Let's say there are 20 MS-SQL servers. Are you suggesting to monitor sql audit log files of binary format using UF on all MS-SQL servers and stream that binary data to a heavy forwarder on a port? How will heavy forwarder be able to decide which specific MS-SQL server instance to connect to for interpreting binary events coming in from multiple MS-SQL server instances on a single port? Can you please share some sample configurations to elaborate your answer?
I also notice that platform of heavy forwarder is mentioned to be windows. So I guess even if you install windows UF on MS-SQL servers, you need another windows machine to create heavy forwarder?