Søren Eggert Lundsteen Olsen
2284e7f082
A DBA should be able to review every statement SQLInsight sends to a monitored server before granting it access. "SQL Scripts/<rule-id>.sql" holds, per rule (82 built-in, 16 community), a Danish header (what and why, how C# judges the data, thresholds with config keys, severity, exact GRANTs, versions, collector file and member) and the collector's SQL verbatim, every version variant as its own batch. "_collectors/<Collector>.sql" holds each collector's queries once. The only statement that is not strictly read-only is documented in the scripts: the deadlock collector's session temp table (#system_health). Inline SQL in the collectors moved to internal constants and Build*Sql methods (no text changed), so SqlScriptTests can check that the scripts still contain the SQL the code sends, that every rule has a script, that every collector query is registered, and that nothing writes. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
40 lines
2.7 KiB
Transact-SQL
40 lines
2.7 KiB
Transact-SQL
-- ===================================================================================================================
|
|
-- Collector: CustomQueryCollector ("custom-rules")
|
|
-- ===================================================================================================================
|
|
-- Hvad: Community-reglernes (rules/community/*.json) og lokale reglers forespørgsler: én gang i master
|
|
-- (server-regler) eller i hver læsbar brugerdatabase (database-regler).
|
|
-- Fil: src/SQLInsight.Collectors/Custom/CustomQueryCollector.cs
|
|
-- Interval: 15 min som standard (SQLInsight:CollectorIntervals:custom-rules)
|
|
-- Versioner: SQL Server 2005 og nyere (pr. regel: minimumVersion)
|
|
--
|
|
-- Rettigheder til agentens login (se db/permissions/grant-least-privilege.sql; [agent] = agentens login):
|
|
-- GRANT VIEW ANY DEFINITION TO [agent]; -- metadata; giver IKKE adgang til data
|
|
-- GRANT CONNECT ANY DATABASE TO [agent]; -- SQL Server 2014+; giver IKKE adgang til data
|
|
-- Før 2014 i stedet, i hver brugerdatabase: CREATE USER [agent] FOR LOGIN [agent];
|
|
--
|
|
-- Bruges af: COM-AX-001, COM-AX-002, COM-AX-003, COM-AX-004, COM-AX-005, COM-AX-006, COM-AX-007, COM-FT-001,
|
|
-- COM-FT-002, COM-FT-003, COM-FT-004, COM-FT-005, COM-DB-001, COM-SEC-001, COM-SEC-002, COM-CFG-001
|
|
-- Read-only: Ja: kun SELECT samt USE (skifter sessionens database), SET-sessionsindstillinger. Intet ændrer data,
|
|
-- indstillinger eller objekter.
|
|
-- Kørsel: Kør i SSMS som agentens login. Hver variant er sin egen batch (GO); en variant for en anden SQL Server-version
|
|
-- end din kan fejle - det er forventet. Agenten kører altid med sessionsindstillingerne i _collectors/InstanceProbe.sql.
|
|
-- ===================================================================================================================
|
|
|
|
-- Variant: Husk databasen, der skal skiftes tilbage til
|
|
-- Kilde: CustomQueryCollector.CurrentDatabaseSql
|
|
-- Kode: src/SQLInsight.Collectors/Db.cs : Db.CurrentDatabaseSql
|
|
SELECT DB_NAME()
|
|
GO
|
|
|
|
-- Variant: Databaserne, database-regler køres i
|
|
-- Kilde: CustomQueryCollector.DatabasesSql
|
|
-- Kode: src/SQLInsight.Collectors/Custom/CustomQueryCollector.cs : CustomQueryCollector.DatabasesSql
|
|
SELECT name FROM sys.databases WHERE database_id > 4 AND state = 0 AND source_database_id IS NULL AND HAS_DBACCESS(name) = 1 ORDER BY name
|
|
GO
|
|
|
|
-- Variant: Én regel: skift database (master for server-regler, ellers hver brugerdatabase) og kør reglens forespørgsel
|
|
-- Kilde: CustomQueryCollector.BuildRuleSql
|
|
-- Kode: src/SQLInsight.Collectors/Custom/CustomQueryCollector.cs : CustomQueryCollector.BuildRuleSql(database, query)
|
|
USE [master];
|
|
-- (reglens forespørgsel: se den enkelte COM-*.sql)
|
|
GO
|