Hi guys, how are things? I’m currently trying to obtain in my Graylog the events from the Audit Log of a MS SQL Server 2016. I’m a bit lost, could anyone help me accomplish this in the easiest way possible?
Thanks so much!
Carlos.
How exactly is Microsoft SQL Server 2016 providing access to the audit log?
- If it’s in the Windows Event Log, you could use NXLOG or Winlogbeat.
- If it’s in files on disk, you could use NXLOG or Filebeat.
- If it’s inside the database itself, you could use the Logstash JDBC input.
2 Likes
Thanks for your reply Jochen. I’m basically having trouble making SQL
Server Audit events appear in the Event Log, so from there take them with
NXLOG (as I’m currently doing with Windows logs).
I tried to generate SQL Server Audit log dumping then in audit files, and
the files generate ok, but when I set them to go to Security Log, they just
don’t show in the Event Log, and of course, NXLOG won’t send anything.
As you can see, this question is more about SQL Server logs than Graylog,
but I think that it’s probable that someone else here had to do the same.
Thanks so much.
Carlos.
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.