Security Compliance

Unable to receive any SQL Server events from the Windows application log

This article provides brief information and steps to resolve the issue when you are not receiving any SQL Server events from the Windows application log.

First published date

10/12/2018 2:51 PM

Last published date

5/28/2019 7:45 PM

Overview

This article provides brief information and steps to resolve the issue when you are not receiving any SQL Server events from the Windows application log. In the Windows Application Log on your SQL Server, there may be events from SQL Server (in the Source column) that are currently not logging to Security Event Manager (formerly Log & Event Manager).

Product section

Security Event Manager

Cause

Processing SQL Server events from the Windows application log requires an additional connector to be configured.

Resolution

The procedure below allows SQL Server events in the Windows application log to be parsed and stored in SEM.

SEM Flash console

  1. In the web console, go to Manage > Nodes.
  2. Find the node with SQL Server installed, click its gear icon, and select Connectors.
  3. Find MSSQL 2000 Application Log connector, click its gear icon, and select New.
  4. Save the connector with the default settings.
  5. Click the gear icon and select Start.
SEM HTML5 console
  1. In the SEM Events Console, click the Nodes tab.
  2. Select the node with SQL Server installed, and then click Manage node connectors.
  3. In the search box, enter MSSQL.
  4. Select the MSSQL Application Log connector, and then click Add Connector.
  5. Keep the default settings, and then click Add.
  6. Under Configured connectors, select the connector, and then click Start.

Note: Even though the connector says MSSQL 2000, it applies to every version of SQL Server.