According to the documentation for CREATE SERVER AUDIT, I should be able to add a
WHEREclause (starting in SQL Server 2012) to do simple filtering. The documentation states that the list of fields that can be filtered on is found in the documentation for the [sys.fn_get_audit_file] system function. Selecting from that function showed that the
class_typefield contains the “object type” (“FN” = Function, “P” = Stored Procedure, etc.) value. That’s just what I needed. So I’m just about done, right? Not so fast!
Nothing’s ever that easy, it seems. Read on for the full story.