Una etiqueta de ingestión identifica el analizador que normaliza los datos de registro sin procesar en formato UDM estructurado. La información de este documento se aplica al analizador con la etiqueta de ingestión MICROSOFT_SQL.
Configurar los registros de Microsoft SQL Server con el agente NxLog
Ve a services.msc y detén el servicio nxlog.
Ve a C:\Program Files (x86)\nxlog\data y elimina configcache.dat.
En el caso del agente de Windows, ve a la ubicación instalada C:\Program Files (x86)\nxlog\conf.
Copia y pega la siguiente configuración en el archivo nxlog.conf.
Este es un archivo de configuración de ejemplo. Consulta el manual de referencia de nxlog sobre las opciones de configuración.
Define ROOT en la carpeta en la que has instalado NXLog. De lo contrario, NXLog no se iniciará.
#define ROOT C:\Program Files\nxlog
define ROOT C:\Program Files (x86)\nxlog
Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log
<Extension charconv>
Module xm_charconv
AutodetectCharsets UTF-8, UCS-2LE
</Extension>
# Load the json extension
<Extension json>
Module xm_json
</Extension>
<Input sql-ERlogs>
Module im_file
File "FILE_PATH"
ReadFromLast False
SavePos False
Exec $FileName = file_name();
Exec $Hostname = hostname_fqdn();
Exec $raw_event = "NXLog|" + $Hostname + "|MS_SQL_SERVER_ERROR|" + $FileName + "|" + "000|000" + "|" + convert($raw_event, 'UCS-2LE','UTF-8');
</Input>
# Send the read log lines out to nxlog server
<Output out-sqlERlogs>
Module om_tcp
Host FORWARDER_IP_ADDRESS
Port PORT_NUMBER
OutputType LineBased
</Output>
# Build the route from nxlog on Windows to nxlog on server
<Route 1>
Path sql-ERlogs => out-sqlERlogs
</Route>
Haz los cambios siguientes:
FILE_PATH: la ubicación del registro de errores de Microsoft SQL
FORWARDER_IP_ADDRESS: la dirección IP del reenviador de Google SecOps
PORT_NUMBER: un número de puerto alto
Inicia el servicio NXLog desde services.msc.
Los registros del agente NxLog están disponibles en C:\Program Files (x86)\nxlog\data\nxlog.log.
Para obtener información sobre la configuración y las opciones de los archivos de registro de errores de SQL, consulta la sección SCM Services - Configure SQL Server Error Logs (Servicios SCM: configurar registros de errores de SQL Server) de la documentación de Microsoft.
Configurar el reenviador de Google SecOps para ingerir registros de Microsoft SQL Server
En el menú de Google SecOps, selecciona Configuración > Reenvíos > Añadir nuevo reenvío.
En el campo Nombre del reenviador, introduce un nombre único para el reenviador.
Haz clic en Enviar. Se añade el reenviador y se muestra la ventana Añadir configuración de recopilador.
En el campo Nombre del recolector, introduzca un nombre único para el recolector.
En el campo Log type (Tipo de registro), introduce Microsoft SQL Server.
Seleccione Syslog como Tipo de recogida.
Configure los siguientes parámetros de entrada:
Protocol: el protocolo de conexión que usa el recopilador para escuchar los datos de syslog.
Dirección: la dirección IP o el nombre de host de destino en el que reside el recopilador y escucha los datos de syslog.
Puerto: el puerto de destino en el que reside el recopilador y escucha los datos de syslog.
[[["Es fácil de entender","easyToUnderstand","thumb-up"],["Me ofreció una solución al problema","solvedMyProblem","thumb-up"],["Otro","otherUp","thumb-up"]],[["Es difícil de entender","hardToUnderstand","thumb-down"],["La información o el código de muestra no son correctos","incorrectInformationOrSampleCode","thumb-down"],["Me faltan las muestras o la información que necesito","missingTheInformationSamplesINeed","thumb-down"],["Problema de traducción","translationIssue","thumb-down"],["Otro","otherDown","thumb-down"]],["Última actualización: 2025-08-20 (UTC)."],[],[],null,["# Collect Microsoft SQL Server logs\n=================================\n\nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n| **Note:** This feature is covered by [Pre-GA Offerings Terms](https://chronicle.security/legal/service-terms/) of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the [Google SecOps Technical Support Service guidelines](https://chronicle.security/legal/technical-support-services-guidelines/) and the [Google SecOps Service Specific Terms](https://chronicle.security/legal/service-terms/).\n\nThis document describes how you can collect the Microsoft SQL Server logs by using\na Google Security Operations forwarder.\n\nFor more information, see [Data ingestion to Google Security Operations](/chronicle/docs/data-ingestion-flow).\n\nAn ingestion label identifies the parser that normalizes raw log data to structured\nUDM format. The information in this document applies to the parser with the\n`MICROSOFT_SQL` ingestion label.\n\nConfigure the Microsoft SQL Server logs using NxLog agent\n---------------------------------------------------------\n\n1. Go to **services.msc** and stop the **nxlog** service.\n2. Go to `C:\\Program Files (x86)\\nxlog\\data` and delete `configcache.dat`.\n3. For the Windows agent, go to the installed location `C:\\Program Files (x86)\\nxlog\\conf`.\n4. Copy and paste the following configuration into the `nxlog.conf` file.\n\n This is a sample configuration file. See the [nxlog reference manual](http://nxlog.org/docs/) about configuration options.\n5. Set `ROOT` to the folder that you installed NXLog in, otherwise NXLog won't start.\n\n #define ROOT C:\\Program Files\\nxlog\n define ROOT C:\\Program Files (x86)\\nxlog\n Moduledir %ROOT%\\modules\n CacheDir %ROOT%\\data\n Pidfile %ROOT%\\data\\nxlog.pid\n SpoolDir %ROOT%\\data\n LogFile %ROOT%\\data\\nxlog.log\n \u003cExtension charconv\u003e\n Module xm_charconv\n AutodetectCharsets UTF-8, UCS-2LE\n \u003c/Extension\u003e\n # Load the json extension\n \u003cExtension json\u003e\n Module xm_json\n \u003c/Extension\u003e\n \u003cInput sql-ERlogs\u003e\n Module im_file\n File \"\u003cvar translate=\"no\"\u003eFILE_PATH\u003c/var\u003e\"\n ReadFromLast False\n SavePos False\n Exec $FileName = file_name();\n Exec $Hostname = hostname_fqdn();\n Exec $raw_event = \"NXLog|\" + $Hostname + \"|MS_SQL_SERVER_ERROR|\" + $FileName + \"|\" + \"000|000\" + \"|\" + convert($raw_event, 'UCS-2LE','UTF-8');\n \u003c/Input\u003e\n # Send the read log lines out to nxlog server\n \u003cOutput out-sqlERlogs\u003e\n Module om_tcp\n Host \u003cvar translate=\"no\"\u003eFORWARDER_IP_ADDRESS\u003c/var\u003e\n Port \u003cvar translate=\"no\"\u003ePORT_NUMBER\u003c/var\u003e\n OutputType LineBased\n \u003c/Output\u003e\n # Build the route from nxlog on Windows to nxlog on server\n \u003cRoute 1\u003e\n Path sql-ERlogs =\u003e out-sqlERlogs\n \u003c/Route\u003e\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eFILE_PATH\u003c/var\u003e: the Microsoft SQL error log location\n - \u003cvar translate=\"no\"\u003eFORWARDER_IP_ADDRESS\u003c/var\u003e: the Google SecOps forwarder IP address\n - \u003cvar translate=\"no\"\u003ePORT_NUMBER\u003c/var\u003e: a high port number\n6. Start the NXLog service from `services.msc`.\n\n NxLog agent logs are available at `C:\\Program Files (x86)\\nxlog\\data\\nxlog.log`.\n\n For information about configuration and options for SQL error log files, see the **SCM Services - Configure SQL Server Error Logs** section in the [Microsoft documentation](http://learn.microsoft.com/).\n\nConfigure the Google SecOps forwarder to ingest Microsoft SQL Server logs\n-------------------------------------------------------------------------\n\n1. In the Google SecOps menu, select **Settings \\\u003e Forwarders \\\u003e Add new forwarder**.\n2. In the **Forwarder name** field, enter a unique name for the forwarder.\n3. Click **Submit** . The forwarder is added and the **Add collector configuration** window appears.\n4. In the **Collector name** field, enter a unique name for the collector.\n5. In the **Log type** field, enter `Microsoft SQL Server`.\n6. Select **Syslog** as the **Collector type**.\n7. Configure the following input parameters:\n - **Protocol**: the connection protocol that the collector uses to listen to syslog data.\n - **Address**: the target IP address or hostname where the collector resides and listens to syslog data.\n - **Port**: the target port where the collector resides and listens to syslog data.\n8. Click **Submit**.\n\nFor more information about the Google SecOps forwarders, see [Manage forwarder configurations through the Google Security Operations UI](/chronicle/docs/install/forwarder-management-configurations).\n\nIf you encounter issues when you create forwarders, contact [Google Security Operations support](/chronicle/docs/getting-support).\n\nWhat's next\n-----------\n\n- [Data ingestion to Google Security Operations](/chronicle/docs/data-ingestion-flow)\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
