Monitoring LOGbinder for SQL Server
When installing, configuring, and running LOGbinder for SQL Server,
the software writes diagnostic events to the Windows Application Event Log.
Most of these will be from the source "LOGbndSE" and the category
"LOGbinder." You may use the Windows Event Viewer to examine these
During Installation and Configuration
During installation and configuration, you will find these entries:
- After installation, there may be an entry from
the source MsiInstaller: "Product: LOGbinder SQL -- Installation completed
- When the configuration of LOGbinder for SQL
Server changes, you will see one or more entries entitled "LOGbinder settings
changed." See Appendix C: Diagnostic Events: “553 – LOGbinder settings changed” for information about these events.
- When the service starts, there may be an entry
from the source LOGbinder SQL: "Service started successfully."
(Entries are also written when the service is stopped.)
You can monitor these events to ensure that LOGbinder for SQL Server
continues to be configured properly, and that unauthorized changes do not
After configuring LOGbinder for SQL Server and starting the service,
it automatically performs a check to ensure that LOGbinder's settings are valid
and that the account running the Windows service has sufficient authority. If
there is a problem, the LOGbinder for SQL Server (LOGbinder SQL) service will
not start and a message will be presented to the user. In most cases, the
details of the problem are written to the Application log. Common problems
not configured properly. See the previous section Configuring LOGbinder for SQL Server for more
authority. If the service account does not have adequate authority, then
the service will not run. An entry is written to the Application log. See Appendix C: Diagnostic Events “556 – LOGbinder insufficient authority” for more details. Some of the common
missing permissions include:
- Account does not have authority to log on as a
- Account does not have necessary permissions to
the Audit File Location.
- The account does not have authority to write to
the Security event log. (If this output destination has not been selected, then
it is not necessary to grant this permission.)
invalid. If the license is not valid or has expired, then the LOGbinder for
SQL Server (LOGbinder SQL) service will not run. An entry may be written to the
Application log. See Appendix C: Diagnostic Events “557 – License for LOGbinder invalid” for details.
- Other errors will be found in entries entitled
"LOGbinder error." See Appendix C: Diagnostic Events “555 – LOGbinder error” for more information.
If any of these errors are encountered, the LOGbinder for SQL Server
(LOGbinder SQL) service will not run.
While LOGbinder for SQL Server is Running
While LOGbinder for SQL Server is running, you will see information
entries in the Application log as follows:
- Entries 'exported' from SQL. This message
indicates the number of audit entries that LOGbinder for SQL Server has processed.
- Entries 'imported' into the Windows event log.
This indicates that the audit entries have been placed in the enabled output
formats. There will be one message event if multiple output formats have been
selected (i.e. you have selected both Windows Security Log and Windows Event
Log as output formats). The 'export'/'import' entries are complementary: there
should be a corresponding 'import' entry for each 'export.'
These log entries are informational in nature. Generally no action
is required. If more entries are being processed than what appear in the event
logs or in your log management solution, it could be that the log size is too
small and entries are being overwritten. See Appendix C: Diagnostic Events “551 – LOGbinder agent successful” for more information on these events.
There may also be some warning event entries:
agent produced unexpected results. When LOGbinder for SQL Server cannot
translate an event properly, in addition to outputting the event to the
selected output streams, it also creates an entry in the Application log. See Appendix C: Diagnostic Events “554 – LOGbinder agent produced unexpected results” for further details.
If LOGbinder for SQL Server has an error, an entry will be created
in the Application log. If permissions are removed, or if the license expires,
you may receive a "556
– LOGbinder insufficient authority"
– License for LOGbinder invalid"
error, which are explained above. Other errors will be entitled "LOGbinder
error." If you cannot resolve the problem, please submit the issue to the LOGbinder support team.
Optionally provide private feedback to help us improve this article...
Thank you for your feedback!