL Server 2012
fn_get_audit_file and xp_readerrorlog are reading two different things. One is reading a particular audit file (or files) and one is reading the SQL Server Error Log. I would expect them to return different rows.
Hmm, same concern here..