How to fix Error 566 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: SQL Server Error 566 – Audit Trace Write Failure

Why This Error Happens

Error 566 occurs when SQL Server’s audit engine (SQLAudit) cannot write a new event to the audit trace file, forcing an immediate shutdown of the instance as a fail-safe security measure. This is most commonly caused by insufficient disk space on the volume hosting the audit log directory, but it can also stem from corrupted .sqlaudit files, a full audit log with ON_FAILURE=SHUTDOWN configured, or the SQL Server service account lacking write permissions to the target folder. In some cases, file system corruption or an antivirus/EDR tool locking the audit file can trigger the same failure.

Step-by-Step Resolution Guide

Step 1: Free Up Disk Space on the Audit Log Volume

  • Check the drive hosting your audit files (commonly C:\Program Files\Microsoft SQL Server\MSSQL17.MSSQLSERVER\MSSQL\Log\) using Get-PSDrive in PowerShell.
  • Delete or archive old .sqlaudit files that are no longer needed for compliance.
  • Move the audit file destination to a volume with more free space if space constraints are recurring.

Step 2: Verify Service Account Permissions

  • Confirm the SQL Server service account (e.g., NT SERVICE\MSSQLSERVER or a domain service account) has Write and Modify NTFS permissions on the audit directory.
  • Right-click the folder → Properties → Security tab → confirm permissions.
  • Restart the SQL Server service via services.msc or run Restart-Service MSSQLSERVER -Force in an elevated PowerShell session.

Step 3: Inspect and Rebuild the Server Audit Specification

  • Open SQL Server Management Studio (SSMS) and navigate to Security > Audits.
  • Right-click the affected audit object and select Script Audit as > DROP And CREATE To > New Query Window.
  • Change the ON_FAILURE option from SHUTDOWN to CONTINUE temporarily to prevent future shutdowns while you diagnose root cause:
  ALTER SERVER AUDIT [YourAuditName]
  WITH (ON_FAILURE = CONTINUE);
  • Re-enable the audit using ALTER SERVER AUDIT [YourAuditName] WITH (STATE = ON);.

Step 4: Check for File Corruption or Locking Conflicts

  • Use Event Viewer (Windows Logs > Application) to identify if antivirus or backup software is locking the .sqlaudit file during write operations.
  • Add an exclusion for the SQL Server audit directory in Windows Defender or your third-party AV/EDR tool.
  • If corruption is suspected, rename the existing audit folder and allow SQL Server to regenerate a fresh audit path on restart.

Alternative or Verification Steps

  • After applying fixes, restart the SQL Server service and monitor the SQL Server Error Log (ERRORLOG in the Log folder) for successful audit initialization messages with no Error 566 recurrence.
  • As a fallback, redirect the audit destination to the Windows Security Log or Application Log instead of a file target, which removes disk-space dependency entirely:
  ALTER SERVER AUDIT [YourAuditName] TO APPLICATION_LOG;