if your Deployment Server has to manage more than 50 clients it must be dedicated to its role.
If your want to take logs from MS SQL Server you have two solutions:
Thanks @gcusello ,
By the way we are not trying to fetch MS SQL audit logs to the DS.
We need to forward these audit logs to the customers indexers from our MS SQL servers.
Till now I came to know having Splunk DB connect on DS won't help us to redirect audit logs to the customer indexers, it will fetch logs into DS which we don't want. We don't have HF in our control as well.
The 2nd approach you mentioned is where I'm looking forward currently.
Only instead of dumping audit logs into a file with some store procedure we would dump it into standard windows event application logs and UF will forward it. Thus is what we are anticipating.
However just was going through community and found a issue mentioned with this approach, which yet personally have not experienced by me so just need to confirm on same. Below is the link of an issue
If this is the case we may need to ask customer to either have CIM modelling for sent logs or then at last need to ask them to fetch logs using Splunk DB connect by themselves.
It depends. If the DS is idle enough it should be able to handle the extra workload. Otherwise, put DBX on a heavy forwarder.
I'll let someone else answer the question about MS SQL audit logs.