Agent Overview
The kAudit EventHub Publisher is a lightweight Windows service that reads SQL Server's native .sqlaudit files from disk and streams them securely to the kAudit platform for monitoring and analysis.
What the agent does
SQL Server writes ──▶ .sqlaudit files ──▶ Agent reads ──▶ HTTPS to kAudit API- Reads SQL Server native audit files (
.sqlaudit) using a direct file parser — no SQL connection required - Streams events to the kAudit platform over outbound HTTPS (port 443)
- Tracks a cursor so it resumes safely after restarts or file rollovers
- Queues events locally if the network is temporarily unavailable and replays them on reconnection
- Reports health and heartbeat signals so the platform can show agent status in the portal
System requirements
| Requirement | Details |
|---|---|
| Operating System | Windows Server 2019, 2022 — or Windows 10/11 (x64 only) |
| Disk space | ~150 MB for binaries + space for the audit cursor and offline queue |
| Network | Outbound HTTPS (TCP 443) to api.kovoco.net |
| Privileges | Local Administrator to install; runs as NT SERVICE\kAuditEventHubPublisher by default |
| .NET Runtime | Not required — the agent is self-contained |
What you need before installing
Gather these before running the installer:
| # | What | Where to get it |
|---|---|---|
| 1 | Central API URL | https://api.kovoco.net |
| 2 | Agent API Key | Admin Portal → Platform Operations → External Agents, or your portal → Organization → API Keys |
| 3 | SQL audit file path | Your DBA — the folder where .sqlaudit files are written (e.g., C:\Audit\) |
| 4 | Database name | Any short label for display in the portal (e.g., production-db) |
Next steps
- Download the Agent — get the latest MSI
- Install the Agent — run the installer on your SQL Server host
- Configure the Agent — set your tenant ID and verify the config