sql-serverxmlt-sqlazure-sql-databaseextended-events

How to import .XEL files into SQL Server


I need to investigate some events from Azure SQL Database.

The Audit logs were stored on a Storage Account and I have downloaded them on my laptop. They are now all in the same folder.

There are many guides that explains you how to import such files into SQL Server:

But when I try to run the query

SELECT event_data = convert(XML, event_data)
FROM sys.fn_xe_file_target_read_file(N'C:\Users\FrancescoMantovani\Downloads\Investigate\*.xel', NULL, NULL, NULL);

I receive the error:

Msg 25718, Level 16, State 3, Line 1 The log file name "C:\Users\FrancescoMantovani\Downloads\Investigate*.xel" is invalid. Verify that the file exists and that the SQL Server service account has access to it.

What am I doing wrong?

EDIT: I tried to put the files into the DATA folder inside Microsoft SQL Server, the error has now changed. Command:

SELECT event_data = convert(XML, event_data)
FROM sys.fn_xe_file_target_read_file(N'C:\Program Files\Microsoft SQL Server\MSSQL15.MSSQLSERVER\MSSQL\DATA\Investigate\00_00_06_511_24.xel', NULL, NULL, NULL);

Error:

Msg 25748, Level 16, State 9, Line 1
The file "C:\Program Files\Microsoft SQL Server\MSSQL15.MSSQLSERVER\MSSQL\DATA\Investigate\00_00_06_511_24.xel" contains audit logs. Audit logs can only be accessed by using the fn_get_audit_file function.

Solution

  • Because the audit files were from Azure SQL Database it was easier for me to use a direct connection to the Storage Account this way:

    SELECT *
    FROM sys.fn_get_audit_file('https://mystorageaccount.blob.core.windows.net/sqldbauditlogs/weu-cust-npr-mssql-srvr/mydatabase/SqlDbAuditing_ServerAudit/2023-07-29/00_00_06_604_12.xel', DEFAULT, DEFAULT);
    GO
    

    And if you want to query the whole folder:

    SELECT *
    FROM sys.fn_get_audit_file('https://mystorageaccount.blob.core.windows.net/sqldbauditlogs/weu-cust-npr-mssql-srvr/mydatabase/SqlDbAuditing_ServerAudit/2023-07-29/', DEFAULT, DEFAULT);
    GO