title: SQL Server Audit Event Log
body: <p>I'm struggling to get audit working using application logs on SQL Server 2012 based upon the various responses I've found here and Microsoft's documentation.  As a test, I executed the following script in Management Studio and it reported success.  However, when I deliberately fail a login, I don't see any records appearing in my OS log.</p>
  
  <pre><code>USE master
  GO
  
  CREATE SERVER AUDIT AuditDataAccess TO APPLICATION_LOG
  GO
  
  CREATE SERVER AUDIT SPECIFICATION HIPPA_Audit_Specification
  FOR SERVER AUDIT AuditDataAccess 
      ADD (FAILED_LOGIN_GROUP)
      WITH (STATE = ON)
  GO
  
  ALTER SERVER AUDIT AuditDataAccess WITH (STATE = ON)
  GO
  </code></pre>
  
  <p><strong>Clarifying</strong>: It works if I put the output to a file instead of the OS log.  If I create the object like this:</p>
  
  <pre><code>CREATE SERVER AUDIT AuditDataAccess TO FILE ( FILEPATH ='C:\SqlAudit\' )
  GO
  </code></pre>
  
  <p>...it works and I can retrieve the data using:</p>
  
  <pre><code>SELECT * FROM sys.fn_get_audit_file ('c:\SqlAudit\AuditDataAccess_*.sqlaudit',default,default);
  GO
  </code></pre>
  
  <p>What am I doing wrong with regard to using an OS Application Log?  </p>
  
  <p><strong>Edit</strong>: If nothing, then am I just looking in the wrong place?  I brought up Windows 7 EventViewer and looked in each subtree of Event Viewer (local)/Windows Logs.  I also looked in Event Viewer (local)/Applications and Service Logs, but don't see an entry for SQL Server beyond the empty "Microsoft-SQLServerDataTools".</p>