2. The userid xxx isn't a SYSADMIN. The second, I believe, is just a misunderstanding. Actually, the event fail is recorded and probably the SET_MONITOR doesn't succeed. Do you agree with this interpretation?
Finally, anybody know which event causes a SET_MONITOR audit? I wasn't able to find on the documentation.