Recently I received the following error from one of my SQL Servers:
Audit: Server Audit: 65536, State changed from: STARTED to: SHUTTING_DOWN Error: 33059, Severity: 16, State: 1. An error occurred while trying to flush all running audit sessions. Some events may be lost. Error: 25725, Severity: 16, State: 1.
After reviewing SQL Server’s error log, and the Windows system event log, I found that at the time of the errors someone was attempting to reboot the Windows operating system.
Now my first concern was making sure that auditing was currently running on this SQL Server. I ran the following SQL to verify that the auditing was enabled:
select name, status, status_desc from sys.dm_server_audit_status;