Ensure 'Maximum number of error log files' is set to greater than or equal to '12'

How it is checked

Audit method: SQL query

sqlcmd -b -h -1 -W -Q "SET NOCOUNT ON; DECLARE @n int; EXEC master.sys.xp_instance_regread N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\MSSQLServer', N'NumErrorLogs', @n OUTPUT; SELECT CASE WHEN ISNULL(@n, -1) = -1 OR @n >= 12 THEN 'compliant' ELSE 'noncompliant' END;"

Expected output

compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Adjust the number of logs to prevent data loss. The default value of 6 may be insufficient for a production environment. Perform either the GUI or T-SQL method shown: GUI Method 1. Open SQL Server Management Studio. 2. Open Object Explorer and connect to the target instance. 3. Navigate to the Management tab in Object Explorer and expand. Right click on the SQL Server Logs file and select Configure 4. Check the Limit the number of error log files before they are recycled 5. Set the Maximum number of error log files to greater than or equal to 12 T-SQL Method Run the following T-SQL to change the number of error log files, replace <NumberGreaterThan11> with your desired number of error log files: EXEC master.sys.xp_instance_regwrite N'HKEY_LOCAL_MACHINE', N'Software\Microsoft\MSSQLServer\MSSQLServer', N'NumErrorLogs', REG_DWORD, <NumberGreaterThan11>;

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

tmaegis scan --target mssql