Søren Eggert Lundsteen Olsen
a256e4c8cc
The error log page called the default trace "the whole error log" and said it has every line, and the ring buffer source told SQLI-LOG-002/005 to grant ALTER TRACE, which does not make 833 or stack dumps visible (they are only in the error log itself). The rules now say that it takes securityadmin, why SQLInsight does not grant it, and the exact statement. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
56 lines
2.8 KiB
C#
56 lines
2.8 KiB
C#
using SQLInsight.Core.Data;
|
|
using SQLInsight.Core.Findings;
|
|
using SQLInsight.Rules.Engine;
|
|
using SQLInsight.Rules.Instance;
|
|
using static SQLInsight.Rules.Tests.TestInstances;
|
|
|
|
namespace SQLInsight.Rules.Tests;
|
|
|
|
public class ErrorLogRuleTests
|
|
{
|
|
private static RuleResult Run(IRule rule, RuleContext context) => Assert.Single(new RuleEngine([rule]).Evaluate(context));
|
|
|
|
private static ErrorLogSnapshot Log(ErrorLogSource source, params ErrorLogGroup[] groups) => new()
|
|
{
|
|
CapturedAt = Now, Source = source, ReadUntil = Now, Groups = groups, Recent = groups, LoginFailureBurst = 20,
|
|
Coverage = source == ErrorLogSource.ErrorLog ? null : "Giv agenten ALTER TRACE eller securityadmin",
|
|
};
|
|
|
|
private static ErrorLogGroup G(ErrorLogCategory category, int error, int severity, int count = 1) =>
|
|
new(category, error, severity, count, Now.AddMinutes(-3), Now.AddMinutes(-1), "Error text with login 'anne'");
|
|
|
|
[Theory]
|
|
[InlineData(824, Severity.Critical)]
|
|
[InlineData(825, Severity.High)]
|
|
public void Corruption_is_critical_and_read_retries_high(int error, Severity expected)
|
|
{
|
|
var finding = Assert.Single(Run(new CorruptionErrorRule(), With(Log(ErrorLogSource.DefaultTrace, G(ErrorLogCategory.Corruption, error, 24)))).Findings);
|
|
|
|
Assert.Equal(expected, finding.Severity);
|
|
Assert.True(finding.Evidence.Single(e => e.Name == "Eksempel").Sensitive);
|
|
}
|
|
|
|
[Fact]
|
|
public void Slow_io_and_stack_dumps_need_the_text_of_the_log()
|
|
{
|
|
var result = Run(new SlowIoErrorRule(), With(Log(ErrorLogSource.RingBuffer)));
|
|
|
|
Assert.Equal(RuleOutcome.NotMeasurable, result.Outcome);
|
|
Assert.Contains("securityadmin ADD MEMBER", result.Reason, StringComparison.Ordinal);
|
|
Assert.Equal(RuleOutcome.NotMeasurable, Run(new SlowIoErrorRule(), With(Log(ErrorLogSource.DefaultTrace))).Outcome);
|
|
Assert.Equal(RuleOutcome.Findings, Run(new SlowIoErrorRule(), With(Log(ErrorLogSource.ErrorLog, G(ErrorLogCategory.SlowIo, 833, 10)))).Outcome);
|
|
Assert.Equal(RuleOutcome.NotMeasurable, Run(new StackDumpRule(), With(Log(ErrorLogSource.RingBuffer))).Outcome);
|
|
}
|
|
|
|
[Theory]
|
|
[InlineData(19, RuleOutcome.Passed)]
|
|
[InlineData(20, RuleOutcome.Findings)]
|
|
public void Login_failures_are_a_finding_from_the_burst_size(int count, RuleOutcome expected) =>
|
|
Assert.Equal(expected, Run(new LoginFailureBurstRule(), With(Log(ErrorLogSource.RingBuffer, G(ErrorLogCategory.LoginFailed, 18456, 14, count)))).Outcome);
|
|
|
|
[Theory]
|
|
[InlineData(17, Severity.Medium)]
|
|
[InlineData(21, Severity.High)]
|
|
public void Severe_errors_by_severity(int severity, Severity expected) =>
|
|
Assert.Equal(expected, Assert.Single(Run(new SevereErrorRule(), With(Log(ErrorLogSource.RingBuffer, G(ErrorLogCategory.Severe, 701, severity)))).Findings).Severity);
|
|
}
|