{"id":1912,"date":"2020-02-01T15:59:43","date_gmt":"2020-02-01T15:59:43","guid":{"rendered":"http:\/\/www.theSQLReport.com\/?p=1912"},"modified":"2020-02-01T15:59:43","modified_gmt":"2020-02-01T15:59:43","slug":"sql-server-audit-error-25725-severity-16-state-1","status":"publish","type":"post","link":"https:\/\/www.theSQLReport.com\/?p=1912","title":{"rendered":"SQL Server Audit: Error: 25725, Severity: 16, State: 1"},"content":{"rendered":"<p>Recently I received the following error from one of my SQL Servers:<\/p>\n<pre class=\"yiv4803845312MsoNormal\">Audit: Server Audit: 65536, State changed from: STARTED to: SHUTTING_DOWN\r\n\r\nError: 33059, Severity: 16, State: 1.\r\n\r\nAn error occurred while trying to flush all running audit sessions.\u00a0 Some events may be lost.\r\n\r\nError: 25725, Severity: 16, State: 1.<\/pre>\n<p>After reviewing SQL Server&#8217;s error log, and the Windows system event log, I found that at the time of the errors someone was attempting to reboot the Windows operating system.<\/p>\n<p>Now my first concern was making sure that auditing was currently running on this SQL Server.\u00a0 I ran the following SQL to verify that the auditing was enabled:<\/p>\n<pre>select name, status, status_desc from sys.dm_server_audit_status;<\/pre>\n<p><a href=\"http:\/\/www.theSQLReport.com\/wp-content\/uploads\/2020\/02\/Audit_Status.jpg\" target=\"_blank\" rel=\"noopener noreferrer\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-1916 size-full\" src=\"http:\/\/www.theSQLReport.com\/wp-content\/uploads\/2020\/02\/Audit_Status.jpg\" alt=\"SQL Server Audit Status\" width=\"517\" height=\"175\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Recently I received the following error from one of my SQL Servers: Audit: Server Audit: 65536, State changed from: STARTED to: SHUTTING_DOWN Error: 33059, Severity: 16, State: 1. An error &hellip; <a class=\"readmore\" href=\"https:\/\/www.theSQLReport.com\/?p=1912\">Continue Reading &rarr;<\/a><\/p>\n","protected":false},"author":1,"featured_media":1916,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-1912","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-sql-server"],"_links":{"self":[{"href":"https:\/\/www.theSQLReport.com\/index.php?rest_route=\/wp\/v2\/posts\/1912"}],"collection":[{"href":"https:\/\/www.theSQLReport.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.theSQLReport.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.theSQLReport.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.theSQLReport.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1912"}],"version-history":[{"count":14,"href":"https:\/\/www.theSQLReport.com\/index.php?rest_route=\/wp\/v2\/posts\/1912\/revisions"}],"predecessor-version":[{"id":1927,"href":"https:\/\/www.theSQLReport.com\/index.php?rest_route=\/wp\/v2\/posts\/1912\/revisions\/1927"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.theSQLReport.com\/index.php?rest_route=\/wp\/v2\/media\/1916"}],"wp:attachment":[{"href":"https:\/\/www.theSQLReport.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1912"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.theSQLReport.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1912"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.theSQLReport.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1912"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}