SQL trace file

[Bechara]

Why should we wait for the trace file to be 1MB of size in order to be processed by the smart connector?  this makes logs coming from SQL are not live events.

Is there any option that can be changed to make the smart connector process the trace file directly?

[osunjio1]

Please can you direct me to where this is documented ( trace file been 1MB ). I have similar issue where my DBA set trace file to 200MB                  and have been begging them to reduce it , maybe that will work.

Thanks.

[arturp1]

Are you talking about sql server? why don't you use multidb flexconnector to extract events quering the db?

[pratikinamdar]

Hi,

Is your question satisfactorily answered?

Thanks,

Pratik

[sandeepu]

Hi Everyone,

We have the same kind of problem. Is there any way to reduce the file size with in 1 MB.

Reason to decrease the file size is, some DB's will generate very few logs, if we wait for the file to become 1MB, is is taking 3-4 days. We need to decrease this file reading size.

Please suggest.

Thanks,

Sandeep

[sandeepu]

Dears,

Does anyone have solution for this.

Thanks,

Sandeep N

[olin9]

You cannot do live collection with trace files that are locked by the database.

The Arcsight connector uses the share location to try and rename the trace file to determine if the file is lock by the database. If the file can be renamed the connector marks the file as readable.

Readable files are then collected via the OBDC and then renamed or deleted based on your settings.

The logs would only be behind based on the amount of time they are locked. The default is 1 hour or until they hit your max setting, which sound like you have it at 1 MB.

If you have 2005 and up SQL server you may be able to send the logs to Windows event log instead of trace files. then you would be able to read logs in real time.

Hope this helps,

Rob

[infosec_pro]

Hi Rob,

How would you send the logs as a Windows event instead of trace files?

Thank you.

[Lar]

Hello Vincent,

You might consider the following option:

https://www.protect724.hpe.com/docs/12162

This setup requires this connector ->

It uses a Microsoft API in conjunction with the event manager. There are a few caveats for its use, it needs to be installed in a Windows 64 bit OS which has .net frame work installed.

The first link is a supplement to the sent link provided. Best to start with 2nd link to check further requirements and configurations.

Hope this helps

Lar