Søren Eggert Lundsteen Olsen
e6840e40d7
A five-minute collector reads important error log entries from the best
source the agent's rights allow: the error log itself (xp_readerrorlog,
only with securityadmin), the default trace's ErrorLog and Audit Login
Failed events (optional ALTER TRACE), or the exception and connectivity
ring buffers (VIEW SERVER STATE: numbers and severity, failed logins).
Repetitions are summed per error; the watermark is the newest entry
read, because the default trace is buffered. Stored in
insight.ErrorLogEvents (migration 0013, EventDays), resumed after restart.
Rules SQLI-LOG-001..006: corruption 823/824/825, I/O over 15 s (833),
severe errors (17+), login failure bursts (configurable), stack dumps and
AG errors; rules needing the log text are "not measurable" with the
right to grant. Page /instanser/{navn}/fejllog (menu Overvågning) and
GET /api/v1/instances/{name}/error-log with messages redacted.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
18 lines
809 B
SQL
18 lines
809 B
SQL
/* Important SQL Server error log entries, summed per collection and error (corruption, slow I/O, severe errors, login
|
|
failures, stack dumps, AG). Sample is a message and can name logins and addresses: local only. Kept EventDays. */
|
|
CREATE TABLE insight.ErrorLogEvents
|
|
(
|
|
EventId bigint IDENTITY(1, 1) NOT NULL CONSTRAINT PK_ErrorLogEvents PRIMARY KEY NONCLUSTERED,
|
|
InstanceId int NOT NULL,
|
|
CollectedAt datetime2(0) NOT NULL,
|
|
Category varchar(32) NOT NULL,
|
|
Error int NULL,
|
|
Severity int NULL,
|
|
[Count] int NOT NULL,
|
|
FirstAt datetime2(0) NOT NULL,
|
|
LastAt datetime2(0) NOT NULL,
|
|
Sample nvarchar(500) NULL,
|
|
Source varchar(16) NOT NULL
|
|
);
|
|
|
|
CREATE CLUSTERED INDEX CX_ErrorLogEvents ON insight.ErrorLogEvents (InstanceId, LastAt);
|