Søren Eggert Lundsteen Olsen
e6840e40d7
A five-minute collector reads important error log entries from the best
source the agent's rights allow: the error log itself (xp_readerrorlog,
only with securityadmin), the default trace's ErrorLog and Audit Login
Failed events (optional ALTER TRACE), or the exception and connectivity
ring buffers (VIEW SERVER STATE: numbers and severity, failed logins).
Repetitions are summed per error; the watermark is the newest entry
read, because the default trace is buffered. Stored in
insight.ErrorLogEvents (migration 0013, EventDays), resumed after restart.
Rules SQLI-LOG-001..006: corruption 823/824/825, I/O over 15 s (833),
severe errors (17+), login failure bursts (configurable), stack dumps and
AG errors; rules needing the log text are "not measurable" with the
right to grant. Page /instanser/{navn}/fejllog (menu Overvågning) and
GET /api/v1/instances/{name}/error-log with messages redacted.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
54 lines
2.5 KiB
C#
54 lines
2.5 KiB
C#
using SQLInsight.Collectors.Concurrency;
|
|
using SQLInsight.Collectors.Databases;
|
|
using SQLInsight.Collectors.Instance;
|
|
using SQLInsight.Collectors.Performance;
|
|
|
|
namespace SQLInsight.Collectors;
|
|
|
|
public static class BuiltInCollectors
|
|
{
|
|
/// <param name="custom">Community and local rules whose queries are run by the custom-rules collector.</param>
|
|
/// <param name="settings">The customer's settings for collectors that need them; defaults when null.</param>
|
|
public static IReadOnlyList<ICollector> Create(Core.CustomRules.CustomRuleCatalog? custom = null, CollectorSettings? settings = null)
|
|
{
|
|
settings ??= new CollectorSettings();
|
|
return
|
|
[
|
|
new ServerCollector(),
|
|
new ConfigurationCollector(),
|
|
new TraceFlagCollector(),
|
|
new InstanceConfigurationCollector(),
|
|
new PrivilegeCollector(settings.Groups, settings.MaxSysadminAccounts),
|
|
new DatabaseCollector(),
|
|
new SuspectPageCollector(),
|
|
new PlanCacheCollector(),
|
|
new WaitStatsCollector(),
|
|
new FileIoCollector(),
|
|
new QueryStatsCollector(settings.ActivityThresholdPercent),
|
|
new WaitSamplingCollector(),
|
|
new LongOperationCollector(),
|
|
new ErrorLogCollector(settings.LoginFailureBurst),
|
|
new PerformanceCounterCollector(),
|
|
new CpuCollector(),
|
|
new BlockingCollector(),
|
|
new DeadlockCollector(),
|
|
new QueryStoreCollector(),
|
|
new PlanAnalysisCollector(),
|
|
new IndexCollector(),
|
|
new AvailabilityGroupCollector(),
|
|
new AgentJobCollector(),
|
|
.. custom is null ? Array.Empty<ICollector>() : [new Custom.CustomQueryCollector(custom)],
|
|
];
|
|
}
|
|
}
|
|
|
|
/// <summary>Settings from the agent's configuration that some collectors need.</summary>
|
|
/// <param name="Groups">Unfolds Windows groups with server rights to the people in them (Active Directory).</param>
|
|
/// <param name="MaxSysadminAccounts">More people and accounts with sysadmin than this is a finding.</param>
|
|
/// <param name="ActivityThresholdPercent">A statement using more CPU time than this share of its lifetime is a finding.</param>
|
|
/// <param name="LoginFailureBurst">Failed logins within one collection (5 minutes) before it is a finding.</param>
|
|
public sealed record CollectorSettings(
|
|
Core.Data.IGroupMemberResolver? Groups = null,
|
|
int MaxSysadminAccounts = 3,
|
|
double ActivityThresholdPercent = 50,
|
|
int LoginFailureBurst = 20);
|