Un'etichetta di importazione identifica il parser che normalizza i dati di log non elaborati in formato UDM strutturato. Le informazioni contenute in questo documento si applicano al parser con l'etichetta di importazione
MICROSOFT_SQL.
Configura i log di Microsoft SQL Server utilizzando l'agente NxLog
Vai a services.msc e interrompi il servizio nxlog.
Vai a C:\Program Files (x86)\nxlog\data ed elimina configcache.dat.
Per l'agente Windows, vai alla posizione di installazione C:\Program Files (x86)\nxlog\conf.
Copia e incolla la seguente configurazione nel file nxlog.conf.
Imposta ROOT sulla cartella in cui hai installato NXLog, altrimenti NXLog non verrà avviato.
#define ROOT C:\Program Files\nxlog
define ROOT C:\Program Files (x86)\nxlog
Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log
<Extension charconv>
Module xm_charconv
AutodetectCharsets UTF-8, UCS-2LE
</Extension>
# Load the json extension
<Extension json>
Module xm_json
</Extension>
<Input sql-ERlogs>
Module im_file
File "FILE_PATH"
ReadFromLast False
SavePos False
Exec $FileName = file_name();
Exec $Hostname = hostname_fqdn();
Exec $raw_event = "NXLog|" + $Hostname + "|MS_SQL_SERVER_ERROR|" + $FileName + "|" + "000|000" + "|" + convert($raw_event, 'UCS-2LE','UTF-8');
</Input>
# Send the read log lines out to nxlog server
<Output out-sqlERlogs>
Module om_tcp
Host FORWARDER_IP_ADDRESS
Port PORT_NUMBER
OutputType LineBased
</Output>
# Build the route from nxlog on Windows to nxlog on server
<Route 1>
Path sql-ERlogs => out-sqlERlogs
</Route>
Sostituisci quanto segue:
FILE_PATH: la posizione del log degli errori di Microsoft SQL
FORWARDER_IP_ADDRESS: l'indirizzo IP del forwarder Google SecOps
PORT_NUMBER: un numero di porta alto
Avvia il servizio NXLog da services.msc.
I log dell'agente NxLog sono disponibili all'indirizzo C:\Program Files (x86)\nxlog\data\nxlog.log.
Per informazioni sulla configurazione e sulle opzioni per i file di log degli errori di SQL, consulta la sezione SCM Services - Configure SQL Server Error Logs nella documentazione Microsoft.
Configura il forwarder Google SecOps per l'importazione dei log di Microsoft SQL Server
Nel menu Google SecOps, seleziona Impostazioni > Forwarder > Aggiungi nuovo forwarder.
Nel campo Nome del forwarder, inserisci un nome univoco per il forwarder.
Fai clic su Invia. Il forwarder viene aggiunto e viene visualizzata la finestra Aggiungi configurazione del raccoglitore.
Nel campo Nome del raccoglitore, inserisci un nome univoco per il raccoglitore.
Nel campo Tipo di log, inserisci Microsoft SQL Server.
Seleziona Syslog come Tipo di raccoglitore.
Configura i seguenti parametri di input:
Protocollo: il protocollo di connessione utilizzato dal raccoglitore per ascoltare
i dati syslog.
Indirizzo: l'indirizzo IP o il nome host di destinazione in cui risiede il raccoglitore
e ascolta i dati syslog.
Porta: la porta di destinazione in cui risiede il raccoglitore e rimane in ascolto
dei dati syslog.
[[["Facile da capire","easyToUnderstand","thumb-up"],["Il problema è stato risolto","solvedMyProblem","thumb-up"],["Altra","otherUp","thumb-up"]],[["Difficile da capire","hardToUnderstand","thumb-down"],["Informazioni o codice di esempio errati","incorrectInformationOrSampleCode","thumb-down"],["Mancano le informazioni o gli esempi di cui ho bisogno","missingTheInformationSamplesINeed","thumb-down"],["Problema di traduzione","translationIssue","thumb-down"],["Altra","otherDown","thumb-down"]],["Ultimo aggiornamento 2025-09-04 UTC."],[],[],null,["# Collect Microsoft SQL Server logs\n=================================\n\nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n| **Note:** This feature is covered by [Pre-GA Offerings Terms](https://chronicle.security/legal/service-terms/) of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the [Google SecOps Technical Support Service guidelines](https://chronicle.security/legal/technical-support-services-guidelines/) and the [Google SecOps Service Specific Terms](https://chronicle.security/legal/service-terms/).\n\nThis document describes how you can collect the Microsoft SQL Server logs by using\na Google Security Operations forwarder.\n\nFor more information, see [Data ingestion to Google Security Operations](/chronicle/docs/data-ingestion-flow).\n\nAn ingestion label identifies the parser that normalizes raw log data to structured\nUDM format. The information in this document applies to the parser with the\n`MICROSOFT_SQL` ingestion label.\n\nConfigure the Microsoft SQL Server logs using NxLog agent\n---------------------------------------------------------\n\n1. Go to **services.msc** and stop the **nxlog** service.\n2. Go to `C:\\Program Files (x86)\\nxlog\\data` and delete `configcache.dat`.\n3. For the Windows agent, go to the installed location `C:\\Program Files (x86)\\nxlog\\conf`.\n4. Copy and paste the following configuration into the `nxlog.conf` file.\n\n This is a sample configuration file. See the [nxlog reference manual](http://nxlog.org/docs/) about configuration options.\n5. Set `ROOT` to the folder that you installed NXLog in, otherwise NXLog won't start.\n\n #define ROOT C:\\Program Files\\nxlog\n define ROOT C:\\Program Files (x86)\\nxlog\n Moduledir %ROOT%\\modules\n CacheDir %ROOT%\\data\n Pidfile %ROOT%\\data\\nxlog.pid\n SpoolDir %ROOT%\\data\n LogFile %ROOT%\\data\\nxlog.log\n \u003cExtension charconv\u003e\n Module xm_charconv\n AutodetectCharsets UTF-8, UCS-2LE\n \u003c/Extension\u003e\n # Load the json extension\n \u003cExtension json\u003e\n Module xm_json\n \u003c/Extension\u003e\n \u003cInput sql-ERlogs\u003e\n Module im_file\n File \"\u003cvar translate=\"no\"\u003eFILE_PATH\u003c/var\u003e\"\n ReadFromLast False\n SavePos False\n Exec $FileName = file_name();\n Exec $Hostname = hostname_fqdn();\n Exec $raw_event = \"NXLog|\" + $Hostname + \"|MS_SQL_SERVER_ERROR|\" + $FileName + \"|\" + \"000|000\" + \"|\" + convert($raw_event, 'UCS-2LE','UTF-8');\n \u003c/Input\u003e\n # Send the read log lines out to nxlog server\n \u003cOutput out-sqlERlogs\u003e\n Module om_tcp\n Host \u003cvar translate=\"no\"\u003eFORWARDER_IP_ADDRESS\u003c/var\u003e\n Port \u003cvar translate=\"no\"\u003ePORT_NUMBER\u003c/var\u003e\n OutputType LineBased\n \u003c/Output\u003e\n # Build the route from nxlog on Windows to nxlog on server\n \u003cRoute 1\u003e\n Path sql-ERlogs =\u003e out-sqlERlogs\n \u003c/Route\u003e\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eFILE_PATH\u003c/var\u003e: the Microsoft SQL error log location\n - \u003cvar translate=\"no\"\u003eFORWARDER_IP_ADDRESS\u003c/var\u003e: the Google SecOps forwarder IP address\n - \u003cvar translate=\"no\"\u003ePORT_NUMBER\u003c/var\u003e: a high port number\n6. Start the NXLog service from `services.msc`.\n\n NxLog agent logs are available at `C:\\Program Files (x86)\\nxlog\\data\\nxlog.log`.\n\n For information about configuration and options for SQL error log files, see the **SCM Services - Configure SQL Server Error Logs** section in the [Microsoft documentation](http://learn.microsoft.com/).\n\nConfigure the Google SecOps forwarder to ingest Microsoft SQL Server logs\n-------------------------------------------------------------------------\n\n1. In the Google SecOps menu, select **Settings \\\u003e Forwarders \\\u003e Add new forwarder**.\n2. In the **Forwarder name** field, enter a unique name for the forwarder.\n3. Click **Submit** . The forwarder is added and the **Add collector configuration** window appears.\n4. In the **Collector name** field, enter a unique name for the collector.\n5. In the **Log type** field, enter `Microsoft SQL Server`.\n6. Select **Syslog** as the **Collector type**.\n7. Configure the following input parameters:\n - **Protocol**: the connection protocol that the collector uses to listen to syslog data.\n - **Address**: the target IP address or hostname where the collector resides and listens to syslog data.\n - **Port**: the target port where the collector resides and listens to syslog data.\n8. Click **Submit**.\n\nFor more information about the Google SecOps forwarders, see [Manage forwarder configurations through the Google Security Operations UI](/chronicle/docs/install/forwarder-management-configurations).\n\nIf you encounter issues when you create forwarders, contact [Google Security Operations support](/chronicle/docs/getting-support).\n\nWhat's next\n-----------\n\n- [Data ingestion to Google Security Operations](/chronicle/docs/data-ingestion-flow)\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
