Søren Eggert Lundsteen Olsen
2284e7f082
A DBA should be able to review every statement SQLInsight sends to a monitored server before granting it access. "SQL Scripts/<rule-id>.sql" holds, per rule (82 built-in, 16 community), a Danish header (what and why, how C# judges the data, thresholds with config keys, severity, exact GRANTs, versions, collector file and member) and the collector's SQL verbatim, every version variant as its own batch. "_collectors/<Collector>.sql" holds each collector's queries once. The only statement that is not strictly read-only is documented in the scripts: the deadlock collector's session temp table (#system_health). Inline SQL in the collectors moved to internal constants and Build*Sql methods (no text changed), so SqlScriptTests can check that the scripts still contain the SQL the code sends, that every rule has a script, that every collector query is registered, and that nothing writes. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
121 lines
7.8 KiB
Transact-SQL
121 lines
7.8 KiB
Transact-SQL
-- ===================================================================================================================
|
|
-- SQLI-CFG-013: Konfiguration ændret
|
|
-- ===================================================================================================================
|
|
-- Regel-id: SQLI-CFG-013
|
|
-- Titel: Konfiguration ændret
|
|
-- Alvor: Info
|
|
-- Versioner: Alle. Tjenestekonti kun fra SQL Server 2008 R2 SP1 (sys.dm_server_services).
|
|
--
|
|
-- Hvad tjekkes, og hvorfor:
|
|
-- Om nogen har ændret en sp_configure-indstilling, et globalt trace flag eller en tjenestekonto. Information, så
|
|
-- ændringen er synlig.
|
|
--
|
|
-- Vurdering (sker i C# ud fra de indsamlede data, ikke i SQL'en, medmindre andet er nævnt):
|
|
-- InstanceConfigurationCollector bygger et "fingeraftryk" af sp_configure (value_in_use), globale trace flags,
|
|
-- tjenester og konti, version, udgave, collation, tempdb-filer m.m. og sammenligner med forrige måling (gemt i
|
|
-- agentens repository, så en ændring mens agenten var nede også ses). Ændringer i områderne sp_configure, trace
|
|
-- flag og tjenestekonto inden for de seneste 24 timer giver ét Info-fund pr. ændring. Alt sker i C#; SQL'en læser
|
|
-- kun de nuværende værdier.
|
|
--
|
|
-- Grænseværdier (konfigurationsnøgle i agentens appsettings.json og standardværdi):
|
|
-- Fundet holdes åbent i 24 timer (ConfigurationFingerprint.RecentWindow, fast i koden).
|
|
--
|
|
-- Rettigheder til agentens login (se db/permissions/grant-least-privilege.sql; [agent] = agentens login):
|
|
-- GRANT VIEW SERVER STATE TO [agent]; -- SQL Server 2005-2019
|
|
-- GRANT VIEW SERVER PERFORMANCE STATE TO [agent]; -- SQL Server 2022+ (erstatter VIEW SERVER STATE)
|
|
-- GRANT VIEW SERVER SECURITY STATE TO [agent]; -- SQL Server 2022+
|
|
-- GRANT VIEW ANY DEFINITION TO [agent]; -- metadata; giver IKKE adgang til data
|
|
--
|
|
-- Data kommer fra (collector, fil : medlemmer, interval):
|
|
-- InstanceConfigurationCollector
|
|
-- Fil: src/SQLInsight.Collectors/Instance/InstanceConfigurationCollector.cs
|
|
-- Medlemmer: InstanceConfigurationCollector.PropertiesSql, InstanceConfigurationCollector.TempdbSql,
|
|
-- InstanceConfigurationCollector.ColumnsSql, InstanceConfigurationCollector.BuildServicesSql(true),
|
|
-- InstanceConfigurationCollector.BuildServicesSql(false), InstanceConfigurationCollector.MemoryModelSql
|
|
-- Interval: 15 min som standard (SQLInsight:CollectorIntervals:instance-config)
|
|
-- Delt script: SQL Scripts/_collectors/InstanceConfigurationCollector.sql
|
|
-- Regelkode: src/SQLInsight.Rules/Configuration/ConfigurationRules.cs : ConfigurationChangedRule.Evaluate
|
|
--
|
|
-- Read-only: Ja: kun SELECT samt DBCC TRACESTATUS (læser trace flags), SET-sessionsindstillinger. Intet ændrer
|
|
-- data, indstillinger eller objekter.
|
|
-- Kørsel: Kør i SSMS som agentens login (eller et login med samme rettigheder). Hver variant er sin egen batch
|
|
-- (GO); en variant for en anden SQL Server-version end din kan fejle - det er forventet.
|
|
-- Per-database-forespørgsler er vist for databasen msdb, som findes overalt: ret navnet til den
|
|
-- database, du vil se.
|
|
-- ===================================================================================================================
|
|
|
|
-- -------------------------------------------------------------------------------------------------------------------
|
|
-- Forbindelsen: Sessionsindstillinger, agenten sætter på hver forbindelse
|
|
-- -------------------------------------------------------------------------------------------------------------------
|
|
|
|
-- Variant: Alle versioner: sættes på hver forbindelse, agenten åbner
|
|
-- Kilde: SqlConnectionFactory.SessionSettings
|
|
-- Kode: src/SQLInsight.Connectivity/SqlConnectionFactory.cs : SqlConnectionFactory.SessionSettings
|
|
SET LOCK_TIMEOUT 5000; SET DEADLOCK_PRIORITY LOW; SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
|
|
GO
|
|
|
|
-- -------------------------------------------------------------------------------------------------------------------
|
|
-- InstanceConfigurationCollector: Instansens opsætning til konfigurationssiden og ændringsloggen: egenskaber,
|
|
-- tempdb-filer, tjenester og konti, Instant File Initialization, memory model, sp_configure og trace flags.
|
|
-- -------------------------------------------------------------------------------------------------------------------
|
|
|
|
-- Variant: SQL Server 2005 og nyere (samme forespørgsel som ConfigurationCollector)
|
|
-- Kilde: ConfigurationCollector.Sql2005
|
|
-- Kode: src/SQLInsight.Collectors/Instance/ConfigurationCollector.cs : ConfigurationCollector.Sql2005
|
|
SELECT name, CAST(value AS bigint), CAST(value_in_use AS bigint) FROM sys.configurations
|
|
GO
|
|
|
|
-- Variant: SQL Server 2000 (legacy ODBC-sti) (samme forespørgsel som ConfigurationCollector)
|
|
-- Kilde: ConfigurationCollector.Sql2000
|
|
-- Kode: src/SQLInsight.Collectors/Instance/ConfigurationCollector.cs : ConfigurationCollector.Sql2000
|
|
SELECT v.name, CAST(c.value AS bigint), CAST(r.value AS bigint)
|
|
FROM master.dbo.spt_values v
|
|
JOIN master.dbo.sysconfigures c ON c.config = v.number
|
|
JOIN master.dbo.syscurconfigs r ON r.config = v.number
|
|
WHERE v.type = 'C'
|
|
GO
|
|
|
|
-- Variant: Alle versioner (SQL Server 2000 og nyere) (samme forespørgsel som TraceFlagCollector)
|
|
-- Kilde: TraceFlagCollector.Sql
|
|
-- Kode: src/SQLInsight.Collectors/Instance/TraceFlagCollector.cs : TraceFlagCollector.Sql
|
|
DBCC TRACESTATUS(-1) WITH NO_INFOMSGS
|
|
GO
|
|
|
|
-- Variant: Alle versioner
|
|
-- Kilde: InstanceConfigurationCollector.PropertiesSql
|
|
-- Kode: src/SQLInsight.Collectors/Instance/InstanceConfigurationCollector.cs : InstanceConfigurationCollector.PropertiesSql
|
|
SELECT CAST(SERVERPROPERTY('ProductVersion') AS nvarchar(128)), CAST(SERVERPROPERTY('ProductLevel') AS nvarchar(128)),
|
|
CAST(SERVERPROPERTY('Edition') AS nvarchar(128)), CAST(SERVERPROPERTY('Collation') AS nvarchar(128)),
|
|
CAST(SERVERPROPERTY('InstanceDefaultDataPath') AS nvarchar(260)), CAST(SERVERPROPERTY('InstanceDefaultLogPath') AS nvarchar(260))
|
|
GO
|
|
|
|
-- Variant: SQL Server 2005 og nyere
|
|
-- Kilde: InstanceConfigurationCollector.TempdbSql
|
|
-- Kode: src/SQLInsight.Collectors/Instance/InstanceConfigurationCollector.cs : InstanceConfigurationCollector.TempdbSql
|
|
SELECT name, type_desc, CAST(size AS bigint) / 128, growth, is_percent_growth, max_size
|
|
FROM sys.master_files WHERE database_id = 2 ORDER BY file_id
|
|
GO
|
|
|
|
-- Variant: SQL Server 2008 R2 SP1 og nyere
|
|
-- Kilde: InstanceConfigurationCollector.ColumnsSql
|
|
-- Kode: src/SQLInsight.Collectors/Instance/InstanceConfigurationCollector.cs : InstanceConfigurationCollector.ColumnsSql
|
|
SELECT COL_LENGTH('sys.dm_server_services', 'instant_file_initialization_enabled'), COL_LENGTH('sys.dm_os_sys_info', 'sql_memory_model_desc')
|
|
GO
|
|
|
|
-- Variant: SQL Server 2008 R2 SP1 og nyere, builds med kolonnen instant_file_initialization_enabled (se ColumnsSql)
|
|
-- Kilde: InstanceConfigurationCollector.BuildServicesSql(med IFI)
|
|
-- Kode: src/SQLInsight.Collectors/Instance/InstanceConfigurationCollector.cs : InstanceConfigurationCollector.BuildServicesSql(true)
|
|
SELECT servicename, service_account, startup_type_desc, status_desc, instant_file_initialization_enabled FROM sys.dm_server_services
|
|
GO
|
|
|
|
-- Variant: SQL Server 2008 R2 SP1 og nyere, builds uden kolonnen instant_file_initialization_enabled
|
|
-- Kilde: InstanceConfigurationCollector.BuildServicesSql(uden IFI)
|
|
-- Kode: src/SQLInsight.Collectors/Instance/InstanceConfigurationCollector.cs : InstanceConfigurationCollector.BuildServicesSql(false)
|
|
SELECT servicename, service_account, startup_type_desc, status_desc, CAST(NULL AS nvarchar(1)) FROM sys.dm_server_services
|
|
GO
|
|
|
|
-- Variant: Builds med kolonnen sql_memory_model_desc (se ColumnsSql)
|
|
-- Kilde: InstanceConfigurationCollector.MemoryModelSql
|
|
-- Kode: src/SQLInsight.Collectors/Instance/InstanceConfigurationCollector.cs : InstanceConfigurationCollector.MemoryModelSql
|
|
SELECT sql_memory_model_desc FROM sys.dm_os_sys_info
|
|
GO
|