Configure SQL Server TFC
SQL Server TFC v.2.0.0 is not configured in the LogRhythm Client Console, it is configured by modifying lrtfc.ini. Depending on your installation, the configuration file can be found in one of the following locations:
- 32-bit: C:\Program Files\LogRhythm\LogRhythm SQL Server Trace File Converter\config
- 64-bit: C:\Program Files(x86)\LogRhythm\LogRhythm SQL Server Trace File Converter\config
- 32-bit: C:\Program Files\LogRhythm\LogRhythm SQL Server 2012 Trace File Converter\config
- 64-bit: C:\Program Files(x86)\LogRhythm\LogRhythm SQL Server 2012 Trace File Converter\config
SQL Server TFC logs are written to lrtfc.log in the installation’s logs directory.
To configure any of the available options in the file, be sure to uncomment the line — delete the leading # symbol if necessary — and change the configuration value after the = sign.
When you are finished modifying the configuration, be sure to save lrtfc.ini and start or restart the LogRhythm SQL Server Trace File Converter service.
Source files will be deleted from the source directory when conversion is complete.
| Parameter | Description | Range | Default |
|---|---|---|---|
| LastWriteWaitTime | Amount of time to wait after last write before converting trace file (in minutes) | 1-2880 | 60 |
| BackupTraceFiles | Backup the original SQL Server trace files before they are converted | True or False | True |
| LogLevel | Logging level | 0 = OFF |
|
| ProcessPriority | Process priority for the converter process | 0 = Low 1 = Below Normal 2 = Normal 3 = Above Normal 4 = High | 2 |
| CycleTime | Time in period for a single processing cycling (in seconds) | 1-86400 | 30 |
| LocalLogLifetime | Time to keep LogRhythm SQL Server Trace File Converter logs (in days) | 1-30 | 7 |
| DestinationFileLifetime | Time to keep backup and converted trace files (in days) – these files will be deleted when they become older than the specified number of days | 0-366 Setting this value to 0 means that converted trace files will never be deleted. | 30 |
| MaxTraceFileSize | Maximum trace file size to convert (in MB) | 1-10000 | 1000 |
| Trace file source, filter, and destination settings | |||
| [Source 1]* | User this group of options to configure the first trace file source, destination, and filter. | ||
| SourceDirectory | This is the directory where TFC will look for SQL trace files to convert. This can be the directory where SQL Server writes trace files, or you can manually copy trace files to this directory. | Any valid directory path | d:\MSSQLServerDevelopment\Data |
| FileFilter | Specifies file extension pattern of files to be converted | *.trc | |
| DestinationDirectory | The directory where converted trace files and backed up trace files will be written. Trace files will be converted to a UTF8-encoded text file and written to a directory named If BackupTraceFiles is True, source trace files will be copied to the backup data directory in the destination directory before being deleted. | Any valid directory path | C:\LogRhythmSQLServerTraceFiles_Dev |
| [Source 2]* | Use this group of options to configure a second trace file source, destination, and filter. | ||
*Be sure to uncomment the Source 1 or Source 2 line, in addition to source, destination, and (optional) filter.