SQL Auditing (Post 26.1.X)

This page describes how to enable SQL auditing in dbWatch Control Center for versions 26.1.X and newer, using Legacy Audting. If you have the newer Audit Module, see here

dbWatch Control Center includes support for SQL audit logging of all statements executed on monitored database instances via dbWatch operations. This feature is particularly useful for:

Security and compliance reporting
Change tracking
Internal investigations and usage analytics

Audit logging captures queries initiated both by user actions (e.g., manual operations via the GUI or CCC scripts) and, if configured, automated jobs run by the system.

Enabling SQL Auditing (Version 26.1.X and newer)

Step-by-Step Instructions

1. Stop the dbWatch Server service before making any changes
2. Navigate to the location of the configuration file (typically: “C:/ProgramData/dbWatchControlCenter/config/server/server_configuration.xml” or “/var/dbwatch-controlcenter/config/server/server_configuration.xml”)
3. Make a full backup of the file before editing
4. There should be an XML block called “audit-settings” that looks similar to this:

<audit-settings>
	<audit-setting>
		<user-audit-type>5</user-audit-type>
		<audit-catalog><![CDATA[C:\local-debug-data\server_new_1\log\audit_oldschool]]></audit-catalog>
		<file-switch-interval-minutes>360</file-switch-interval-minutes>
		<user-audit-catalog><![CDATA[C:\local-debug-data\server_new_1\log\audit_oldschool]]></user-audit-catalog>
		<audit-level>2</audit-level>
		<file-keep-for-days>-1</file-keep-for-days>
	</audit-setting>
</audit-settings>

The relavant tags are:

Tag	Description
<audit-catalog>	Directory where audit logs will be stored. The file will be named `audit.log` and rotated as needed.
<file-switch-interval-minutes>	How frequently (in minutes) the log file should be rotated. When a switch occurs, the old file is zipped and timestamped.
<file-keep-for-days>	Number of days to retain archived (zipped) logs. A value of 0 disables deletion.
<audit-level>	Defines audit granularity: 0 = No logging 1 = Log user-initiated statements only 2 = Log all database statements including background jobs
<user-audit-type>	This is used for auditing of user actions, don’t change it.
<user-audit-catalog>	This is used for auditing of user actions, don’t change it.

5. Save the file and restart the dbWatch Server.

For further assistance with auditing setup, central log integration (e.g., with ELK/Splunk), or security audits, please contact:
support@dbwatch.com