DBLense SQL Server Auditor — User Guide
Live operational auditing for SQL Server. Three-layer architecture with a centralized database, background collector service, and management dashboard — featuring AI-powered security insights, SIEM integration, and optional integration with native SQL Server Audit (the Compliance Pack) for SOX / HIPAA / PCI DSS evidence trails.
Overview
DBLense SQL Server Auditor uses a three-layer architecture to provide live operational auditing of SQL Server. The background collector service continuously captures audit-relevant events from registered instances with no gaps, and all data flows into a centralized database accessible via a desktop dashboard with AI-powered analysis.
The tool supports on-premises SQL Server 2016+ (Standard, Enterprise, Developer) and Azure SQL Managed Instance. For compliance-grade evidence trails recognised by external auditors, enable the optional Compliance Pack, which reads from a native SQL Server Audit you configure on the monitored instance.
Architecture
DBLense SQL Auditor consists of three independent components that can be installed together or separately on different machines:
| Component | Description | Where to Install |
|---|---|---|
| Central Database | SQL Server database that stores all audit data, user accounts, registered server configurations, sessions, and alerts. This is the single source of truth for all audit information. | Any SQL Server instance (dedicated or shared). Typically on a central/management server. |
| Collector Service | A Windows background service (DBLenseAuditCollector) that runs continuously. It connects to registered SQL Server instances, captures audit events, and writes collected data to the central database. |
Any Windows server with network access to both the target SQL Servers and the central database. Can run on the SQL Server host itself or a separate monitoring server. |
| UI Dashboard | Desktop WPF application with 5 tabs (Dashboard, Events, Configure, Alerts, Reports) plus a dedicated Settings window. Includes AI-powered security insights panel, SIEM/webhook management, user administration, tamper-proof ledger verification, and PDF compliance reporting. | Any Windows workstation. Multiple users can connect to the same central database simultaneously. |
Deployment Scenarios
| Scenario | Components Needed | Description |
|---|---|---|
| Fresh / Full Setup | All three | First-time installation. Install all components from a single setup wizard. The central database is created, the collector service is registered, and the dashboard is ready to use. |
| Add monitoring workstation | UI Dashboard only | The central database and collector service are already running. A DBA wants to view audit data from their workstation. Install only the UI Dashboard and point it to the existing central database. |
| Add collector to new server | Collector Service only | The central database exists. You want to monitor SQL Servers in a different network segment. Install the collector service on a server in that segment and point it to the central database. |
| Set up central database | Central Database only | Prepare the database on a dedicated SQL Server before installing the service and dashboard on other machines. |
Key Use Cases
- Compliance auditing — Track who accessed what data and when (SOX, HIPAA, GDPR)
- Security monitoring — Detect failed logins, permission changes, and suspicious DDL activity
- Change tracking — Record all schema modifications (CREATE, ALTER, DROP) with the responsible user
- Access auditing — Monitor which logins access sensitive databases and tables
- Forensic analysis — Search historical audit data to investigate security incidents
- Centralized auditing — Collect audit data from multiple servers into a single remote database