...
Gathering events directly from the system databases is useful only under very specific circumstances in an audited environment. Accidental collection of SQL Server internal operations can occur when you audit DML or SELECT events, resulting in the storage of unnecessary data. If you want to continue auditing system databases, consider routinely archiving or grooming your event databases.
...
| Note |
|---|
Auditing the Login Failed event category does not result in the collection of the same level of data. You can leave this action enabled. |