We recently started getting a large quantity of DML Begin/Commit/Rollback Transaction Audit Events recorded. There is no database listed, the login is different for the events and the Application tends to be from three different main sources. What would cause these to be reported at a server level, seeing as there is no database listed?
Look at the Audit Events in SQLcm. Between each Begin Tran and either Commit or Rollback, will list the queries that were run (provided we are capturing those). The Begin Tran database will reflect what the first statement would have for the database, as the last statement would be used for either the commit or rollback.
For example, I started a transaction on one database (TestDB1), and the last line before doing a rollback, I did a USE TestDB2 (this is a query command I dont capture). When I captured the events, the rollback shows TestDB2. Some events do not reference a database. I suspect that is why there is no database shown for the transaction event.