SQL trace file
Why should we wait for the trace file to be 1MB of size in order to be processed by the smart connector? this makes logs coming from SQL are not live events.
Is there any option that can be changed to make the smart connector process the trace file directly?
Please can you direct me to where this is documented ( trace file been 1MB ). I have similar issue where my DBA set trace file to 200MB and have been begging them to reduce it , maybe that will work.
We have the same kind of problem. Is there any way to reduce the file size with in 1 MB.
Reason to decrease the file size is, some DB's will generate very few logs, if we wait for the file to become 1MB, is is taking 3-4 days. We need to decrease this file reading size.
You cannot do live collection with trace files that are locked by the database.
The Arcsight connector uses the share location to try and rename the trace file to determine if the file is lock by the database. If the file can be renamed the connector marks the file as readable.
Readable files are then collected via the OBDC and then renamed or deleted based on your settings.
The logs would only be behind based on the amount of time they are locked. The default is 1 hour or until they hit your max setting, which sound like you have it at 1 MB.
If you have 2005 and up SQL server you may be able to send the logs to Windows event log instead of trace files. then you would be able to read logs in real time.
Hope this helps,
You might consider the following option:
It uses a Microsoft API in conjunction with the event manager. There are a few caveats for its use, it needs to be installed in a Windows 64 bit OS which has .net frame work installed.
The first link is a supplement to the sent link provided. Best to start with 2nd link to check further requirements and configurations.
Hope this helps