topic Re: Why are Windows event logs with MSSQLSERVER$AUDIT as source getting truncated and the message is empty? in Getting Data In

Why are Windows event logs with MSSQLSERVER$AUDIT as source getting truncated and the message is empty?

gregory_cordier — Tue, 27 Mar 2018 11:53:37 GMT

Hi,

We have an auditing setup which logs in Windows event logs (Forwarded Events) as "MSSQLSERVER$AUDIT" source.
they are well displayed in event viewer console, but the log is truncated and message is empty :

here the input file on windows server :

on the other side "Microsoft Windows Security auditing" events that are in "Forwarded Events" too are correctly sent and parsed in Splunk Indexer.

how come ?
where elsewhere do I have to check ?

Splunk UF is installed on Windows server with the Windows Events Collector

Thanks

Re: Why are Windows event logs with MSSQLSERVER$AUDIT as source getting truncated and the message is empty?

gregory_cordier — Tue, 03 Apr 2018 13:30:41 GMT

After searching and get helped from support, I tried the solution described in https://answers.splunk.com/answers/326943/why-is-windows-event-log-message-data-being-trunca.html

now logs are fully sent and parsed.

Re: Why are Windows event logs with MSSQLSERVER$AUDIT as source getting truncated and the message is empty?

richgalloway — Tue, 03 Apr 2018 14:14:19 GMT

@gregory.cordier If your problem is resolved, please accept the answer to help future readers.