SQL Server Error Log – Is It or Can It Be Encrypted?

encryptionerror logsql server

Is it possible for the SQL Server Error Logs to be encrypted?

Our SQL Server recently had a memory dump which it threw into the Error Log. While the dump was definitely useful to identify the issue, it got me wondering about the visibility of that dump to users who may have access to the server, but not necessarily SQL Server.

I know TDE protects Data, Log, and Backup files at rest, but potentially sensitive information can be exposed via a memory dump – especially if it is intentionally engineered by a malicious source.

The contents of the dump looks similar to this:

02f59f10  70b50b54 00000101 000000a2 00650073  T..p........s.e. 
02f59f20  00760072 00720065 0027003d 006f006c  r.v.e.r.=.'.l.o. 
02f59f30  00610063 0068006c 0073006f 00270074  c.a.l.h.o.s.t.'. 
02f59f40  0054003b 00750072 00740073 00640065  ;.T.r.u.s.t.e.d. 
02f59f50  0043005f 006e006f 0065006e 00740063  _.C.o.n.n.e.c.t. 
02f59f60  006f0069 003d006e 00720074 00650075  i.o.n.=.t.r.u.e. 
02f59f70  0041003b 00700070 0069006c 00610063  ;.A.p.p.l.i.c.a. 
02f59f80  00690074 006e006f 004e0020 006d0061  t.i.o.n. .N.a.m.

I want to be proactive and protect against possible data breaches by encrypting the SQL Server Error Log if possible to reduce the chance of intentional memory dumps exposing sensitive data to non-authorized users.

Best Answer

Is it possible for the SQL Server Error Logs to be encrypted?

There is no option that "turns on errorlog encryption", so you'll need to use encryption at a lower layer, such as bitlocker or similar disk encryption utilities.

Our SQL Server recently had a memory dump which it threw into the Error Log. While the dump was definitely useful to identify the issue, it got me wondering about the visibility of that dump to users who may have access to the server, but not necessarily SQL Server.

If they have access to the server then they have access to SQL Server. No two ways about it.

I know TDE protects Data, Log, and Backup files at rest, but potentially sensitive information can be exposed via a memory dump - especially if it is intentionally engineered by a malicious source.

TDE wouldn't help here, and in general full disk encryption won't help either if the sources can already log into the server - regardless of having access to SQL Server or not.

Anyone that can log into the server can potentially read memory. Some permissions might not be locked down and debuggers can be attached. Other avenues also exist which I won't get into here but if they have access, it's already too late.

I want to be proactive and protect against possible data breaches by encrypting the SQL Server Error Log if possible to reduce the chance of intentional memory dumps exposing sensitive data to non-authorized users.

I completely understand and you should be proactive, kudos! Sadly, there really isn't anything native inside of SQL Server to do this. Encrypting it through 3rd party solutions may cause other issues.

I would say the best thing is to make sure no one has access to the server and who has access to SQL Server. Anecdotal evidence: I once was able to see a bunch of data on a "locked down" server because there was a share that had "everyone" as read permissions.

Related Question