SQL 2012 logging is not working

[JimBernsteinSV]

I installed Log Insight Manager 2.5 GA (Version 2.5.0-2347850) and installed the agent on a SQL 2012 Standard server and also installed the SQL management pack but nothing is showing up in Log Insight.

Here is my liagent.ini file entry for SQL which I got off of a tutorial online.

[filelog|SQL2012]

directory=C:\Program Files\Microsoft SQL Server\MYSQL11.MSSQLSERVER\MSSQL\Log\

include=ERRORLOG.log

exclude=*.trc

charset=UTF-16LE

event_marker=^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}\.\d{2}

And here are some entries from the liagent log.

2015-02-17 09:07:55.202336 0x00000968 <warng> FLogCollector:692  | Currently there are no log files passing through the 'include'/'exclude' file name filter for channel <SQL2012>.

2015-02-17 09:07:55.202336 0x00000968 <trace> FLogCollector:246  | Subscribed to channel <SQL2012>.

Is this a configuration issue? I set it up on another SQL server and will see if that does the same thing.

[sflanders]

This means that ERRORLOG.log does not exist in the directory you specified. What files do you see in that directory? Perhaps it is a case sensitivity issue.

[JimBernsteinSV]

There are a bunch of log files in there including ERRORLOG. One thing I was curious about was when I tried to browse to that folder I got the Windows you don't have permission to go there message where you can click ok and enter the folder anyway (Windows 2012). I turned off UAC hoping that would take care of that but don't know if that would have affected the agent getting into the log folder to begin with. I dont know if you need to reboot anymore after changing UAC settings like you used to and it didn't say I needed to.

[sflanders · Accepted solution]

If it is a permissions problem then you could increase the debug_level to 1 by adding

[logging]

debug_level=1

and then check the agent log again. You might also try changing the include to

include=ERRORLOG*

or even remove the include option all together and have the agent collect all files in that directory.

[JimBernsteinSV]

Ill try that and restart the agent service. I figured I would post the ini file contents here too in case something else is wrong. It looks like debug level is commented out to begin with?

; Client-side configuration of VMware Log Insight Agent.

; See liagent-effective.ini for the actual configuration used by VMware Log Insight Agent.

[server]

hostname=LOGINSIGHT

; Log Insight server hostname or ip address

; If omitted the default value is LOGINSIGHT

;hostname=LOGINSIGHT

; Set protocol to use:

; cfapi - Log Insight REST API

; syslog - Syslog protocol

; If omitted the default value is cfapi

;

;proto=cfapi

; Log Insight server port to connect to. If omitted the default value is:

; for syslog: 514

; for cfapi without ssl: 9000

; for cfapi with ssl: 9543

;port=9000

;ssl - enable/disable SSL. Applies to cfapi protocol only.

; Possible values are yes or no. If omitted the default value is no.

;ssl=no

; Time in minutes to force reconnection to the server

; If omitted the default value is 30

;reconnect=30

[storage]

;max_disk_buffer - max disk usage limit (data + logs) in MB:

; 100 - 2000 MB, default 200

;max_disk_buffer=200

[logging]

;debug_level - the level of debug messages to enable:

;   0 - no debug messages

;   1 - trace essential debug messages

;   2 - verbose debug messages (will have negative impact on performace)

;debug_level=0

[winlog|Application]

channel=Application

[winlog|Security]

channel=Security

[winlog|System]

channel=System

[filelog|SQL2012]

directory=C:\Program Files\Microsoft SQL Server\MSSQL11.VCENTER\MSSQL\Log

include=ERRORLOG.log

exclude=*.trc

charset=UTF-16LE

event_marker=^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}\.\d{2}

[admin]

The configuration seems OK. You are right that debug_level option is commented out. Please set it as debug_level=1 per Steve's advice and remove the leading semicolon in order to make it work.

[JimBernsteinSV]

I have a little data in the overview section but nowhere else. Does that mean something is working? I would think there would be data in the other sections as well.

[sflanders]

Looks like it! You can confirm by running one on IA and seeing what the filepath field is for events returned.

[JimBernsteinSV]

I'm not sure what you mean by running one on IA. I'm not a DB guy :smileygrin:

If I click on count of SQL Server instances it will show the 2 SQL servers I have agents on so that's working. I would just think there would be more information in the other sections. But then again maybe I don't want any info there because that most likely means there would be problems!

[sflanders]

Sorry IA = Interactive Analytics. For one of the widget on LI select the magnifying glass to view on IA. Then look at event under the search bar and you should see filepath as a blue hyperlink. I assume it will be the ERRORLOG you specified in the agent configuration.

[JimBernsteinSV]

Ahhh, gotcha. Yes indeed that's what is says so I think I am good to go. Next will be Exchange and AD after I move those VMs to my 5.5 environment so Im looking forward to that.

Thanks for your help!

[sflanders]

Happy to assist!