SQL Server security best practice

Security! This is the word comes in mind of every concerned person when it come...

Change the Collation Settings in MS SQL Server

This post will show you how to change the collation settings in MS SQL Server for specific database...

Resolve collation conflict

In this post I will show you how you can resolve collation conflict error...

Book: SQL Server 2008 High Availability

In this book I have tried to cover every single piece of information that might requires for installing and configuring SQL Server HA option like Clustering, Replication, Log Shipping and Database Mirroring...

Why to recompile Stored Procedure

Generally, we create views and stored procedures (proc here after) ...

Showing posts with label sql server. Show all posts
Showing posts with label sql server. Show all posts

6/24/2016

Problems When Running DBCC SHRINKFILE On SQL Server Database

Overview of the Situation

While accessing data files in SQL Server, many issues may occur that may lead to frustrating situation for users. One such situation occurs when user are running DBCC SHRINKFILE. There are many issues with running DBCC SHRINKFILE on your SQL Server data file. In the information described below, user will get to know the causes of this issue and relevant solutions to overcome from the situation.

Reason for Occurrence of Issue

The fragmentation plays a major role in the occurrence of an issue with running DBCC SHRINKFILE on your SQL Server data file. It occurs in two ways as mentioned below:

  • First is the fragmentation of file. As by default 1 MB of file size is used, commonly the file must grow. Though file fragmentation is not directly linked with the fragmentation that is within SQL table, it grounds extra IO operations.
  • Another form of fragmentation is index fragmentation. It arises when the SQL Server splits a page to permit for insertion of new row. The fragmentation of index can be restrained with
sys.dm_db_index_physical_stats

Workaround with the Situation

DBCC SHRINKFILE helps to shrink the size of .mdf file whether to a specific size or to a small size. It moves the pages of file from back to first free pages in front of file along through the importance the pages in reverse order ends up.

User can remove the fragmentation by rebuilding the index by using DBCC DBREINDEX or user can user ALTER TABLE with REBUILD option. User can use mentioned script to rebuild:

PK_Consume_Space

It helps to remove the fragmentation and after that, the user can measure both the space used by database and fragmentation.

Sometimes, the user notice that the size of database has grown from 18 to 42 megabytes. This is because the data is copied to new space in the file and there are two copies of data on disk. If the script is run to add extra space to defragmented index then, the space is allotted for the insertion of new rows without splitting. It helps to boost the performance at time of insertion, which helps to eliminate the fragmentation. User can note down the percentage, which signifies that the physical order rows in the table that are within the file helps to match the logical order of rows. This ordering of data helps in efficient reading the data.

There are the effective solutions with which user can solve the problem as mentioned:

  • User must have extra space in file. If the database keeps on increasing or very dynamic, the extra space is important to avoid the growth of file at the production time.
  • Another option is to rebuild a complete file. It requires CREATE INDEX with DROP_EXISTING statement for all the indexes that are present in file and can be difficult. The easy solution to use ALTER INDEX REORGANIZE or DBCC INDEXDEFRAG. It helps in rebuilding to remove defragmentation.

Conclusion

In the above discussion, some reasons of issues are discussed by running DBCC SHRIKFILE on SQL Server data file. Even along with this, a solution is also discussed which helps users to remove the issues with running DBCC SHRINKFILE on your SQL Server data files.

8/03/2015

SQL Server GEEKS Annual summit 2015

BannerSSGS_200x200px

Last month, I have requested my manager for an approval so that I can attend SQL Server Geeks Annual Summit 2015,  and now  when I hear back from him, I am really very excited that I will be attending.

You must be wondering what is so exciting about this Summit ? Well, let me tell you, there are number of reasons, at least for me to be that excited. 

  • In past  (even this year), when I had a chance I could not attended PASS Summit. And I always use to think why something like this is not organizing in INDIA. Well done Amit Bansal ( Blog | Twitter ) and team. You have done this, and, like other folks, I would be thankful.
  • I would be able to meet friends whom I never met in-person despite of knowing them for so long time, and to some I will be meeting after several years. For example Satya Shyam K Jayanti ( Blog | Twitter ), Amit Bansal ( Blog | Twitter ) , Prashant Kumar ( Blog | Twitter ) and probably Denny Cherry ( Blog | Twitter )  as I had few email exchange while I was authoring my book on SQL Server High Availability for Beginners.
  • I have always believed in learning, if you believe me learning is never ending process, if we want to make progress  we have to keep learning; SQLServerGeek’s Annual Summit will provide that platform to learn something new, something exciting, for instance BI, Cloud and Big Data. Learning these technologies from experts will be an advantage.

There are some personal reasons as well for me to attend this event, as I already mentioned – to meet few friends in-person, and to make few more friends. I have been knowing few of these friends while I was aspiring DBA, when I was MVP and when I was being transformed as a professional.

I have been knowing Satya Shyam K Jayanti when I was aspiring DBA, I learned many things from him. Amit Bansal, I know him since 2007 when I was an MVP, though we didn’t meet each other personally we have had many occasion to talk over phone,  email and chat. Prashant Kumar is my colleague and friend, we’ve already met in-person and we talk to each other often as he is working as technical escalation, one level up then me. I will also meet Pinal Dave ( Blog | Twitter ) if he is in city, he don’t need introduction in SQL Server community, he is like brother to me.   There are others whom I have read and it would be fun and exciting to meet if time permits, they are Benjamin Nevarez, Sarabpreet Singh and Manohar Punna.

I would like to thank them all and wish belated Guru Purnima, all as I have learned things from them all. I have always admired dedication and zest that Pinal and Amit showed for community, I wish someday I will be able to match that level of energy and dedication. Sorry I missed to name few, if I write about them all this list and post will not end.  

In last, I would like to thank Amit once again for organizing this event and providing a platform to learn and socialize with alike minded community people. I would also like to thank my manager – John Eisbrener and CEO – Paul Vallee  and my company Pythian for sponsoring me so that I can enjoy the company of alike minded geeks and learn something new.

See you there at #SSGAS2015!!!!

11/03/2013

SQL Server–Security Risk Assessment PMP Way

clip_image001Recently I had a chance to speak my friend Ashish Sharma who is my colleague too. We were discussing Project Management topics (he recently passed PMP and ACP). Our discussion ended at very interesting topic – RISK Assessment.
Definition: According to PMBOK, Projects can have unforeseen event or activity that can impact the project’s progress, result or an outcome in negative or positive way. Further, A Risk can be assessed using two factors – impact and probability. Determining the quantitative or qualitative value of risk related to a concrete situation and recognized threats is known as Risk Assessment.
So, coming to the point, how do we do Risk Assessment for Database systems, especially SQL Server ?
I myself have never come to situation where I have created or used Risk Assessment Register for SQL Server. I was thinking is there some readily available Risk Assessment Register / document somewhere? Hence, I have decided to research little more on it. I found absolutely nothing on this very topic. However, searching for different term - SQL Server security, and Risk Assessment – none found.
After spending some time researching I have found a good sample document for Risk Assessment Register that we can use, you can download it from here.
Now, this is what we have is Risk Register, how about threats? Sometime back, in 2009 I have wrote an article on SQL Server Security, using that article I have tried to pen down some threats that I can think off at this moment, they are:
Possible Threats Risk Mitigation
Virus Attack Install AV on DB Server however do not forget to exclude SQL server files
Unauthorised Logins Always use Audit (C2, Windows, SQL or both) failed login attempts and analyze them regularly. Always, rename SA / Admin account and use strong password mechanism for all the servers. If possible always try to use domain authenticated acconts.
MiM Attack To metigate MiM attach do following :
  • Isolate database server from Application / IIS Server
  • Configure SQL Server to use non-default port
  • Use Encryption / SSL
  • Use Firewall inbound / outbound rules
Root Access To avoid someone getting root access do following:
  • Disable / Rename in-built Admin account
  • Grant least access to Service Account
  • Use strong / random password
SQL Injection Do following:
  • Avoid using Dynamic SQL when you can
  • use parameterized query / stored procedure 3) Always validate the value at form level before it's being passed to database server
  • Refer above items
Known Configuration Always try to customize default configuration if you can, for example:
  • Run SQL server on non standard port
  • disable / rename SA account
  • Disable xp_cmdshell and other extended procedures

References :
http://en.wikipedia.org/wiki/Risk_assessment
http://en.wikipedia.org/wiki/Project_risk_management
http://www.brighthubpm.com/risk-management/3247-creating-a-risk-register-a-free-excel-template/
photo credit: kenteegardin via photopin cc
-- Hemantgiri S. Goswami (http://www.sql-server-citation.com )

10/18/2012

SQL Server Database Backup Report using T-SQL

Today, I am going to share few very useful scripts which will report us on Database Backup from different view points. To get the List/History/Log of all the Successful Backups
SELECT 

  b.machine_name,

  b.server_name,

  b.database_name as DBName,

  b.backup_start_date,

  b.backup_finish_date,

  CASE 

    WHEN b.[type] = 'D' THEN 'Database'

    WHEN b.[type] = 'I' THEN 'Differential database'

    WHEN b.[type] = 'L' THEN 'Log'

    WHEN b.[type] = 'F' THEN 'File or filegroup'

    WHEN b.[type] = 'G' THEN 'Differential file'

    WHEN b.[type] = 'P' THEN 'Partial'

    WHEN b.[type] = 'Q' THEN 'Differential partial'

    ELSE b.[type]

  END Backup_Type,    

  b.expiration_date,

  b.[user_name],

  DATEDIFF(MINUTE,b.backup_start_date ,b.backup_finish_date) as Total_Time_in_Minute,

  b.recovery_model,

  b.backup_size/(1024 * 1024 * 1024) as Total_Size_GB,

  bf.physical_device_name as Location

FROM 

  msdb.dbo.backupset AS b

INNER JOIN msdb.dbo.backupmediafamily AS bf

  ON b.media_set_id=bf.media_set_id

ORDER BY 

  b.backup_start_date DESC

GO
To get a list of all successful Backups taken till date for a particular Database
DECLARE @DBName AS VARCHAR(100) = 'Your Database Name'
SELECT 

  b.machine_name,

  b.server_name,

  b.database_name as DBName,

  b.backup_start_date,

  b.backup_finish_date,

  CASE 

    WHEN b.[type] = 'D' THEN 'Database'

    WHEN b.[type] = 'I' THEN 'Differential database'

    WHEN b.[type] = 'L' THEN 'Log'

    WHEN b.[type] = 'F' THEN 'File or filegroup'

    WHEN b.[type] = 'G' THEN 'Differential file'

    WHEN b.[type] = 'P' THEN 'Partial'

    WHEN b.[type] = 'Q' THEN 'Differential partial'

    ELSE b.[type]

  END Backup_Type,

  b.expiration_date,

  b.[user_name],

  DATEDIFF(MINUTE,b.backup_start_date ,b.backup_finish_date) as Total_Time_in_Minute,

  b.recovery_model,

  b.backup_size/(1024 * 1024 * 1024) as Total_Size_GB,

  bf.physical_device_name as Location

FROM 

  msdb.dbo.backupset AS b

INNER JOIN msdb.dbo.backupmediafamily AS bf

  ON b.media_set_id=bf.media_set_id

WHERE

  b.database_name = @DBName  

ORDER BY 

  b.backup_start_date DESC

GO
To get the List of all Databases which are not backed up till date
SELECT

  d.name [DB_Name]

FROM

  master.sys.databases d

LEFT JOIN msdb.dbo.backupset b

  ON b.database_name = d.name

WHERE

  d.database_id IS NULL
To get the List of all Databases which are not backed up since last X days
DECLARE @LastXDays AS INT = 1

;WITH LatestBackupSet AS (

SELECT 

  b.database_name as DBName,

  b.backup_start_date LastBackedUpOn,

  b.[user_name],

  ROW_NUMBER() OVER(PARTITION BY b.database_name ORDER BY b.backup_start_date DESC) Rnk

FROM 

  msdb.dbo.backupset AS b

)

SELECT 

  lbs.DBName,

  lbs.LastBackedUpOn,

  lbs.[user_name]

FROM 

  LatestBackupSet AS lbs

WHERE

  DATEDIFF(DAY,lbs.LastBackedUpOn ,CURRENT_TIMESTAMP) = @LastXDays  

  AND lbs.Rnk = 1

ORDER BY 

  lbs.DBName DESC

GO
To get a list of the Latest successful backups of all Databases
;WITH LatestBackupSet AS (

SELECT 

  b.machine_name,

  b.server_name,

  b.database_name as DBName,

  b.backup_start_date,

  b.backup_finish_date,

  CASE 

    WHEN b.[type] = 'D' THEN 'Database'

    WHEN b.[type] = 'I' THEN 'Differential database'

    WHEN b.[type] = 'L' THEN 'Log'

    WHEN b.[type] = 'F' THEN 'File or filegroup'

    WHEN b.[type] = 'G' THEN 'Differential file'

    WHEN b.[type] = 'P' THEN 'Partial'

    WHEN b.[type] = 'Q' THEN 'Differential partial'

    ELSE b.[type]

  END Backup_Type,

  b.expiration_date,

  b.[user_name],

  DATEDIFF(MINUTE,b.backup_start_date ,b.backup_finish_date) as Total_Time_in_Minute,

  b.recovery_model,

  b.backup_size/(1024 * 1024 * 1024) as Total_Size_GB,

  bf.physical_device_name as Location,

  ROW_NUMBER() OVER(PARTITION BY b.database_name ORDER BY b.backup_start_date DESC) Rnk

FROM 

  msdb.dbo.backupset AS b

INNER JOIN msdb.dbo.backupmediafamily AS bf

  ON b.media_set_id=bf.media_set_id

)

SELECT 

  machine_name,

  server_name,

  DBName,

  backup_start_date,

  backup_finish_date,

  Backup_Type,

  expiration_date,

  [user_name],

  Total_Time_in_Minute,

  recovery_model,

  Total_Size_GB,

  Location

FROM 

  LatestBackupSet AS lbs

WHERE

  lbs.Rnk = 1

ORDER BY 

  lbs.DBName DESC

GO
To get the Latest successful backup of a particular Database
DECLARE @DBName AS VARCHAR(100) = 'Your Database Name'

 

;WITH LatestBackupSet AS (

SELECT 

  b.machine_name,

  b.server_name,

  b.database_name as DBName,

  b.backup_start_date,

  b.backup_finish_date,

  CASE 

    WHEN b.[type] = 'D' THEN 'Database'

    WHEN b.[type] = 'I' THEN 'Differential database'

    WHEN b.[type] = 'L' THEN 'Log'

    WHEN b.[type] = 'F' THEN 'File or filegroup'

    WHEN b.[type] = 'G' THEN 'Differential file'

    WHEN b.[type] = 'P' THEN 'Partial'

    WHEN b.[type] = 'Q' THEN 'Differential partial'

    ELSE b.[type]

  END Backup_Type,

  b.expiration_date,

  b.[user_name],

  DATEDIFF(MINUTE,b.backup_start_date ,b.backup_finish_date) as Total_Time_in_Minute,

  b.recovery_model,

  b.backup_size/(1024 * 1024 * 1024) as Total_Size_GB,

  bf.physical_device_name as Location,

  ROW_NUMBER() OVER(PARTITION BY b.database_name ORDER BY b.backup_start_date DESC) Rnk

FROM 

  msdb.dbo.backupset AS b

INNER JOIN msdb.dbo.backupmediafamily AS bf

  ON b.media_set_id=bf.media_set_id

WHERE

  b.database_name = @DBName  

)

SELECT 

  machine_name,

  server_name,

  DBName,

  backup_start_date,

  backup_finish_date,

  Backup_Type,

  expiration_date,

  [user_name],

  Total_Time_in_Minute,

  recovery_model,

  Total_Size_GB,

  Location

FROM 

  LatestBackupSet AS lbs

WHERE

  lbs.Rnk = 1

ORDER BY 

  lbs.DBName DESC

GO
To get a list of Databases that were backed-up and do not currently exist
SELECT

  DISTINCT b.database_name

FROM

  msdb.dbo.backupset b

WHERE

  DB_ID(b.database_name) IS NULL
Hope, the above given script will be of help to you. Also, I would like to request you to please add any relevant script which you feel would be useful as a comment.

2/28/2011

Cannot resolve the collation conflict


Recently when I was referring to SQL Server Forums I saw a question that reads like:
I get an error  Cannot resolve the collation conflict between "Latin1_General_CI_AI" and "SQL_Latin1_General_CP1_CI_AS" in the equal to operation.
image
What is a Collation?
In simple words Collation is the set of rules that ensure proper use of characters for Language or Alphabet. Here are some recommendation from books online about choosing collation:
    • Select a BINARY2 collation if binary code point based ordering is acceptable.
    • Select a Windows collation for consistent comparison across data types.
    • Use a new 100-level collation for better linguistic sorting support.
    • If you plan to migrate a database to the upgraded instance of SQL Server, select the collation that matches your existing collation of the database.
Solution:
The error that we are referring here shown up because the two databases have different collation for some reason, now, to overcome this issue one may use COLLATE clause, but do remember that COLLATE clause will work with CHAR,VARCHAR,TEXT, NCHAR, NVARCHAR and NTEXT data type.
The Syntax :
SELECT * 
FROM 
SYS.databases SD
JOIN
SOMEDB.DBO.SOMETBL JC    
ON 
SD.database_id  = JC.DBID  COLLATE Latin1_General_CI_AI
Here are some external resource for further reading




http://msdn.microsoft.com/en-us/library/ms143508.aspx>




http://blogs.msdn.com/b/qingsongyao/archive/2008/08/25/sql-server-2008-katmai-s-new-collations.aspx
photo credit: mdanys via photopin cc

3/09/2009

Community launched | Surat SQL Server User Group | DotNetChaps

Hi,

We have formed a Technical Community User Group. The aim of this User Group is to share/exchange what all we have in terms of the knowledge.

We have two separate forums for MS SQL and for Dot Net technology to avoid confusion. You may post all your queries pertaining to MS SQL at http://www.surat-user-group.org and if you are having a query in .Net (be it asp .net, c# or vb .net) please post it to http://tech.groups.yahoo.com/group/DotNetChaps/

http://www.surat-user-group.org is having an association with SQLPASS (http://www.sqlpass.org) and is an official SQLPASS Chapter.

http://tech.groups.yahoo.com/group/DotNetChaps/ is having an association with iNETA.

8/20/2007

5/03/2007

Feature Pack for SQL Server 2005

Have you downloaded stand alone value addition packages for SQL Server 2005 like Best Practice Analyzer,Performance Dashboard etc. ? Here is a link where you can find this all http://www.microsoft.com/downloads/details.aspx?familyid=50b97994-8453-4998-8226-fa42ec403d17&displaylang=en

ELSASOFT giving out SQLSPEC for FREE to MVP

Dear All MVP(s),
SQLSPEC is a software that helps DBA(s) to document Database Objects, It is a tool from
Elsasoft LLC; they are giving out SQLSPEC for free to MVP(s) and significant contributors to SQL Server Community, drop a mail to sqlspec@elsasoft.org, with below information
Your full name
Proof of your contribution to the database community
Proof of your Microsoft MVP, Microsoft MCT, or Oracle ACE status if applicable

There's more detail here: http://www.elsasoft.org/mvp.htm
You may also have a look at Software Spotlight at http://www.sql-server-performance.com/software_spotlights/da_sqlspec.asp

4/24/2007

Logging and Data Storage Algorithms in MS SQL Server

Ever wonder how SQL Server Logs data in T-Log and Data Files? What algorithm it uses!!! What is ARIES (Algorithm for Recovery and Isolation Exploiting Semantics), refer Microsoft Knowledge Base Article http://support.microsoft.com/kb/230785 which gives the complete details how it works!! With the detail explanation on each steps and terms.

3/27/2007

Index Defregment Best Practice

Here is the best article on Index Defregment Best Practice published on Microsoft Web Site

http://www.microsoft.com/technet/prodtechnol/sql/2000/maintain/ss2kidbp.mspx


Hemantgiri S. Goswami

Microsoft SQL Server MVP





Technorati Tags: , , ,



powered by performancing firefox

2/20/2007

Difference between Stored Procedure and Function (UDF)

Functions

  • can be used with Select statement

  • Not returning output parameter but returns Table variables

  • You can join UDF

  • Can not be used to change server configuration

  • Can not be used with XML FOR clause

  • Can not have transaction within function



Stored Procedure

  • have to use EXEC or EXECUTE

  • return output parameter

  • can create table but won’t return Table Variables

  • you can not join SP

  • can be used to change server configuration

  • can be used with XML FOR Clause

  • can have transaction within SP

New Version Microsoft SQL Server 2005 SP2 and Books On Line release

New version of SQL Server 2005 SP2 & SQL Server 2005 Books Online (BOL) released and now available at http://www.microsoft.com/sql/sp2.mspx

2/05/2007

SQL Server : TO Blob or Not

Hi All,

In many community forums i participated i found many users ask a querstion on BLOB datatype. That is "Is it okay if i do store binary files / images / documents store in SQL Server Database?" . The answer is no.....it is always good to store the location of the Binary Files or Documents Or Images and let it handled by Front End application. Here is a wonderfull research paper published on Microsoft Site http://research.microsoft.com/research/pubs/view.aspx?msr_tr_id=MSR-TR-2006-45


Regards
Hemantgiri S. Goswami
Microsoft SQL Server MVP
"Humans don't have Caliber to PASS TIME , Time it self Pass or Fail Humans"

Disclaimer: This postings is provided "AS IS"

New Year Gift from Microsoft

Hi All,
I am honored Microsoft Most Valuable Professional in Windows Server System - SQL Server Competency for year 2007. A wonderfull gift from Microsoft.

Hemantgiri S. Goswami

"Katmai" - Next Version of SQL Server

Hi All,
Microsoft officials has announced in their blog at ZDNET website, They code name it "Katmai" that would be next version of Microsoft SQL Server and that's not just a SQL Server but more then that. Read more on it http://blogs.zdnet.com/microsoft/?p=217

Regards
Hemantgiri S. Goswami
Microsoft SQL Server MVP
"Humans don't have Caliber to PASS TIME , Time it self Pass or Fail Humans"

Disclaimer: This postings is provided "AS IS"

11/23/2006

Change Authentication Mode with Registry

Hi,
What if we need to change / read / write some registry entry in Server but we donot have access to server!!!! but at the same time we do have SA/Admin privilege on SQL Server (Assuming we need to change registry settings on SQL Server itself ) for example while setting up SQL Server they have installed SQL Server with *Mixed Authentication Mode* and now we need to change it to *Windows Only Authentication Mode* to do so from Query Analyzer we do have xTended Store Procedure to help us they are xp_regread and xp_regwrite
For an instance assume that your Authentication Mode is set to *Mixed Authentication Mode* to read it run below query in QA if it shows ‘0’ or '2' means that authentication mode is Mixed

EXECUTE master..xp_regread
'HKEY_LOCAL_MACHINE', 'SOFTWARE\Microsoft\MSSQLServer\MSSQLServer',
'LoginMode'

Now if we wants to change it to *Windows Only* run below query in QA

declare @md int

set @md=1

EXECUTE master..xp_regwrite

'HKEY_LOCAL_MACHINE',

'SOFTWARE\Microsoft\MSSQLServer\MSSQLServer',

'LoginMode', 'reg_dword', @md

This will make changes in your Registry and change your *Authentication Mode* also.

Disclaimer : In the example above both the xTended Stored Procedure used are Undocumented so use it at your own risk and please check for its availability / support before using it.


This posting is provided * AS IS * for the shake of knowledge sharing only.

7/06/2006

MS Released SQL 2005 Everywhere Edition CTP

SQL Server Everywhere Microsoft SQL Server 2005 Everywhere Edition CTP available :
http://www.microsoft.com/downloads/details.aspx?FamilyID=85E0C3CE-3FA1-453A-8CE9-AF6CA20946C3&displaylang=en

7/05/2006

Securing Microsoft SQL Server

Hi,
their are several ways to secure your SQL Server
1). Strengthen Password Mechanism
2). Using NTFS File System
3). Change the Port of SQL Server other than default
4). Use named instance
5). Set firewall
6). Using Windows Authentication
7). Using EFS

i would suggest to refer below links for more :
http://vyaskn.tripod.com/sql_server_security_best_practices.htm

www.microsoft.com/technet/prodtechnol/sql/2000/maintain/sqlc2.mspx -- C2 Audit

http://www.sql-server-performance.com/ck_database_encryption.asp

http://www.sqlservercentral.com/columnists/bkelley/implementing_efs.asp

http://www.microsoft.com/sql/prodinfo/previousversions/securingsqlserver.mspx

Regards

7/01/2006

Upgrade help to SQL Server 2005

Hi,
here is a reference article for those who wants to upgrade to SQL Server 2005
http://www.microsoft.com/technet/prodtechnol/sql/themes/default.mspx