Monitoring SQLERR logs

[grantcasey]

I'd like to monitor the MSSQL SQLERROR log file, for example i've turned on T1222 and want to get the deadlock output into splunk.

I think i'm just stumped on how to monitor the file named ERRORLOG (with no suffix.)

any tips?

[acbennett3 · Accepted solution]

ERRORLOG* worked for me - got both current/no extension and archived copies

[David]

Have you tried adding an input for the file path? You should be able to add it, by following this document:

http://www.splunk.com/base/Documentation/latest/admin/MonitorFilesAndDirectories

I believe the file will be located at %PROGRAMFILES%\Microsoft SQL Server\MSSQL.n\MSSQL\LOG\ERRORLOG

Let me know if you run into any problems.

[grantcasey]

I know the input path to use, but the file inside that path has no extension which is causing my grief. I can't convince splunk to monitor it.