How to Ingest and Parse WSUS Logs from WID Database into Splunk?

[refahiati]

Hello,

I have a WSUS server that is using the Windows Internal Database (WID). I would like to ingest WSUS service logs into Splunk, store them, and then parse them for further analysis. Could someone guide me on the best approach to achieve this?

Specifically:

1. What is the best way to configure Splunk to collect logs from the WSUS service (and database if necessary)?
2. Are there any best practices or recommended add-ons for parsing and indexing WSUS logs in Splunk?

Thanks in advance for your help!

[PickleRick · Accepted solution]

If WSUS writes events to event log or flat files, you can use the usual methods (wineventlog and monitor inputs) to obtain that data.

WID is another story - it's an embedded component and cannot be queried from remote so the only way to access it would be by some component installed directly on the WSUS server.

The most obvious way to access a MSSQL database which is using DBConnect will fail however because Microsoft's JDBC driver for MSSQL is a pure-Java implementation and only uses TCP/IP connectivity. You could try using jTDS driver but this is unsupported and generally unexplored territory. In other words you're on your own here.

You could also try using SQL Studio and tools contained therein to script some queries against database and write results to a file but again - I don't think that's something people do often and you're unlikely to find a ready-made solution.

There is a third-party (not Splunk-supported) add-on and app for WSUS on Splunkbase but the add-on assumes connectivity to WSUS database using DBConnect (which means a WSUS setup with an external MS SQL instance). But you can look into it to find the queries you need if you decide to implement the ingestion process on your own.