MSSQL ERRORLOG problem

daniellim — Tue, 29 Sep 2020 20:14:12 GMT

I am using splunk to monitor the MSSQL ERRORLOG files.

My goal is to list the failed and success logons into MSSQL. Without using db connect 2 and just the Splunk_TA_microsoft-sqlserver, am I looking into the correct logs (ERRORLOG*) for this??

inputs.conf
[monitor://C:\Program Files\Microsoft SQL Server\MSSQL12\MSSQL\Log\ERRORLOG*]
sourcetype = mssql:errorlog
disabled = 0

The file path is correct, however, i realized there wasn't a stanza in the props.conf for [mssql:errorlog]

My question is am i looking at the correct log file, and do I have to do a manual field extraction for this sourcetype [mssql:errorlog] for MSSQL failed and success logons?

Re: MSSQL ERRORLOG problem

Azeemering — Tue, 29 Sep 2020 21:44:44 GMT

Yes you are correct. The mssql errorlog cycles from ERRORLOG1 till 99

Make sure you also set your CHARSET correct as you might get weird results otherwise.
Something like this:
[mssql:errorlog]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
CHARSET=UTF-8
MAX_TIMESTAMP_LOOKAHEAD=22
disabled=false
TIME_FORMAT=%Y-%m-%d %H:%M:%S.%2N
TIME_PREFIX=^
HEADER_FIELD_LINE_NUMBER=8
LINE_BREAKER=([\r\n]+)\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}.\d{2}
TRUNCATE=999999

And yes this will probably mean manual field extraction. I think we are a few months further. I'd like to know how you got on with this?

topic Re: MSSQL ERRORLOG problem in All Apps and Add-ons

MSSQL ERRORLOG problem

Re: MSSQL ERRORLOG problem