Søren Eggert Lundsteen Olsen
2284e7f082
A DBA should be able to review every statement SQLInsight sends to a monitored server before granting it access. "SQL Scripts/<rule-id>.sql" holds, per rule (82 built-in, 16 community), a Danish header (what and why, how C# judges the data, thresholds with config keys, severity, exact GRANTs, versions, collector file and member) and the collector's SQL verbatim, every version variant as its own batch. "_collectors/<Collector>.sql" holds each collector's queries once. The only statement that is not strictly read-only is documented in the scripts: the deadlock collector's session temp table (#system_health). Inline SQL in the collectors moved to internal constants and Build*Sql methods (no text changed), so SqlScriptTests can check that the scripts still contain the SQL the code sends, that every rule has a script, that every collector query is registered, and that nothing writes. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
118 lines
7.9 KiB
Transact-SQL
118 lines
7.9 KiB
Transact-SQL
-- ===================================================================================================================
|
|
-- SQLI-LOG-004: Mange mislykkede logins
|
|
-- ===================================================================================================================
|
|
-- Regel-id: SQLI-LOG-004
|
|
-- Titel: Mange mislykkede logins
|
|
-- Alvor: Medium
|
|
-- Versioner: SQL Server 2005 og nyere (fra ring buffer kun 2008+ via connectivity ring buffer).
|
|
--
|
|
-- Hvad tjekkes, og hvorfor:
|
|
-- Om der er mange mislykkede logins (fejl 18456) på kort tid: forkert kodeord i en applikation eller et forsøg på
|
|
-- at gætte kodeord.
|
|
--
|
|
-- Vurdering (sker i C# ud fra de indsamlede data, ikke i SQL'en, medmindre andet er nævnt):
|
|
-- Kun den seneste måling (ikke døgnets sum): fund hvis antallet af fejl 18456 siden forrige måling (normalt 5
|
|
-- minutter) er mindst grænsen.
|
|
--
|
|
-- Grænseværdier (konfigurationsnøgle i agentens appsettings.json og standardværdi):
|
|
-- SQLInsight:ErrorLog:LoginFailureBurst, standard 20.
|
|
--
|
|
-- Rettigheder til agentens login (se db/permissions/grant-least-privilege.sql; [agent] = agentens login):
|
|
-- GRANT VIEW SERVER STATE TO [agent]; -- SQL Server 2005-2019
|
|
-- GRANT VIEW SERVER PERFORMANCE STATE TO [agent]; -- SQL Server 2022+ (erstatter VIEW SERVER STATE)
|
|
-- GRANT VIEW SERVER SECURITY STATE TO [agent]; -- SQL Server 2022+
|
|
-- Valgfrit: GRANT ALTER TRACE TO [agent]; -- default trace (udkommenteret i grant-least-privilege.sql; uden den bruges næste kilde)
|
|
-- Valgfrit: ALTER SERVER ROLE [securityadmin] ADD MEMBER [agent]; -- xp_readerrorlog; gives IKKE som standard
|
|
--
|
|
-- Data kommer fra (collector, fil : medlemmer, interval):
|
|
-- ErrorLogCollector
|
|
-- Fil: src/SQLInsight.Collectors/Instance/ErrorLogCollector.cs
|
|
-- Medlemmer: ErrorLogCollector.CanReadErrorLogSql, ErrorLogCollector.BuildErrorLogSql(fromLocal, toLocal),
|
|
-- PrivilegeCollector.DefaultTracePathSql, ErrorLogCollector.BuildDefaultTraceSql(files, sinceLocal),
|
|
-- ErrorLogCollector.RingBufferSql, ErrorLogCollector.ConnectivitySql
|
|
-- Interval: 5 min som standard (SQLInsight:CollectorIntervals:error-log)
|
|
-- Delt script: SQL Scripts/_collectors/ErrorLogCollector.sql
|
|
-- Regelkode: src/SQLInsight.Rules/Instance/ErrorLogRules.cs : LoginFailureBurstRule
|
|
--
|
|
-- Read-only: Ja: kun SELECT samt xp_readerrorlog (læser fejlloggen), sys.fn_trace_gettable (læser default trace),
|
|
-- SET-sessionsindstillinger. Intet ændrer data, indstillinger eller objekter.
|
|
-- Kørsel: Kør i SSMS som agentens login (eller et login med samme rettigheder). Hver variant er sin egen batch
|
|
-- (GO); en variant for en anden SQL Server-version end din kan fejle - det er forventet.
|
|
-- Per-database-forespørgsler er vist for databasen msdb, som findes overalt: ret navnet til den
|
|
-- database, du vil se.
|
|
-- ===================================================================================================================
|
|
|
|
-- -------------------------------------------------------------------------------------------------------------------
|
|
-- Forbindelsen: Sessionsindstillinger, agenten sætter på hver forbindelse
|
|
-- -------------------------------------------------------------------------------------------------------------------
|
|
|
|
-- Variant: Alle versioner: sættes på hver forbindelse, agenten åbner
|
|
-- Kilde: SqlConnectionFactory.SessionSettings
|
|
-- Kode: src/SQLInsight.Connectivity/SqlConnectionFactory.cs : SqlConnectionFactory.SessionSettings
|
|
SET LOCK_TIMEOUT 5000; SET DEADLOCK_PRIORITY LOW; SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
|
|
GO
|
|
|
|
-- -------------------------------------------------------------------------------------------------------------------
|
|
-- ErrorLogCollector: SQL Server-fejlloggen siden forrige måling fra den bedste kilde, agentens rettigheder giver: 1)
|
|
-- fejlloggen (xp_readerrorlog, kræver securityadmin), 2) default trace (kræver ALTER TRACE), 3) exception- og
|
|
-- connectivity ring buffer (kun fejlnumre).
|
|
-- -------------------------------------------------------------------------------------------------------------------
|
|
|
|
-- Variant: SQL Server 2005 og nyere
|
|
-- Kilde: ErrorLogCollector.CanReadErrorLogSql
|
|
-- Kode: src/SQLInsight.Collectors/Instance/ErrorLogCollector.cs : ErrorLogCollector.CanReadErrorLogSql
|
|
SELECT CASE WHEN IS_SRVROLEMEMBER(N'securityadmin') = 1 OR IS_SRVROLEMEMBER(N'sysadmin') = 1 THEN 1 ELSE 0 END,
|
|
DATEDIFF(minute, GETUTCDATE(), GETDATE()), GETUTCDATE()
|
|
GO
|
|
|
|
-- Variant: SQL Server 2005 og nyere, kilde 1: fejlloggen (når agenten er securityadmin)
|
|
-- Kilde: ErrorLogCollector.BuildErrorLogSql
|
|
-- Kode: src/SQLInsight.Collectors/Instance/ErrorLogCollector.cs : ErrorLogCollector.BuildErrorLogSql(fromLocal, toLocal)
|
|
-- Agenten indsætter tidspunktet for forrige måling og nu + 1 minut (serverens lokale tid) som literaler, fx
|
|
-- '2026-10-02T09:00:00'. Her er de variabler, så scriptet kan køres i SSMS.
|
|
DECLARE @fra nvarchar(19);
|
|
DECLARE @til nvarchar(19);
|
|
SET @fra = CONVERT(nvarchar(19), DATEADD(hour, -1, GETDATE()), 126);
|
|
SET @til = CONVERT(nvarchar(19), DATEADD(minute, 1, GETDATE()), 126);
|
|
EXEC master.dbo.xp_readerrorlog 0, 1, NULL, NULL, @fra, @til
|
|
GO
|
|
|
|
-- Variant: SQL Server 2005 og nyere, kilde 2: default trace (når agenten har ALTER TRACE)
|
|
-- Kilde: ErrorLogCollector.DefaultTracePathSql
|
|
-- Kode: src/SQLInsight.Collectors/Instance/PrivilegeCollector.cs : PrivilegeCollector.DefaultTracePathSql
|
|
SELECT path, DATEDIFF(minute, GETUTCDATE(), GETDATE()) FROM sys.traces WHERE is_default = 1
|
|
GO
|
|
|
|
-- Variant: SQL Server 2005 og nyere, kilde 2: default trace (når agenten har ALTER TRACE)
|
|
-- Kilde: ErrorLogCollector.BuildDefaultTraceSql
|
|
-- Kode: src/SQLInsight.Collectors/Instance/ErrorLogCollector.cs : ErrorLogCollector.BuildDefaultTraceSql(files, sinceLocal)
|
|
-- Agenten indsætter filargumenterne som literaler: første gang og efter rollover mappen + log.trc med DEFAULT (alle
|
|
-- rollover-filer), ellers den aktuelle fil med 1 (kun den fil), samt tidspunktet for forrige måling (lokal tid).
|
|
-- Her er de variabler, så scriptet kan køres i SSMS.
|
|
DECLARE @fil nvarchar(260);
|
|
DECLARE @siden nvarchar(19);
|
|
SELECT @fil = LEFT(path, LEN(path) - CHARINDEX(N'\', REVERSE(path)) + 1) + N'log.trc' FROM sys.traces WHERE is_default = 1;
|
|
SET @siden = CONVERT(nvarchar(19), DATEADD(hour, -1, GETDATE()), 126);
|
|
SELECT StartTime, EventClass, Error, Severity, CAST(TextData AS nvarchar(2000))
|
|
FROM sys.fn_trace_gettable(@fil, DEFAULT)
|
|
WHERE EventClass IN (20, 22) AND StartTime > @siden
|
|
GO
|
|
|
|
-- Variant: SQL Server 2005 og nyere, kilde 3: exception ring buffer (kun VIEW SERVER STATE)
|
|
-- Kilde: ErrorLogCollector.RingBufferSql
|
|
-- Kode: src/SQLInsight.Collectors/Instance/ErrorLogCollector.cs : ErrorLogCollector.RingBufferSql
|
|
SELECT DATEADD(millisecond, -CAST((i.ms_ticks - rb.timestamp) % 1000 AS int), DATEADD(second, -CAST((i.ms_ticks - rb.timestamp) / 1000 AS int), GETUTCDATE())),
|
|
rb.x.value('(//Exception/Error)[1]', 'int'), rb.x.value('(//Exception/Severity)[1]', 'int')
|
|
FROM (SELECT timestamp, CAST(record AS xml) AS x FROM sys.dm_os_ring_buffers WHERE ring_buffer_type = N'RING_BUFFER_EXCEPTION') rb
|
|
CROSS JOIN sys.dm_os_sys_info i
|
|
GO
|
|
|
|
-- Variant: SQL Server 2008 og nyere, kilde 3: mislykkede logins fra connectivity ring buffer
|
|
-- Kilde: ErrorLogCollector.ConnectivitySql
|
|
-- Kode: src/SQLInsight.Collectors/Instance/ErrorLogCollector.cs : ErrorLogCollector.ConnectivitySql
|
|
SELECT DATEADD(millisecond, -CAST((i.ms_ticks - rb.timestamp) % 1000 AS int), DATEADD(second, -CAST((i.ms_ticks - rb.timestamp) / 1000 AS int), GETUTCDATE())),
|
|
rb.x.value('(//SniConsumerError)[1]', 'int'), rb.x.value('(//State)[1]', 'int'), rb.x.value('(//RemoteHost)[1]', 'nvarchar(128)')
|
|
FROM (SELECT timestamp, CAST(record AS xml) AS x FROM sys.dm_os_ring_buffers
|
|
WHERE ring_buffer_type = N'RING_BUFFER_CONNECTIVITY' AND record LIKE N'%<SniConsumerError>18456</SniConsumerError>%') rb
|
|
CROSS JOIN sys.dm_os_sys_info i
|
|
GO
|