{"id":26975892,"url":"https://github.com/soheilpro/sqlmon","last_synced_at":"2025-10-07T22:45:30.748Z","repository":{"id":48266899,"uuid":"199271055","full_name":"soheilpro/sqlmon","owner":"soheilpro","description":"Collects events from SQL Server and saves them to Elasticsearch for further analysis.","archived":false,"fork":false,"pushed_at":"2025-03-12T08:53:17.000Z","size":669,"stargazers_count":34,"open_issues_count":9,"forks_count":3,"subscribers_count":4,"default_branch":"master","last_synced_at":"2025-07-05T23:47:50.453Z","etag":null,"topics":["analysis","elasticsearch","elk","kibana","profile","profiler","sql","sql-server","sqlserver"],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/soheilpro.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-07-28T10:06:55.000Z","updated_at":"2025-06-26T20:21:48.000Z","dependencies_parsed_at":"2025-04-03T11:32:41.443Z","dependency_job_id":"ec80c4f6-52e8-4a96-b18b-723c0e6c82d7","html_url":"https://github.com/soheilpro/sqlmon","commit_stats":null,"previous_names":[],"tags_count":10,"template":false,"template_full_name":null,"purl":"pkg:github/soheilpro/sqlmon","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/soheilpro%2Fsqlmon","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/soheilpro%2Fsqlmon/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/soheilpro%2Fsqlmon/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/soheilpro%2Fsqlmon/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/soheilpro","download_url":"https://codeload.github.com/soheilpro/sqlmon/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/soheilpro%2Fsqlmon/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":267578003,"owners_count":24110351,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-07-28T02:00:09.689Z","response_time":68,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["analysis","elasticsearch","elk","kibana","profile","profiler","sql","sql-server","sqlserver"],"created_at":"2025-04-03T11:30:26.483Z","updated_at":"2025-10-07T22:45:25.696Z","avatar_url":"https://github.com/soheilpro.png","language":"JavaScript","readme":"# sqlmon\nCollects events from SQL Server and saves them to Elasticsearch for further analysis.\n\nYou can use [sqltop](https://github.com/soheilpro/sqltop) or Kibana to analyze these data.\n\n## Installation\n\n```\nnpm install -g sqlmon\n```\n\n## Sample\n```\n$ sqlmon \\\n    --ss-address sql.example.com \\\n    --ss-user sa \\\n    --ss-password p@ssw0rd \\\n    --es-address elasticsearch.example.com \\\n    --trace-directory 'c:\\trace' \\\n    --events RPCCompleted SQLBatchCompleted \\\n    --fields TextData TextDataHash QueryHash LoginName Duration Reads Writes CPU \\\n    --duration 60s\n\nConnecting to sql.example.com...\nCreating trace...\nTrace file path: c:\\trace\\20190729103344280.trc\nStarting trace...\nCollecting events for 60s until 14:13:20... (Press [c] to stop)\nStopping trace...\nReading trace...\nSaving 18120 events to elasticsearch.example.com...\n100.00% 18120/18120\nDisconnecting...\n```\n\n## Usage\n### Trace directory\nsqlmon needs to write trace files to a temporary directory on the server first. Use the `---trace-directory` option to specify the location of this directory:\n```\n--trace-directory 'c:\\trace'\n```\n\n**Note 1**: The SQL Server service account (usually NT Service\\MSSQLSERVER) must have Write permission on this directory.\n\n**Note 2**: These files are not removed when the program ends and must be manually deleted.\n\n### Duration\nUse the `--duration` or `-d` parameter to specify the duration that the trace must run:\n\n```\n--duration 1m\n```\n\nYou can use any specifier like `30s`, `10m`, `2h`, or `1d`. The default is `60s`.\n\n### Max trace size\nBy default, sqlmon limits the size of trace files to 1 GB. You can change this by using the `--max-size` option (in megabytes):\n\n```\n--max-size 2048 # 2 GB\n```\n\n### Events to capture\nUse the `--events` parameter to specify the events to be captured:\n\n```\n--events RPCCompleted SQLBatchCompleted\n```\n\nSee [all supported events](#supported-events-and-fields).\n\n### Fields to include\nUse the `--fields` parameter to specify the fields to be included:\n\n```\n--fields TextData Reads Writes CPU Duration RowCounts\n```\n\nSee [all supported fields](#supported-events-and-fields).\n\n### Index name\nThe default Elasticsearch index name is `sql-YY.MM.DD` which can be changed using the `--index-prefix` option:\n\n```\n--index-prefix trace-\n```\n\n### Collect only\nIf you only want to collect events without saving them to Elasticsearch, you can use the `--collect-only` option.\n\n### Importing trace files\nIf you have a saved trace file (created by either sqlmon or SQL Server Profiler), you can import it into Elasticsearch using the `--import` option:\n\n```\n--import 'c:\\trace\\20190728042508732.trc'\n```\n\n### Delayed start\nYou can use the `--delay` option to delay starting the operations until a later time:\n\n```\n--delay 1h\n```\n\n### Hooks\nThere are a few hooks defined that let you run any program at certain stages of the execution:\n\n```\n--schedule-hook ./myscript.sh\n--collection-start-hook ./myscript.sh\n--collection-end-hook ./myscript.sh\n--save-start-hook ./myscript.sh\n--save-end-hook ./myscript.sh\n--error-hook ./myscript.sh\n--interrupt-hook ./myscript.sh\n```\n\nThe following environment variables are available to use in your hooks:\n* SQLMON_SQLSERVER_ADDRESS\n* SQLMON_SQLSERVER_PORT\n* SQLMON_SQLSERVER_USER\n* SQLMON_SQLSERVER_PASSWORD\n* SQLMON_SQLSERVER_TIMEOUT\n* SQLMON_ELASTICSEARCH_ADDRESS\n* SQLMON_ELASTICSEARCH_PORT\n* SQLMON_ELASTICSEARCH_TIMEOUT\n* SQLMON_TRACE_DIRECTORY\n* SQLMON_INDEX_PREFIX\n* SQLMON_EVENTS\n* SQLMON_FIELDS\n* SQLMON_DURATION\n* SQLMON_MAX_SIZE\n* SQLMON_BATCH_SIZE\n* SQLMON_DELAY\n* SQLMON_COLLECT_ONLY\n* SQLMON_IMPORT\n* SQLMON_START_DATETIME\n* SQLMON_START_TIME\n* SQLMON_TRACE_FILE_PATH\n* SQLMON_STOP_DATETIME\n* SQLMON_STOP_TIME\n* SQLMON_TRACE_FILE_PATH\n* SQLMON_ERROR\n\n## Computed fields\n### TextDataHash\nTextDataHash is the hash of the TextData field.\n\n### QueryHash\nQueryHash is created by first removing all parameters and variables from TextData and then hashing it. It is useful for grouping queries to find the top resource consuming ones.\n\n\u003cimg src=\"kibana.png\" width=\"800\" alt=\"Kibana\" \u003e\n\n## Supported events and fields\nSee [SQL Server Event Class Reference](https://docs.microsoft.com/en-us/sql/relational-databases/event-classes/sql-server-event-class-reference) for detailed information about these fields and events.\n\n### Events\n* AssemblyLoad\n* Attention\n* AuditAddDBUserEvent\n* AuditAddLoginEvent\n* AuditAddLogintoServerRoleEvent\n* AuditAddMembertoDBRoleEvent\n* AuditAddRoleEvent\n* AuditAppRoleChangePasswordEvent\n* AuditBackupRestoreEvent\n* AuditBrokerConversation\n* AuditBrokerLogin\n* AuditChangeAuditEvent\n* AuditChangeDatabaseOwner\n* AuditDatabaseManagementEvent\n* AuditDatabaseObjectAccessEvent\n* AuditDatabaseObjectGDREvent\n* AuditDatabaseObjectManagementEvent\n* AuditDatabaseObjectTakeOwnershipEvent\n* AuditDatabaseOperationEvent\n* AuditDatabasePrincipalImpersonationEvent\n* AuditDatabasePrincipalManagementEvent\n* AuditDatabaseScopeGDR\n* AuditDBCCEvent\n* AuditFulltext\n* AuditLogin\n* AuditLoginChangePasswordEvent\n* AuditLoginChangePropertyEvent\n* AuditLoginFailed\n* AuditLoginGDREvent\n* AuditLogout\n* AuditObjectDerivedPermissionEvent\n* AuditObjectGDREvent\n* AuditSchemaObjectAccessEvent\n* AuditSchemaObjectManagementEvent\n* AuditSchemaObjectTakeOwnershipEvent\n* AuditServerAlterTraceEvent\n* AuditServerObjectGDREvent\n* AuditServerObjectManagementEvent\n* AuditServerObjectTakeOwnershipEvent\n* AuditServerOperationEvent\n* AuditServerPrincipalImpersonationEvent\n* AuditServerPrincipalManagementEvent\n* AuditServerScopeGDREvent\n* AuditServerStartsandStops\n* AuditStatementPermissionEvent\n* AutoStats\n* BackgroundJobError\n* BitmapWarning\n* BlockedProcessReport\n* BrokerActivation\n* BrokerConnection\n* BrokerConversation\n* BrokerConversationGroup\n* BrokerCorruptedMessage\n* BrokerForwardedMessageDropped\n* BrokerForwardedMessageSent\n* BrokerMessageClassify\n* BrokerMessageUndeliverable\n* BrokerQueueDisabled\n* BrokerRemoteMessageAcknowledgement\n* BrokerTransmission\n* CPUthresholdexceeded\n* CursorClose\n* CursorExecute\n* CursorImplicitConversion\n* CursorOpen\n* CursorPrepare\n* CursorRecompile\n* CursorUnprepare\n* DatabaseMirroringStateChange\n* DatabaseSuspectDataPage\n* DataFileAutoGrow\n* DataFileAutoShrink\n* DeadlockGraph\n* DegreeofParallelism\n* Deprecated\n* DeprecationAnnouncement\n* DeprecationFinalSupport\n* DTCTransaction\n* ErrorLog\n* EventLog\n* Exception\n* ExchangeSpillEvent\n* ExecPreparedSQL\n* ExecutionWarnings\n* ExistingConnection\n* FTCrawlAborted\n* FTCrawlStarted\n* FTCrawlStopped\n* HashWarning\n* LockAcquired\n* LockCancel\n* LockDeadlock\n* LockDeadlockChain\n* LockEscalation\n* LockReleased\n* LockTimeout\n* LockTimeoutNonZero\n* LogFileAutoGrow\n* LogFileAutoShrink\n* MissingColumnStatistics\n* MissingJoinPredicate\n* MountTape\n* ObjectAltered\n* ObjectCreated\n* ObjectDeleted\n* OLEDBCallEvent\n* OLEDBDataReadEvent\n* OLEDBErrors\n* OLEDBProviderInformation\n* OLEDBQueryInterfaceEvent\n* Performancestatistics\n* PlanGuideSuccessful\n* PlanGuideUnsuccessful\n* PreConnectCompleted\n* PreConnectStarting\n* PrepareSQL\n* ProgressReportOnlineIndexOperation\n* QNdynamics\n* QNparametertable\n* QNsubscription\n* QNtemplate\n* RPCCompleted\n* RPCOutputParameter\n* RPCStarting\n* ScanStarted\n* ScanStopped\n* ServerMemoryChange\n* ShowplanAll\n* ShowplanAllForQueryCompile\n* ShowplanStatisticsProfile\n* ShowplanText\n* ShowplanTextUnencoded\n* ShowplanXML\n* ShowplanXMLForQueryCompile\n* ShowplanXMLStatisticsProfile\n* SortWarnings\n* SPCacheHit\n* SPCacheInsert\n* SPCacheMiss\n* SPCacheRemove\n* SPCompleted\n* SPRecompile\n* SPStarting\n* SPStmtCompleted\n* SPStmtStarting\n* SQLBatchCompleted\n* SQLBatchStarting\n* SQLFullTextQuery\n* SQLStmtCompleted\n* SQLStmtRecompile\n* SQLStmtStarting\n* SQLTransaction\n* TMBeginTrancompleted\n* TMBeginTranstarting\n* TMCommitTrancompleted\n* TMCommitTranstarting\n* TMPromoteTrancompleted\n* TMPromoteTranstarting\n* TMRollbackTrancompleted\n* TMRollbackTranstarting\n* TMSaveTrancompleted\n* TMSaveTranstarting\n* TraceFileClose\n* TransactionLog\n* UnprepareSQL\n* User0\n* User1\n* User2\n* User3\n* User4\n* User5\n* User6\n* User7\n* User8\n* User9\n* UserErrorMessage\n* XQueryStaticType\n\n### Fields\n* ApplicationName\n* BigintData1\n* BigintData2\n* BinaryData\n* ClientProcessID\n* ColumnPermissions\n* CPU\n* DatabaseID\n* DatabaseName\n* DBUserName\n* Duration\n* EndTime\n* Error\n* EventClass\n* EventSequence\n* EventSubClass\n* FileName\n* GUID\n* Handle\n* HostName\n* IndexID\n* IntegerData\n* IntegerData2\n* IsSystem\n* LineNumber\n* LinkedServerName\n* LoginName\n* LoginSid\n* MethodName\n* Mode\n* NestLevel\n* NTDomainName\n* NTUserName\n* ObjectID\n* ObjectID2\n* ObjectName\n* ObjectType\n* Offset\n* OwnerID\n* OwnerName\n* ParentName\n* Permissions\n* ProviderName\n* [QueryHash](#computed-fields)\n* Reads\n* RequestID\n* RoleName\n* RowCounts\n* ServerName\n* SessionLoginName\n* Severity\n* SourceDatabaseID\n* SPID\n* SqlHandle\n* StartTime\n* State\n* Success\n* TargetLoginName\n* TargetLoginSid\n* TargetUserName\n* TextData\n* [TextDataHash](#computed-fields)\n* TransactionID\n* Type\n* Writes\n* XactSequence\n\n## Version History\n+ **1.5**\n    + Added authetication support for Elasticsearch.\n+ **1.4**\n    + Added TextDataHash field.\n+ **1.3**\n    + Added support for hooks.\n+ **1.2**\n    + Added --delay option.\n+ **1.1**\n\t+ Added --collect-only option.\n+ **1.0**\n\t+ Initial release.\n\n## Author\n**Soheil Rashidi**\n\n+ http://soheilrashidi.com\n+ http://twitter.com/soheilpro\n+ http://github.com/soheilpro\n\n## Copyright and License\nCopyright 2019 Soheil Rashidi.\n\nLicensed under the The MIT License (the \"License\");\nyou may not use this work except in compliance with the License.\nYou may obtain a copy of the License in the LICENSE file, or at:\n\nhttp://www.opensource.org/licenses/mit-license.php\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n","funding_links":[],"categories":[],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsoheilpro%2Fsqlmon","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsoheilpro%2Fsqlmon","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsoheilpro%2Fsqlmon/lists"}