By default, Events records are written to CanaryEvents.sqlite located in C:\ProgramData\Canary Labs\Events. You may choose to designate another SQL db as the Event target.

<Settings>
    <SQLServer>MachineName\SQLExpress</SQLServer>
    <Database>CanaryEvents</Database>
    <User></User>
    <Pwd></Pwd>
</Settings>

1. Create and save a file with the text below as CanaryEvents.exe.admin in the same directory as the CanaryEvents.exe file.  By default, this is located in C:\Program Files\Canary\Events if using v20.2 or later. Previous versions are located in C:\Program Files\Canary Labs\Canary Admin.

   • CanaryEvents.exe.admin example:

     <Settings>
         <SQLServer>MachineName\SQLExpress</SQLServer>
         <Database>CanaryEvents</Database>
         <User></User>
         <Pwd></Pwd>
     </Settings>

      

2. Configure the file accordingly.
   • <SQLServer> - used to specify the server name where the SQL server resides. If the SQL server is local to the Canary Events service a period can be used in place of "MachineName".
   • <Database> - the name of the database to be created in the SQL server that will store the events.
   • <User> & <Pwd> - the account credentials used to create and write events to the SQL server. By default, the Canary Events service runs under the Local System account. If the Events service is configured to run under another service account which has permissions to the SQL server, these credentials are not required.
3. Once the file is configured, restart the Canary Events service. The tables are created automatically as long as the account has the correct permissions and should look like this:

If the user account does not have permissions to create the tables in the database the attached scripts can be used to create them.