I have an MS SQL server writing audit data to a .sqlaudit file. I need to get this data into Splunk. I have DB Connect installed, but I'm not sure how to ingest the .sqlaudit file data. Do I use DB Connect or the UF?
Please see my reply above. The audit files are being created per Splunk instructions, but how do I get them into Splunk?
Those should be a “regular” text files, (I haven’t any MS SQL server on my hands) so just use UF as any other files.
ismo
Using the MS SQL addon I see this reference to audit logs 'uses the sys.fn_get_audit_file function via DB Connect.'
https://docs.splunk.com/Documentation/AddOns/released/MSSQLServer/Datatypes
Hi
here is old answers https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-collect-SQL-audit-data/td-p/350002
r. Ismo
Thank you, I have been through this article and either I'm missing something or the article is missing something.
Following the steps to 'Create audit objects in Microsoft SQL Server for the Splunk Add-on for Microsoft SQL Server' I now have audit files being written to disk.
CREATE SERVER AUDIT MSSQL_Database_Audit TO FILE ( FILEPATH = 'C:\\SQLAudit' ) ;
However, I do not see steps in the article for how to get the file data into Splunk.
1. create an identity in splunk with an account that has access to SQL Server
- account will require server Control (USE master; GRANT CONTROL SERVER TO SplunkUSER;)
2. Create a new connection using identity created in step1
3. Create a data lab and specify your Connection created in step 2.
In the data lab you specify your query
SELECT * FROM sys.fn_get_audit_file ('\\\<servername>\<sharename>\*.sqlaudit',null,null);