:py:mod:`dissect.target.plugins.os.windows.log.mssql`
=====================================================

.. py:module:: dissect.target.plugins.os.windows.log.mssql




Module Contents
---------------

Classes
~~~~~~~

.. autoapisummary::

   dissect.target.plugins.os.windows.log.mssql.MssqlPlugin




Attributes
~~~~~~~~~~

.. autoapisummary::

   dissect.target.plugins.os.windows.log.mssql.MssqlErrorlogRecord
   dissect.target.plugins.os.windows.log.mssql.RE_TIMESTAMP_PATTERN


.. py:data:: MssqlErrorlogRecord

.. py:data:: RE_TIMESTAMP_PATTERN

.. py:class:: MssqlPlugin(target: dissect.target.target.Target)

   Bases: :py:obj:`dissect.target.plugin.Plugin`


   Return information related to Microsoft SQL Server.

   Currently returns ERRORLOG messages. These log files contain information such as:
       - Logon failures
       - Enabling/disabling of features, such as xp_cmdshell

   .. rubric:: References

   - https://learn.microsoft.com/en-us/sql/relational-databases/logs/view-offline-log-files


   .. py:attribute:: __namespace__
      :value: 'mssql'


      Defines the plugin namespace.


   .. py:attribute:: MSSQL_KEY_GLOB
      :value: 'HKLM\\SOFTWARE\\Microsoft\\Microsoft SQL Server\\MSSQL*.*'



   .. py:attribute:: FILE_GLOB
      :value: 'ERRORLOG*'



   .. py:attribute:: instances


   .. py:method:: check_compatible() -> None

      Perform a compatibility check with the target.

      This function should return ``None`` if the plugin is compatible with the current target (``self.target``).
      For example, check if a certain file exists. Otherwise it should raise an
      :class:`UnsupportedPluginError`.

      :raises UnsupportedPluginError: If the plugin could not be loaded.



   .. py:method:: errorlog() -> collections.abc.Iterator[MssqlErrorlogRecord]

      Return all Microsoft SQL Server ERRORLOG messages.

      These log files contain information such as:
       - Logon failures
       - Enabling/disabling of features, such as xp_cmdshell

      Yields MssqlErrorlogRecord instances with fields:

      .. code-block:: text

          ts (datetime): Timestamp of the log line.
          instance (str): SQL Server instance name.
          process (str): Process name.
          message (str): Log message.
          path (Path): Path to the log file.

      .. rubric:: References

      - https://learn.microsoft.com/en-us/sql/relational-databases/logs/view-offline-log-files