- Add a server and database for auditing using Extended event data collection
- Connect to the audited server in SSMS and make sure that the current user (the user which is currently logged in) is mapped to the database you are auditing.
- In the context of the db that is being audited, run the following command: EXECUTE AS USER = SUSER_NAME();
- On the audited server, restart the Distributed process to force Trace processing
- The logs show a parsing error and the Trace is moved to the Quarantine folder
2024-02-29 09:15:41.566 DEBUG [QDQ6X6Y2]: SQL Parser exited with code 1
2024-02-29 09:15:41.566 DEBUG [QDQ6X6Y2]: syntax error, state:1292(10101) near: SUSER_NAME(1,19)
2024-02-29 09:15:41.566 DEBUG [QDQ6X6Y2]: SQL Query: EXECUTE AS USER = SUSER_NAME()
Expected result: The EXECUTE AS USER = SUSER_NAME(); query is processed without issues.