Søren Eggert Lundsteen Olsen
2284e7f082
A DBA should be able to review every statement SQLInsight sends to a monitored server before granting it access. "SQL Scripts/<rule-id>.sql" holds, per rule (82 built-in, 16 community), a Danish header (what and why, how C# judges the data, thresholds with config keys, severity, exact GRANTs, versions, collector file and member) and the collector's SQL verbatim, every version variant as its own batch. "_collectors/<Collector>.sql" holds each collector's queries once. The only statement that is not strictly read-only is documented in the scripts: the deadlock collector's session temp table (#system_health). Inline SQL in the collectors moved to internal constants and Build*Sql methods (no text changed), so SqlScriptTests can check that the scripts still contain the SQL the code sends, that every rule has a script, that every collector query is registered, and that nothing writes. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
84 lines
5.5 KiB
Transact-SQL
84 lines
5.5 KiB
Transact-SQL
-- ===================================================================================================================
|
|
-- SQLI-AG-002: Sekundær replika er langt bagud
|
|
-- ===================================================================================================================
|
|
-- Regel-id: SQLI-AG-002
|
|
-- Titel: Sekundær replika er langt bagud
|
|
-- Alvor: Medium
|
|
-- Versioner: SQL Server 2012 og nyere med Always On slået til.
|
|
--
|
|
-- Hvad tjekkes, og hvorfor:
|
|
-- Om en sekundær replika er langt bagud: muligt datatab (commit-forsinkelse) eller lang failover-tid (redo queue).
|
|
--
|
|
-- Vurdering (sker i C# ud fra de indsamlede data, ikke i SQL'en, medmindre andet er nævnt):
|
|
-- For hver sekundær, ikke suspenderet database-replika: muligt datatab = last_commit_time på den primære - på den
|
|
-- sekundære (sekunder); recovery-tid = redo_queue_size / redo_rate (sekunder). Fund hvis datatab >= 60 s eller
|
|
-- recovery-tid >= 600 s.
|
|
--
|
|
-- Grænseværdier (konfigurationsnøgle i agentens appsettings.json og standardværdi):
|
|
-- 60 sekunder (MaxDataLossSeconds) og 600 sekunder (MaxRecoverySeconds), fast i koden.
|
|
--
|
|
-- Rettigheder til agentens login (se db/permissions/grant-least-privilege.sql; [agent] = agentens login):
|
|
-- GRANT VIEW SERVER STATE TO [agent]; -- SQL Server 2005-2019
|
|
-- GRANT VIEW SERVER PERFORMANCE STATE TO [agent]; -- SQL Server 2022+ (erstatter VIEW SERVER STATE)
|
|
-- GRANT VIEW SERVER SECURITY STATE TO [agent]; -- SQL Server 2022+
|
|
-- GRANT VIEW ANY DEFINITION TO [agent]; -- metadata; giver IKKE adgang til data
|
|
--
|
|
-- Data kommer fra (collector, fil : medlemmer, interval):
|
|
-- AvailabilityGroupCollector
|
|
-- Fil: src/SQLInsight.Collectors/Instance/AvailabilityGroupCollector.cs
|
|
-- Medlemmer: AvailabilityGroupCollector.ReplicasSql, AvailabilityGroupCollector.DatabasesSql,
|
|
-- AvailabilityGroupCollector.ClusterMembersSql
|
|
-- Interval: 1 min som standard (SQLInsight:CollectorIntervals:availability-groups)
|
|
-- Delt script: SQL Scripts/_collectors/AvailabilityGroupCollector.sql
|
|
-- Regelkode: src/SQLInsight.Rules/Availability/AvailabilityRules.cs : AvailabilityGroupLagRule.Evaluate
|
|
--
|
|
-- Read-only: Ja: kun SELECT samt SET-sessionsindstillinger. Intet ændrer data, indstillinger eller objekter.
|
|
-- Kørsel: Kør i SSMS som agentens login (eller et login med samme rettigheder). Hver variant er sin egen batch
|
|
-- (GO); en variant for en anden SQL Server-version end din kan fejle - det er forventet.
|
|
-- Per-database-forespørgsler er vist for databasen msdb, som findes overalt: ret navnet til den
|
|
-- database, du vil se.
|
|
-- ===================================================================================================================
|
|
|
|
-- -------------------------------------------------------------------------------------------------------------------
|
|
-- Forbindelsen: Sessionsindstillinger, agenten sætter på hver forbindelse
|
|
-- -------------------------------------------------------------------------------------------------------------------
|
|
|
|
-- Variant: Alle versioner: sættes på hver forbindelse, agenten åbner
|
|
-- Kilde: SqlConnectionFactory.SessionSettings
|
|
-- Kode: src/SQLInsight.Connectivity/SqlConnectionFactory.cs : SqlConnectionFactory.SessionSettings
|
|
SET LOCK_TIMEOUT 5000; SET DEADLOCK_PRIORITY LOW; SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
|
|
GO
|
|
|
|
-- -------------------------------------------------------------------------------------------------------------------
|
|
-- AvailabilityGroupCollector: Always On: replikaer, databasereplikaer (køer, hastigheder, commit-tid) og
|
|
-- Windows-clusterets medlemmer.
|
|
-- -------------------------------------------------------------------------------------------------------------------
|
|
|
|
-- Variant: SQL Server 2012 og nyere med Always On slået til
|
|
-- Kilde: AvailabilityGroupCollector.ReplicasSql
|
|
-- Kode: src/SQLInsight.Collectors/Instance/AvailabilityGroupCollector.cs : AvailabilityGroupCollector.ReplicasSql
|
|
SELECT ag.name, ar.replica_server_name, ars.is_local, ars.role_desc, ars.connected_state_desc, ars.synchronization_health_desc,
|
|
ar.availability_mode_desc, ar.failover_mode_desc
|
|
FROM sys.availability_groups ag
|
|
JOIN sys.availability_replicas ar ON ar.group_id = ag.group_id
|
|
LEFT JOIN sys.dm_hadr_availability_replica_states ars ON ars.replica_id = ar.replica_id
|
|
GO
|
|
|
|
-- Variant: SQL Server 2012 og nyere med Always On slået til
|
|
-- Kilde: AvailabilityGroupCollector.DatabasesSql
|
|
-- Kode: src/SQLInsight.Collectors/Instance/AvailabilityGroupCollector.cs : AvailabilityGroupCollector.DatabasesSql
|
|
SELECT ag.name, DB_NAME(drs.database_id), ar.replica_server_name, drs.is_local,
|
|
CASE WHEN ars.role = 1 THEN 1 ELSE 0 END,
|
|
drs.synchronization_state_desc, drs.synchronization_health_desc, drs.is_suspended, drs.suspend_reason_desc,
|
|
drs.log_send_queue_size, drs.log_send_rate, drs.redo_queue_size, drs.redo_rate, drs.last_commit_time
|
|
FROM sys.dm_hadr_database_replica_states drs
|
|
JOIN sys.availability_replicas ar ON ar.replica_id = drs.replica_id
|
|
JOIN sys.availability_groups ag ON ag.group_id = drs.group_id
|
|
LEFT JOIN sys.dm_hadr_availability_replica_states ars ON ars.replica_id = drs.replica_id
|
|
GO
|
|
|
|
-- Variant: SQL Server 2012 og nyere med Always On slået til (tom uden Windows-cluster)
|
|
-- Kilde: AvailabilityGroupCollector.ClusterMembersSql
|
|
-- Kode: src/SQLInsight.Collectors/Instance/AvailabilityGroupCollector.cs : AvailabilityGroupCollector.ClusterMembersSql
|
|
SELECT member_name, member_type_desc, member_state, member_state_desc, number_of_quorum_votes FROM sys.dm_hadr_cluster_members
|
|
GO
|