Hi
I'm having problems integrating SQL Server with Qradar and i have some questions:
1- The database does not have enought space so we had to add a new partition (I:\) and the audit file is being recorded in this partition. does this generate some issue in the moment of do the integration?
(The file is being recorded in I:\MELOPIDO_ADMIN\DatosSQL\Audit\Instancia)
2- The view was created at instance level, does this affect at the moment of the integration?, it must be created at DB level?
3- If i have a Console-EP-EC deployment, what component sends the query to the DB?
I'm having a timeout issue in Qradar, i already excuted the Query in the database to the view and received data from the query, does someone have some idea about what can be the problem?
Thanks for the help
------------------------------
Johan López
------------------------------