Label penyerapan mengidentifikasi parser yang menormalisasi data log mentah ke format UDM terstruktur. Informasi dalam dokumen ini berlaku untuk parser dengan label penyerapan
MICROSOFT_SQL.
Mengonfigurasi log Microsoft SQL Server menggunakan agen NxLog
Buka services.msc dan hentikan layanan nxlog.
Buka C:\Program Files (x86)\nxlog\data, lalu hapus configcache.dat.
Untuk agen Windows, buka lokasi yang diinstal C:\Program Files (x86)\nxlog\conf.
Salin dan tempel konfigurasi berikut ke dalam file nxlog.conf.
Ini adalah contoh file konfigurasi. Lihat manual referensi nxlog tentang opsi konfigurasi.
Setel ROOT ke folder tempat Anda menginstal NXLog, jika tidak, NXLog tidak akan dimulai.
#define ROOT C:\Program Files\nxlog
define ROOT C:\Program Files (x86)\nxlog
Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log
<Extension charconv>
Module xm_charconv
AutodetectCharsets UTF-8, UCS-2LE
</Extension>
# Load the json extension
<Extension json>
Module xm_json
</Extension>
<Input sql-ERlogs>
Module im_file
File "FILE_PATH"
ReadFromLast False
SavePos False
Exec $FileName = file_name();
Exec $Hostname = hostname_fqdn();
Exec $raw_event = "NXLog|" + $Hostname + "|MS_SQL_SERVER_ERROR|" + $FileName + "|" + "000|000" + "|" + convert($raw_event, 'UCS-2LE','UTF-8');
</Input>
# Send the read log lines out to nxlog server
<Output out-sqlERlogs>
Module om_tcp
Host FORWARDER_IP_ADDRESS
Port PORT_NUMBER
OutputType LineBased
</Output>
# Build the route from nxlog on Windows to nxlog on server
<Route 1>
Path sql-ERlogs => out-sqlERlogs
</Route>
Ganti kode berikut:
FILE_PATH: lokasi log error Microsoft SQL
FORWARDER_IP_ADDRESS: alamat IP penerusan Google SecOps
PORT_NUMBER: nomor port tinggi
Mulai layanan NXLog dari services.msc.
Log agen NxLog tersedia di C:\Program Files (x86)\nxlog\data\nxlog.log.
Untuk mengetahui informasi tentang konfigurasi dan opsi untuk file log error SQL, lihat bagian SCM Services - Configure SQL Server Error Logs di dokumentasi Microsoft.
Mengonfigurasi penerus Google SecOps untuk menyerap log Microsoft SQL Server
Di menu Google SecOps, pilih Settings > Forwarders > Add new forwarder.
Di kolom Nama penerusan, masukkan nama unik untuk penerusan.
Klik Kirim. Forwarder ditambahkan dan jendela Add collector configuration
akan muncul.
Di kolom Nama pengumpul, masukkan nama unik untuk pengumpul.
Di kolom Jenis log, masukkan Microsoft SQL Server.
Pilih Syslog sebagai Collector type.
Konfigurasikan parameter input berikut:
Protokol: protokol koneksi yang digunakan pengumpul untuk memproses data syslog.
Alamat: alamat IP atau nama host target tempat pengumpul
berada dan memproses data syslog.
Port: port target tempat pengumpul berada dan memproses
data syslog.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-04 UTC."],[],[],null,["# Collect Microsoft SQL Server logs\n=================================\n\nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n| **Note:** This feature is covered by [Pre-GA Offerings Terms](https://chronicle.security/legal/service-terms/) of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the [Google SecOps Technical Support Service guidelines](https://chronicle.security/legal/technical-support-services-guidelines/) and the [Google SecOps Service Specific Terms](https://chronicle.security/legal/service-terms/).\n\nThis document describes how you can collect the Microsoft SQL Server logs by using\na Google Security Operations forwarder.\n\nFor more information, see [Data ingestion to Google Security Operations](/chronicle/docs/data-ingestion-flow).\n\nAn ingestion label identifies the parser that normalizes raw log data to structured\nUDM format. The information in this document applies to the parser with the\n`MICROSOFT_SQL` ingestion label.\n\nConfigure the Microsoft SQL Server logs using NxLog agent\n---------------------------------------------------------\n\n1. Go to **services.msc** and stop the **nxlog** service.\n2. Go to `C:\\Program Files (x86)\\nxlog\\data` and delete `configcache.dat`.\n3. For the Windows agent, go to the installed location `C:\\Program Files (x86)\\nxlog\\conf`.\n4. Copy and paste the following configuration into the `nxlog.conf` file.\n\n This is a sample configuration file. See the [nxlog reference manual](http://nxlog.org/docs/) about configuration options.\n5. Set `ROOT` to the folder that you installed NXLog in, otherwise NXLog won't start.\n\n #define ROOT C:\\Program Files\\nxlog\n define ROOT C:\\Program Files (x86)\\nxlog\n Moduledir %ROOT%\\modules\n CacheDir %ROOT%\\data\n Pidfile %ROOT%\\data\\nxlog.pid\n SpoolDir %ROOT%\\data\n LogFile %ROOT%\\data\\nxlog.log\n \u003cExtension charconv\u003e\n Module xm_charconv\n AutodetectCharsets UTF-8, UCS-2LE\n \u003c/Extension\u003e\n # Load the json extension\n \u003cExtension json\u003e\n Module xm_json\n \u003c/Extension\u003e\n \u003cInput sql-ERlogs\u003e\n Module im_file\n File \"\u003cvar translate=\"no\"\u003eFILE_PATH\u003c/var\u003e\"\n ReadFromLast False\n SavePos False\n Exec $FileName = file_name();\n Exec $Hostname = hostname_fqdn();\n Exec $raw_event = \"NXLog|\" + $Hostname + \"|MS_SQL_SERVER_ERROR|\" + $FileName + \"|\" + \"000|000\" + \"|\" + convert($raw_event, 'UCS-2LE','UTF-8');\n \u003c/Input\u003e\n # Send the read log lines out to nxlog server\n \u003cOutput out-sqlERlogs\u003e\n Module om_tcp\n Host \u003cvar translate=\"no\"\u003eFORWARDER_IP_ADDRESS\u003c/var\u003e\n Port \u003cvar translate=\"no\"\u003ePORT_NUMBER\u003c/var\u003e\n OutputType LineBased\n \u003c/Output\u003e\n # Build the route from nxlog on Windows to nxlog on server\n \u003cRoute 1\u003e\n Path sql-ERlogs =\u003e out-sqlERlogs\n \u003c/Route\u003e\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eFILE_PATH\u003c/var\u003e: the Microsoft SQL error log location\n - \u003cvar translate=\"no\"\u003eFORWARDER_IP_ADDRESS\u003c/var\u003e: the Google SecOps forwarder IP address\n - \u003cvar translate=\"no\"\u003ePORT_NUMBER\u003c/var\u003e: a high port number\n6. Start the NXLog service from `services.msc`.\n\n NxLog agent logs are available at `C:\\Program Files (x86)\\nxlog\\data\\nxlog.log`.\n\n For information about configuration and options for SQL error log files, see the **SCM Services - Configure SQL Server Error Logs** section in the [Microsoft documentation](http://learn.microsoft.com/).\n\nConfigure the Google SecOps forwarder to ingest Microsoft SQL Server logs\n-------------------------------------------------------------------------\n\n1. In the Google SecOps menu, select **Settings \\\u003e Forwarders \\\u003e Add new forwarder**.\n2. In the **Forwarder name** field, enter a unique name for the forwarder.\n3. Click **Submit** . The forwarder is added and the **Add collector configuration** window appears.\n4. In the **Collector name** field, enter a unique name for the collector.\n5. In the **Log type** field, enter `Microsoft SQL Server`.\n6. Select **Syslog** as the **Collector type**.\n7. Configure the following input parameters:\n - **Protocol**: the connection protocol that the collector uses to listen to syslog data.\n - **Address**: the target IP address or hostname where the collector resides and listens to syslog data.\n - **Port**: the target port where the collector resides and listens to syslog data.\n8. Click **Submit**.\n\nFor more information about the Google SecOps forwarders, see [Manage forwarder configurations through the Google Security Operations UI](/chronicle/docs/install/forwarder-management-configurations).\n\nIf you encounter issues when you create forwarders, contact [Google Security Operations support](/chronicle/docs/getting-support).\n\nWhat's next\n-----------\n\n- [Data ingestion to Google Security Operations](/chronicle/docs/data-ingestion-flow)\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
