Els

NumberOne

How can I connect to SIEM(Energylogserver) an .ldf file containing 1C database logs? Filebeat and NXLog do not support this format.

SzymonC

Hi,
I'm a little surprised that filebeat won't read ldf file, it should work fine. Do you have any errors from it (you can see where logs are stored in the service parameters. For example auditbeat config screen below)?

Alternatively you can try using MSSQL module on filebeat?
https://www.elastic.co/guide/en/beats/filebeat/7.17/filebeat-module-mssql.html

NumberOne

Hi!

So we have logs stored by type G:\base_1c\Test_2020_log.ldf

But filebeat doesn't send anything to logstash. What other alternatives are there to send logs from this path?

How else can I use the MSSQL module, does it pull logs by itself? They log in only using this path.

If I even use the MSSQL module, can I extract data from the database myself, or how does it work?

NumberOne

???)

SzymonC

Hi,

Can you send a screenshot of the folder modules.d with file extensions visible?
Also are there any errors in filebeat logs, when you entered the file path?

If you want to extract data from MSSQL database itself, you'd have to use logstash for that. It has an input plugin for getting data from database.
https://www.elastic.co/guide/en/logstash/7.17/plugins-inputs-jdbc.html

But to be honest, I wouldn't give up on filebeat just yet.