Database Source
| Typically Used By | Database administrators; Data-centric organizations |
| Description | A method for collecting database audit logs, query logs, and performance metrics directly from database systems using JDBC connections. |
| Official Vendor Documentation | https://library.humio.com |
| Setup Difficulty | 5 (Advanced) |
| Useful for | DevOps , SecOps |
| Primary Use Case | DB audit logging |
| Scenarios not Recommended | High-performance production databases; Environments with strict security policies |
| Data Volume Handling | Medium |
| Authentication Method | Database credentials |
| Fault Tolerance | Medium |
| Additional Tools Required | JDBC driver |
Use the Database Source in Falcon LogScale Collector to collect new rows from a relational database and send them to Falcon LogScale Collector or Falcon Next-Gen SIEM. Database Source was introduced in Collector 1.11. It polls the database every five seconds and maintains an offset-based checkpoint.
Supported databases
Microsoft SQL Server (MSSQL)
MySQL
Oracle Database
PostgreSQL
The required database drivers are included with Falcon LogScale Collector. No separate driver installation is required.
Database Logs ingest flowThe following diagram shows how Database log data flows through Log Collector's ingestion pipeline, highlighting specific parser types applied to the log data before data is compressed, stored in the repository, and indexed for searching:
Before you begin
Install Log Collector Collector 1.11 or later on a host that can reach the database.
Ensure the Collector has outbound network access to the database host and port, and allow connections from the Collector in the database firewall.
Create or identify database credentials with appropriate read permissions.
Identify a table, view, or custom query that returns the events to collect.
Identify a suitable offset/key column. A unique, monotonically increasing integer such as an auto-incrementing primary key is strongly recommended.
Identify the value to use as the event message. A physical message column is not mandatory; a custom query or view can construct it.
Configure TLS for the database connection when using the default full security mode.
For Log Collector, create or identify the destination repository, parser, and ingest token used by the Collector sink.