Configure the Agent

After installing the agent, you need to set a few configuration values — most importantly, your Tenant ID — before events will be published to the platform.

Config file location

The agent's configuration file is installed at:

C:\ProgramData\kAudit\Agent\config\publisher.appsettings.json

Open this file in a text editor (Notepad, VS Code, etc.) with Administrator privileges.

---

Step 1 — Get your Tenant ID

Required in v1.0.x

The Tenant ID is not auto-populated during installation in the current release. You must retrieve it and add it manually.

Run this request with your API Key to get your assigned Tenant ID:

$apiKey = "sk_agent_xxx_yyy"
$response = Invoke-RestMethod `
  -Uri "https://api.kovoco.net/api/v1/agent/config" `
  -Headers @{ "Authorization" = "ApiKey $apiKey" }

$response.tenantId

Copy the tenantId GUID from the response (format: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx).

---

Step 2 — Add the Tenant ID to the config file

Open publisher.appsettings.json and add the TenantId value to each entry in the Databases array:

{
  "EventHubPublisher": {
    "Databases": [
      {
        "Name": "production-db",
        "Enabled": true,
        "TenantId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
        "AuditSource": {
          "Type": "DirectFile",
          "DirectFile": {
            "AuditFilePath": "C:\\Audit\\*.sqlaudit"
          }
        }
      }
    ]
  }
}

---

Step 3 — Restart the service

After saving the config file, restart the service for the change to take effect:

Restart-Service -Name 'kAuditEventHubPublisher'

---

Verify the agent is publishing

Wait 60 seconds, then check that the service is still running:

Get-Service -Name 'kAuditEventHubPublisher'
# Expected: Status = Running

Check the Windows Event Log for any agent-specific errors:

Get-EventLog -LogName Application -Source 'kAuditEventHubPublisher' -Newest 10

Sign in to portal.kovoco.net and navigate to Settings → SQL Instances. Your SQL Server instance should appear within a few minutes of the agent starting successfully.

---

Multiple databases

To monitor additional SQL Server instances or databases from the same agent host, add more entries to the Databases array:

"Databases": [
  {
    "Name": "production-db",
    "Enabled": true,
    "TenantId": "xxxxxxxx-...",
    "AuditSource": { ... }
  },
  {
    "Name": "reporting-db",
    "Enabled": true,
    "TenantId": "yyyyyyyy-...",
    "AuditSource": {
      "Type": "DirectFile",
      "DirectFile": { "AuditFilePath": "C:\\AuditReporting\\*.sqlaudit" }
    }
  }
]

Restart the service after each change.

---

Custom service account

By default, the agent runs as NT SERVICE\kAuditEventHubPublisher. To run as a custom Windows service account:

1. In Services (services.msc), right-click kAudit EventHub Publisher → Properties → Log On.
2. Select This account and enter your service account credentials.
3. Ensure the account has Read access to the .sqlaudit folder.
4. Click OK and restart the service.

---

Uninstalling

To remove the agent:

msiexec /x "C:\Temp\kaudit\kaudit-msi-installer-<version>.msi" /qn

Or use Add/Remove Programs → search for kAudit → Uninstall.

The configuration file at C:\ProgramData\kAudit\ is preserved on uninstall. Delete it manually if you want a clean removal.