LEM MSSQL Auditor need more logs verbosity

ajff

Hello there,

Cannot figure out how to configure what MSSQL Auditor sends to LEM.

I have edited default SQL Profiler trace file and now I can see all events needed on agent's log file but not on LEM appliance.

I just found this link:

https://support.solarwinds.com/?title=Success_Center/Log_%26_Event_Manager_%28LEM%29/The_level_of_auditing_is_provided_by_MSSQL_Auditor

Could you please explain me how to get rid all limitations for sending trace data.

Thanks in advance!

curtisi

First off, the official response is:

"SolarWinds have had customers request or provide additional trace auditing, but SolarWinds advised against capturing anything that might have actual query/insert data in it since that could be either stored in a log file (in plain text) on disk on the system and/or in the LEM database."

We really don't want LEM itself to have to be PCI compliant, for example, so we don't want the actual PPI data in LEM.

There's also the other piece of this to consider: The LEM Agent Connector for MSSQL Auditor.  The connector is what reads the SQL Auditor logs, and has been tuned to discard or ignore any data that isn't generated by our stock traces.  You may be able to make a Feature Request, but I doubt there's anything easily done in configuration to make the LEM accept all data.