Aaron Bertrand takes a look at a pre-configured tool and gives us ways to make it better:
I was recently trying to troubleshoot a SQL Server replication-related deadlock that our monitoring tool didn’t capture, and tried to find information about it in the system_health Extended Events session. With the default retention settings and the amount of noise contributed by security ring buffer events, I quickly discovered that the session only had data going back less than two hours. Meaning unless I started investigating an event immediately after it happened, all evidence had rolled out forever.
Read on for Aaron’s guidance around this. The natural next step is to build out your own extended events which capture what you need.