Microsoft SQL Server

This guide shows you how to read events from Microsoft SQL Server and Azure SQL Database with Tenzir.

Use from_microsoft_sql to connect to Microsoft SQL Server over the Tabular Data Stream (TDS) protocol. The operator can read a full table, execute a custom query, list table metadata, or poll a table for newly inserted rows.

Connect to Azure SQL

Azure SQL Database accepts TDS connections on port 1433 and requires TLS. Use the server host name from Azure, usually in the form <server>.database.windows.net, and set tls=true.

from_microsoft_sql query="SELECT TOP 10 * FROM dbo.events",
                   host="example.database.windows.net",
                   port=1433,
                   user="tenzir_reader",
                   password=secret("azure-sql-password"),
                   database="security",
                   tls=true

The operator currently supports SQL authentication. Microsoft Entra authentication, managed identities, Windows authentication, and Kerberos are not supported.

Read from SQL Server

Use table to read every row from a table:

from_microsoft_sql table="dbo.events",
                   host="sql.example.com",
                   user="tenzir_reader",
                   password=secret("sql-server-password"),
                   database="security",
                   tls=true

Use query or sql when you want to select, filter, or join data in SQL Server before Tenzir receives it:

from_microsoft_sql query=r"SELECT id, created_at, source, message
                          FROM dbo.events
                          WHERE severity >= 3",
                   host="sql.example.com",
                   user="tenzir_reader",
                   password=secret("sql-server-password"),
                   database="security",
                   tls=true

Stream new rows

Set live=true to poll a table for newly inserted rows. Live mode uses a monotonic integer tracking column as a watermark. If you don’t specify tracking_column, the operator tries to detect a single integer identity column or a single integer primary-key column.

from_microsoft_sql table="dbo.events",
                   live=true,
                   tracking_column="id",
                   host="sql.example.com",
                   user="tenzir_reader",
                   password=secret("sql-server-password"),
                   database="security",
                   tls=true

Live mode initializes its watermark from the current maximum tracking value and then emits rows with greater values. It doesn’t emit an initial snapshot, and it doesn’t capture updates or deletes.

Inspect metadata

List all base tables in the selected database:

from_microsoft_sql show="tables",
                   host="sql.example.com",
                   user="tenzir_reader",
                   password=secret("sql-server-password"),
                   database="security",
                   tls=true

List columns for a table:

from_microsoft_sql show="columns",
                   table="dbo.events",
                   host="sql.example.com",
                   user="tenzir_reader",
                   password=secret("sql-server-password"),
                   database="security",
                   tls=true

See Also

• from_microsoft_sql