MSSQL Auditing Recomendations
I use Idera SQL compliance manager. Works well, uses server-side tracing and sends trace files to a central db server and has anti-tampering hashing too. It is also very configurable so you can choose what to audit, and has nice reports with SSRS.
We use Guardium. This is essentially a packet sniffer plus a piece of software installed directly on the database server in the event that anyone would run anything while RDPd into the database server.