Before Redgate Monitor can use SQL Audit on a Google Cloud SQL instance, you must turn on SQL Server audit for that instance. Google covers this in SQL Server database auditing. The steps below cover what Redgate Monitor needs, with links to Google's documentation and our own observations.

SQL Audit on Google Cloud SQL is available from Redgate Monitor 14.33.

Setup

Create a Cloud Storage bucket

Google Cloud SQL uploads the audit files to a Cloud Storage bucket. You cannot turn on SQL Server audit without one, so create a bucket first if you do not have one already. See Create a bucket. We recommend you put the bucket in the same region as the instance, and that you set a retention policy on it. Cloud Storage is charged separately from Cloud SQL.

Redgate Monitor reads the audit files from the instance, not from the bucket. The bucket is a Google Cloud SQL requirement, and Redgate Monitor does not need access to it.

Turn on SQL Server audit

In the Google Cloud console:

1. Go to the Cloud SQL Instances page and click the name of your instance.
2. Click Edit.
3. Under Customize your instance, click Flags and parameters.
4. Select the Enable SQL Server audit checkbox and choose your bucket.
5. Click Advanced Options to set how long the instance keeps the audit files, and how often it uploads them to the bucket. Retention is between one and seven days, and the default is seven. Upload frequency is between 1 and 720 minutes, and the default is 10.
6. Click Save.

You can do the same with the gcloud CLI:

gcloud sql instances patch INSTANCE_NAME \
  --audit-bucket-path=gs://BUCKET_NAME \
  --audit-retention-interval=24h \
  --audit-upload-interval=10m

The default retention and upload settings suit Redgate Monitor. Redgate Monitor samples SQL Audit every 10 minutes and reads the files from the instance, so it collects the records well before the shortest retention period removes them.

Check the monitoring account

Redgate Monitor connects to the instance with the SQL Server credentials you gave when you added it. Use the default sqlserver user that Google Cloud SQL creates, or a user with the same permissions.

After you turn on SQL Server audit, Google Cloud SQL gives the sqlserver user permission to create, alter, and drop server audits. Redgate Monitor needs this permission. Redgate Monitor also reads the audit records with msdb.dbo.gcloudsql_fn_get_audit_file, so the account must be able to run that function.

Let Redgate Monitor create the audit

You do not create the server audit yourself. The next time Redgate Monitor samples the instance, it creates a server audit named RedgateMonitorPermissionsAudit and a server audit specification named RedgateMonitorPermissionsAuditSpec, and turns both of them on. The audit writes to /var/opt/mssql/audit, which is the only path Google Cloud SQL accepts.

Audit file rollover

Google Cloud SQL accepts a maximum audit file size between 2 MB and 50 MB, and you cannot set a maximum number of rollover files. On a busy instance, the audit files can roll over before Redgate Monitor samples them, and the records in the removed file are lost. See SQL Audit file rollover missed events for how to raise the maximum file size.

SQL Audit setup on Redgate Monitor

See SQL Audit and Permissions required to monitor SQL Server for more information about the permissions required, including how to give permissions to other roles.