From a256e4c8cc7f58fc7c760aa980c346b2763b8a02 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?S=C3=B8ren=20Eggert=20Lundsteen=20Olsen?= Date: Fri, 2 Oct 2026 11:31:53 +0200 Subject: [PATCH] Review 1.2: say correctly what each error log source shows The error log page called the default trace "the whole error log" and said it has every line, and the ring buffer source told SQLI-LOG-002/005 to grant ALTER TRACE, which does not make 833 or stack dumps visible (they are only in the error log itself). The rules now say that it takes securityadmin, why SQLInsight does not grant it, and the exact statement. Co-Authored-By: Claude Opus 5.5 (1M context) --- src/SQLInsight.Core/Data/ErrorLog.cs | 2 +- src/SQLInsight.Rules/Instance/ErrorLogRules.cs | 8 ++++++-- src/SQLInsight.Web/Components/Pages/ErrorLogPage.razor | 4 ++-- tests/SQLInsight.Rules.Tests/ErrorLogRuleTests.cs | 2 +- 4 files changed, 10 insertions(+), 6 deletions(-) diff --git a/src/SQLInsight.Core/Data/ErrorLog.cs b/src/SQLInsight.Core/Data/ErrorLog.cs index a3fc915..d0454fb 100644 --- a/src/SQLInsight.Core/Data/ErrorLog.cs +++ b/src/SQLInsight.Core/Data/ErrorLog.cs @@ -9,7 +9,7 @@ public enum ErrorLogSource /// The error log itself (xp_readerrorlog): everything. Needs securityadmin, which the agent normally does not have. ErrorLog, - /// The default trace's ErrorLog and Audit Login Failed events: every error log line. Needs ALTER TRACE (optional). + /// The default trace's ErrorLog and Audit Login Failed events: severe errors with text and failed logins, not 833 or stack dumps. Needs ALTER TRACE (optional). DefaultTrace, /// The exception ring buffer: error numbers and severity, no text. Needs only VIEW SERVER STATE. diff --git a/src/SQLInsight.Rules/Instance/ErrorLogRules.cs b/src/SQLInsight.Rules/Instance/ErrorLogRules.cs index d34670e..9adb32c 100644 --- a/src/SQLInsight.Rules/Instance/ErrorLogRules.cs +++ b/src/SQLInsight.Rules/Instance/ErrorLogRules.cs @@ -31,7 +31,8 @@ public abstract class ErrorLogRule(ErrorLogCategory category, bool needsText) : var snapshot = context.Data.Get(); if (needsText && snapshot.Source != ErrorLogSource.ErrorLog) { - throw new DataUnavailableException(snapshot.Coverage ?? ErrorLogCollectorText.Coverage); + // Not the snapshot's coverage text: that recommends ALTER TRACE, which does not make 833 or stack dumps visible. + throw new DataUnavailableException(ErrorLogCollectorText.NeedsErrorLog); } return Result(Relevant(snapshot).Select(g => CreateFinding( @@ -56,7 +57,10 @@ public abstract class ErrorLogRule(ErrorLogCategory category, bool needsText) : internal static class ErrorLogCollectorText { - public const string Coverage = "Fejlloggen kan ikke læses fuldt ud med agentens rettigheder. Giv agenten ALTER TRACE (valgfrit i grant-least-privilege.sql)."; + public const string NeedsErrorLog = + "Langsom I/O (833) og stack dumps står kun i selve fejlloggen (xp_readerrorlog), som kræver serverrollen securityadmin; ALTER TRACE er ikke nok. " + + "SQLInsight giver ikke agenten securityadmin som standard, fordi rollen kan tildele rettigheder. Ønskes det alligevel: " + + "ALTER SERVER ROLE securityadmin ADD MEMBER [agentens login]; (SQL Server 2005-2008 R2: EXEC sp_addsrvrolemember N'agentens login', N'securityadmin';)"; } public sealed class CorruptionErrorRule() : ErrorLogRule(ErrorLogCategory.Corruption, needsText: false) diff --git a/src/SQLInsight.Web/Components/Pages/ErrorLogPage.razor b/src/SQLInsight.Web/Components/Pages/ErrorLogPage.razor index 2cead25..660fc94 100644 --- a/src/SQLInsight.Web/Components/Pages/ErrorLogPage.razor +++ b/src/SQLInsight.Web/Components/Pages/ErrorLogPage.razor @@ -59,7 +59,7 @@ else
Hvad betyder det? -

SQL Servers fejllog er instansens dagbog. SQLInsight Pro læser den uden at have adgang til selve filen: med rettigheden ALTER TRACE (valgfri i grant-least-privilege.sql) via default trace, som har hver linje, og ellers kun fejlnumre fra SQL Servers exception ring buffer. Beskadigede sider (823/824/825) og I/O over 15 sekunder (833) peger næsten altid på storage og skal undersøges med det samme.

+

SQL Servers fejllog er instansens dagbog. SQLInsight Pro bruger den bedste kilde, agentens rettigheder giver: selve fejlloggen kun med serverrollen securityadmin (gives ikke som standard), med rettigheden ALTER TRACE (valgfri i grant-least-privilege.sql) default trace med alvorlige fejl og mislykkede logins, og ellers kun fejlnumre fra SQL Servers exception ring buffer. Langsom I/O (833) og stack dumps ses kun i selve fejlloggen. Beskadigede sider (823/824/825) og I/O over 15 sekunder (833) peger næsten altid på storage og skal undersøges med det samme.

@@ -88,7 +88,7 @@ else public static string SourceText(ErrorLogSource source) => source switch { ErrorLogSource.ErrorLog => "fejlloggen", - ErrorLogSource.DefaultTrace => "default trace (hele fejlloggen)", + ErrorLogSource.DefaultTrace => "default trace (alvorlige fejl og mislykkede logins)", _ => "exception ring buffer (kun fejlnumre)", }; diff --git a/tests/SQLInsight.Rules.Tests/ErrorLogRuleTests.cs b/tests/SQLInsight.Rules.Tests/ErrorLogRuleTests.cs index e3c5e29..1f94ead 100644 --- a/tests/SQLInsight.Rules.Tests/ErrorLogRuleTests.cs +++ b/tests/SQLInsight.Rules.Tests/ErrorLogRuleTests.cs @@ -36,7 +36,7 @@ public class ErrorLogRuleTests var result = Run(new SlowIoErrorRule(), With(Log(ErrorLogSource.RingBuffer))); Assert.Equal(RuleOutcome.NotMeasurable, result.Outcome); - Assert.Contains("ALTER TRACE", result.Reason, StringComparison.Ordinal); + Assert.Contains("securityadmin ADD MEMBER", result.Reason, StringComparison.Ordinal); Assert.Equal(RuleOutcome.NotMeasurable, Run(new SlowIoErrorRule(), With(Log(ErrorLogSource.DefaultTrace))).Outcome); Assert.Equal(RuleOutcome.Findings, Run(new SlowIoErrorRule(), With(Log(ErrorLogSource.ErrorLog, G(ErrorLogCategory.SlowIo, 833, 10)))).Outcome); Assert.Equal(RuleOutcome.NotMeasurable, Run(new StackDumpRule(), With(Log(ErrorLogSource.RingBuffer))).Outcome);