Azure Sentinel - SQL Audit

Eduards 791

Hello,

Recently i configure SQL Audit and audit server specifications to collect SQL logs and send it to Application.

Also i installed MMA agent on SQL server and configured that Event Viewer -> Application logs (MSSQLSERVER) will be delivered to Azure Sentinel.

But when i configured SQL Audit with Queue delay (43200000 miliseconds = 12 h) it's still runs audit once a 1 minute and i receive a lots of logs.. and all this logs are collected in Azure Sentinel..

Why SQL Audit Queue delay is not working properly??

Marilee Turscak-MSFT 34,546 Reputation points Microsoft Employee

2021-01-07T00:25:41.583+00:00

My suspicion is that Sentinel keeps logging regardless of that setting, but I've reached out to someone from the Sentinel team to confirm. Are all of the logs recent? Is it for all computers or just some?
Eduards 791 Reputation points

2021-01-07T07:16:18.343+00:00

Hello @MarileeTurscak

I have 2 SQL servers which have MMA agent installed.

In Azure Security Event are configured like this.

in Log Analytics Workspace Application log are added.

I configure SQL Audit to log all data in Event Viewer -> Application and delay is 12 hours.

https://techcommunity.microsoft.com/t5/azure-sentinel/monitoring-sql-server-with-azure-sentinel/ba-p/1502960

After i add to audit this data

And when i enable audit and audit server specifications i receive a lot of SQL logs all information logs and they are sent to Azure sentinel.

After my test, after 10 minutes of logging SQL events to Azure sentinel i receive:

52300 event in 10 minutes? It's not normal.

Share via

Azure Sentinel - SQL Audit