Quantcast
Channel: SQL Server Information
Viewing all 36 articles
Browse latest View live

How to audit user activities from Transaction Log File

0
0

There are scenarios where you may want to find out which user deleted the data or created a table etc .. 

 Use below statement in the database whose transaction log file is to be audited

DBCC LOG (<DBID\DBNAME>, 3)

Replace DBID with the ID of database whose transaction log file is to be analyzed.

This may generate huge output if the transaction log file size is big

You may get lucky if the transaction log is not truncated 

Next, in the output from above query you can look for TRANSACTION SID or DESCRIPTION column for point in time LSN having LOP_BEGIN_XACT statement.

Those column usually contain the SID value for the user who made the change & can be mapped in SID column in SYSUSERS table of that database to which the log file belongs.

Also check the TRANSACTION NAME column which may contain type of operation done, as a matter of fact the DESCRIPTION column usually contains operation & SID details. For e.g.

CREATE TABLE;0x0105000000000005150000005d28f57fd53ad8354354e02a00d40400


The SQL Server FullTextSearch (MSSQLSERVER) service depends the following service: NTLMSSP. This service might not be installed.

0
0

SQL Server 2005 FullText Search on Windows 2008 [Longhorn] Cluster fails to come online. Below is the error noticed in System event log

Generic application 'SQL Server Fulltext' could not be brought online (with error '1075') during an attempt to start the service. Possible cause: the specified service parameters might be invalid.

The SQL Server FullTextSearch (MSSQLSERVER) service depends the following service: NTLMSSP. This service might not be installed.

 

Resolution 1

==============

Locate the below registry entry on the nodes where FTS is not coming online

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msftesql\DependOnService

Remove "NTLMSSP" & restart OS               (You may want to follow KB 322756 [How to back up and restore the registry in Windows]         before you make the registry changes)

 

Resolution 2

==============

Refer to KB 936302 & check problem 3 stated in there

Install SQL Server 2005 SP2 to fix this issue

SQL Server 2000 or SP4 installation or bringing SQL resource online after install/ upgrade fails with "The specified service does not exist as an installed service"

0
0

After installing SQL Server on a cluster or upgrading it to Sevice Pack 4, if you reboot the nodes then you get below message or try to bring the SQL Server resource online from cluster administrator, then it fails with below error

"The specified service does not exist as an installed service"

You might observe that the setup did not fail at all. But in the setup logs you will find that the SQL setup or service pack had copied the binaries successfully but it had failed in creating the services.

Setup succeeds as this is a non-fatal error.

 

Resolution

============

  •  You may register the service by using the command from setup logs itself, for example

scm.exe -Silent 1 -Action 5 -ExePath "C:\Program Files\Microsoft SQL Server\MSSQL\binn\sqlservr.exe" -Service "MSSQLSERVER"

scm.exe -Silent 1 -Action 7 -Service MSSQLSERVER -SvcStartType 1 -SvcAccount "CCC\BT_ATLSQ02" -SvcEPwd

scm.exe -Silent 1 -Action 5 -Service "SQLSERVERAGENT" -Dependencies MSSQLSERVER -ExePath "C:\Program Files\Microsoft SQL Server\MSSQL\binn\sqlagent.exe" -SvcAccount "CCC\BT_ATLSQ02" -SvcEPwd

  •  If the service registration failes with error that the service name is already under use then please remove the entry for the service from the registry location "HKLM\SYSTEM\CurrentControlSet\Services" & reboot the node
  • For more options with Service Control Manager SCM.exe or SC.exe, execute it from Start->Run or from command prompt

Replication agents may fail with error "Server '(servername)' is not registered at server '(servername)'."

0
0

Symptoms

One or more replication agents are failing with below error in verbose log

<verbose log>

OLE DB distributor 'SQLGUYDISTRIB': execute sp_server_info 18

ANSI codepage: 1

OLE DB Distributor 'SQLGUYDISTRIB': select datasource, srvid from master..sysservers where upper(srvname) = upper(N'SQLGUYPUB')

Agent message code 20053. Server 'SQLGUYPUB' is not registered at server 'SQLGUYDISTRIB'.

Repl Agent Status: 6

ErrorId = 4, SourceTypeId = 2

ErrorCode = '20053'

ErrorText = 'Server 'SQLGUYPUB' is not registered at server 'SQLGUYDISTRIB'.'

Adding alert to msdb..sysreplicationalerts: ErrorId = 4,

Transaction SeqNo =,  Command Id = -1

Message: Replication-Replication Distribution Subsystem: agent (null) failed. Server 'SQLGUYPUB' is not registered at server 'SQLGUYDISTRIB'. Disconnecting from OLE DB Subscriber 'SQLGUYSUB'

</verbose log>

Cause

On Distributor server, the permission on publisher linked server to establish connection is set to "Not be made"

Resolution

On distributor server, the proxy account of replication agent's job should have access to linked server created for publisher. Make sure that when you connect to distributor server using credentials of replication agent's job proxy account, you should be able to see publisher server in sysservers table or in linked servers folder in object explorer.

Set the publisher linked server security to "Be made using the login's current security context"

Error: 17207, Severity: 16, State: 1. STREAMFCB::Startup: Operating system error 0xc01c0012(failed to retrieve text for this error. Reason: 317) occurred while creating or opening file '(file path)'.

0
0

Symptoms

A SQL Server 2008 database having filestream enabled is in either recovery or being restored fails with below error

Error: 17207, Severity: 16, State: 1

STREAMFCB::Startup: Operating system error 0xc01c0012(failed to retrieve text for this error. Reason: 317) occurred while creating or opening file 'i:\FileStream\OpsFileStream'. Diagnose and correct the operating system error, and retry the operation.

Error: 17204, Severity: 16, State: 1

FCB::Startup () failed: Could not open file i:\FileStream\OpsFileStream for file number 65537. OS error: 0xc01c0012(failed to retrieve text for this error. Reason 317).

Error: 5105, Severity: 16, State: 14.

A file activation error occurred. The physical file name 'i:\FileStream\OpsFileStream' may be incorrect. Diagnose and correct additional errors, and retry the operation.

The issue most likely will happen after SQL Server is restarted or it terminated abnormally.

Resolution

Immediate resolution so far is to reboot the machine.

Windows Sync Manager shows error message "Microsoft SQL Server could not save the security changes" when specifying user/password for publisher/distributor

0
0

Symptoms

In pull subscriptions, when you use Windows Synchronization Manager to synchronize, it will ask for security information to connect to publisher and distributor. As soon as you click ON on the dialog box, it would show error message

 

Microsoft SQL Server could not save the security changes

 

Cause

Current logged on user does not have adequate permissions over registry entries

 

Resolution

 Collect Process Monitor Logs and you will see ACCESS DENIED for couple of registry keys including the ones belonging to SQL Server. In a specific scenario they were

 Operation Path Result Detail
 RegCreateKey HKLM\Software\Microsoft\Microsoft SQL Server\MSSQL10.MSSQLSERVER\Replication\Subscriptions\<Subscription> ACCESS DENIEDDesired Access: Write 
 RegCreateKey HKLM\Software\Microsoft\Microsoft SQL Server\MSSQL10.MSSQLSERVER\Replication\Subscription\<Subscription>ACCESS DENIED Desired Access: Write
 RegCreateKey HKLM\SOFTWARE\Description ACCESS DENIED Desired Access: Maximum Allowed
 RegOpenKey HKLM\Software\Microsoft\MSSQLServer\Client\SNI10.0 ACCESS DENIEDDesired Access: Write
 RegOpenKey HKLM\System\CurrentControlSet\Services\WinSock2\Parameters ACCESS DENIED Desired Access: All Access
 RegOpenKeyHKLM\System\CurrentControlSet\Services\WinSock2\ParametersACCESS DENIEDDesired Access: All Access

 

Ensure that the current logged on account has adequate permissions over these registry keys (or whichever they turn out to be in ProcMon Logs.)

A value for the parameter @host_name was specified, but no articles in the publication use SUSER_SNAME() for parameterized filtering.

0
0

When adding data partitions in merge publication sometimes below error is encountered


 


Cannot add a partition with SUSER_SNAME


A value for the parameter @host_name was specified, but no articles in the publication use SUSER_SNAME() for parameterized filtering.


 


 Check if there are invisible special characters line new line feed, tab etc. & remove them


 

Replication over firewall

0
0

Most of the times you would run into scenario where you have a firewall between publisher/ distributor & subscriber


 


                                     |


                                     |  F


                                     |  I


PUBLISHER                     |  R  


                                     |  E                                       SUBSCRIBER


                                     |  W


DISTRIBUTOR                 |  A


                                     |   L


                                     |   L


                                     |


 


 


Most people usually only allow traffic through one TCP/IP port on which the respective SQL instance is listening & in most of the cases even SQL Browser service is stopped & Named Pipe protocol is disabled.


 


But if the subscriber is a named instance listening on either static or dynamic port then you can only connect to it using either an alias or specfying the port number along with SERVER\INSTANCE NAME.


 


In such scenario if you try to create a subscription & specify     SERVER\INSTANCE NAME, <PORT>     for the sbscriber server either in the New Subscription wizard or in T-SQL then it failes with below error for example


 


SQL Server replication requires the actual server name to make a connection to the server. Connections through a server alias, IP address, or any other alternate name are not supported. Specify the actual server name, ‘HIMALAYA\KILLER’. (Replication.Utilities)


 


You will not be able to create subscription because the doesn’t allow server with port or ip address alone or with port. However, there is a special case with aliases. Though the above error message tells you not to use aliases but as long as the alias name is same as the subscriber server name & you have specified correct port number in the alias the subscription will be created & replication will successfully work. Create a TCP/IP alias on publisher server with same name as susbcriber server\ instance with correct port.


 


Make sure that when you run select @@servername on subscriber it returns you the correct server name


 


 


NOTE


=====


Alias names can be case sensitive, make sure to use the same case while specifying alias in SQL Server Management Studio or any replication wizard


How to see commands with Command IDs in SQL Server 2000

0
0


Below query will help in seeing the command along with command_id. This is helpful in cases where you want to skip a corrupt command in SQL Server 2000 Transactional Replication


 


use distribution


select


publisher_database_id,


xact_seqno, type,


article_id,


originator_id,


command_id,


partial_command,


cast(command as nvarchar(4000))


from


msrepl_commands

How to manually install SQL SP4 scripts when only the binaries have been upgraded

0
0


There are times when we see that while installing Service Pack 4 for SQL Server 2000 on standalone or clustered instance, the binaries have been upgraded but somehow SP4 failed to apply the T-SQL upgrade scripts. You can apply below steps to install SQL Server 2000 SP4 scripts on your instance.


 



  • After the point that the binaries are upgraded on the cluster nodes or the standalone server, you must run the SQL SP4 scripts

  • Close all applications that are accessing SQL Server, including SQL Enterprise Manager

  • Take the SQL Server offline if on a cluster or stop the SQL Service if standalone

  • Make sure from the services panel that the SQL Service is stopped

  • From command prompt goto path                   \Program Files\Microsoft SQL Server\MSSQL\Binn

  • Use proper path to reach in Named Instance folders

  • Start SQL Server in Single User Mode from command prompt through command sqlservr -T4022 -T4010 -m

  • Check proper command in SQL 2000 BOL if this is named instance, above syntax is for default instance

  • Open the SQL Query Analyzer & connect to the Master database

  • Run below scripts in Master database in exact sequence as they appear below, taking them from the Install folder of SP4 setup directory




      1. sp1_serv_uni.sql

      2. 80sp1-tools.sql

      3. sp2_serv_uni.sql

      4. 80sp2-tools.sql

      5. sp3_serv_uni.sql

      6. 80sp3-tools.sql

      7. replsys.sql

      8. replcom.sql

      9. repltran.sql

      10. replmerg.sql

      11. remove_old_msx_accounts.sql

      12. sp4_serv_uni.sql

      13. 80sp4-tools.sql

 



  • At this point you would have installed all the script that SP4 setup applies

  • Close the SQL Query Analyzer

  • At the command prompt press [ctrl+c] keys to shutdown the SQL Server

  • Again make sure from the Service panel that the SQL Server Service is stopped

  • Start the SQL Server again from command prompt sqlservr -T4022 -T4010

  • Open the SQL Query Analyzer & connect to the Master database

  • Run the below stored procedure in Master database [provide the previous build of SQL Server, the below example considers SP3 Build 760]

  • EXEC sp_vupgrade_replication @security_mode=1,@ver_old=760

  • Close SQL Query Analyzer

  • At the command prompt press [ctrl+c] keys to shutdown the SQL Server

  • Reboot the server or the nodes if this is cluster

How to audit user activities from Transaction Log File

0
0

There are scenarios where you may want to find out which user deleted the data or created a table etc .. 


 Use below statement in the database whose transaction log file is to be audited



DBCC LOG (<DBID\DBNAME>, 3)


Replace DBID with the ID of database whose transaction log file is to be analyzed.


This may generate huge output if the transaction log file size is big


You may get lucky if the transaction log is not truncated 


Next, in the output from above query you can look for TRANSACTION SID or DESCRIPTION column for point in time LSN having LOP_BEGIN_XACT statement.


Those column usually contain the SID value for the user who made the change & can be mapped in SID column in SYSUSERS table of that database to which the log file belongs.


Also check the TRANSACTION NAME column which may contain type of operation done, as a matter of fact the DESCRIPTION column usually contains operation & SID details. For e.g.



CREATE TABLE;0x0105000000000005150000005d28f57fd53ad8354354e02a00d40400

The SQL Server FullTextSearch (MSSQLSERVER) service depends the following service: NTLMSSP. This service might not be installed.

0
0

SQL Server 2005 FullText Search on Windows 2008 [Longhorn] Cluster fails to come online. Below is the error noticed in System event log



Generic application ‘SQL Server Fulltext’ could not be brought online (with error ‘1075’) during an attempt to start the service. Possible cause: the specified service parameters might be invalid.


The SQL Server FullTextSearch (MSSQLSERVER) service depends the following service: NTLMSSP. This service might not be installed.


 


Resolution 1


==============


Locate the below registry entry on the nodes where FTS is not coming online


HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msftesql\DependOnService


Remove “NTLMSSP” & restart OS               (You may want to follow KB 322756 [How to back up and restore the registry in Windows]         before you make the registry changes)


 


Resolution 2


==============


Refer to KB 936302 & check problem 3 stated in there


Install SQL Server 2005 SP2 to fix this issue

SQL Server 2000 or SP4 installation or bringing SQL resource online after install/ upgrade fails with "The specified service does not exist as an installed service"

0
0

After installing SQL Server on a cluster or upgrading it to Sevice Pack 4, if you reboot the nodes then you get below message or try to bring the SQL Server resource online from cluster administrator, then it fails with below error



“The specified service does not exist as an installed service”


You might observe that the setup did not fail at all. But in the setup logs you will find that the SQL setup or service pack had copied the binaries successfully but it had failed in creating the services.


Setup succeeds as this is a non-fatal error.


 


Resolution


============



  •  You may register the service by using the command from setup logs itself, for example


scm.exe -Silent 1 -Action 5 -ExePath “C:\Program Files\Microsoft SQL Server\MSSQL\binn\sqlservr.exe” -Service “MSSQLSERVER”


scm.exe -Silent 1 -Action 7 -Service MSSQLSERVER -SvcStartType 1 -SvcAccount “CCC\BT_ATLSQ02” -SvcEPwd


scm.exe -Silent 1 -Action 5 -Service “SQLSERVERAGENT” -Dependencies MSSQLSERVER -ExePath “C:\Program Files\Microsoft SQL Server\MSSQL\binn\sqlagent.exe” -SvcAccount “CCC\BT_ATLSQ02” -SvcEPwd



  •  If the service registration failes with error that the service name is already under use then please remove the entry for the service from the registry location “HKLM\SYSTEM\CurrentControlSet\Services” & reboot the node

  • For more options with Service Control Manager SCM.exe or SC.exe, execute it from Start->Run or from command prompt

Replication agents may fail with error "Server ‘(servername)’ is not registered at server ‘(servername)’."

0
0

Symptoms



One or more replication agents are failing with below error in verbose log


<verbose log>


OLE DB distributor ‘SQLGUYDISTRIB’: execute sp_server_info 18


ANSI codepage: 1


OLE DB Distributor ‘SQLGUYDISTRIB’: select datasource, srvid from master..sysservers where upper(srvname) = upper(N’SQLGUYPUB’)


Agent message code 20053. Server ‘SQLGUYPUB’ is not registered at server ‘SQLGUYDISTRIB’.


Repl Agent Status: 6


ErrorId = 4, SourceTypeId = 2


ErrorCode = ‘20053’


ErrorText = ‘Server ‘SQLGUYPUB’ is not registered at server ‘SQLGUYDISTRIB’.’


Adding alert to msdb..sysreplicationalerts: ErrorId = 4,


Transaction SeqNo =,  Command Id = -1


Message: Replication-Replication Distribution Subsystem: agent (null) failed. Server ‘SQLGUYPUB’ is not registered at server ‘SQLGUYDISTRIB’. Disconnecting from OLE DB Subscriber ‘SQLGUYSUB’


</verbose log>


Cause


On Distributor server, the permission on publisher linked server to establish connection is set to “Not be made”

Resolution



On distributor server, the proxy account of replication agent’s job should have access to linked server created for publisher. Make sure that when you connect to distributor server using credentials of replication agent’s job proxy account, you should be able to see publisher server in sysservers table or in linked servers folder in object explorer.


Set the publisher linked server security to “Be made using the login’s current security context”

Error: 17207, Severity: 16, State: 1. STREAMFCB::Startup: Operating system error 0xc01c0012(failed to retrieve text for this error. Reason: 317) occurred while creating or opening file ‘(file path)’.

0
0

Symptoms



A SQL Server 2008 database having filestream enabled is in either recovery or being restored fails with below error


Error: 17207, Severity: 16, State: 1


STREAMFCB::Startup: Operating system error 0xc01c0012(failed to retrieve text for this error. Reason: 317) occurred while creating or opening file ‘i:\FileStream\OpsFileStream’. Diagnose and correct the operating system error, and retry the operation.


Error: 17204, Severity: 16, State: 1


FCB::Startup () failed: Could not open file i:\FileStream\OpsFileStream for file number 65537. OS error: 0xc01c0012(failed to retrieve text for this error. Reason 317).


Error: 5105, Severity: 16, State: 14.


A file activation error occurred. The physical file name ‘i:\FileStream\OpsFileStream’ may be incorrect. Diagnose and correct additional errors, and retry the operation.


The issue most likely will happen after SQL Server is restarted or it terminated abnormally.


Resolution


Immediate resolution so far is to reboot the machine.

Windows Sync Manager shows error message "Microsoft SQL Server could not save the security changes" when specifying user/password for publisher/distributor

0
0

Symptoms



In pull subscriptions, when you use Windows Synchronization Manager to synchronize, it will ask for security information to connect to publisher and distributor. As soon as you click ON on the dialog box, it would show error message


 


Microsoft SQL Server could not save the security changes


 


Cause


Current logged on user does not have adequate permissions over registry entries


 


Resolution



 Collect Process Monitor Logs and you will see ACCESS DENIED for couple of registry keys including the ones belonging to SQL Server. In a specific scenario they were







































 Operation  Path  Result  Detail
 RegCreateKey  HKLM\Software\Microsoft\Microsoft SQL Server\MSSQL10.MSSQLSERVER\Replication\Subscriptions\<Subscription>  ACCESS DENIED Desired Access: Write 
 RegCreateKey  HKLM\Software\Microsoft\Microsoft SQL Server\MSSQL10.MSSQLSERVER\Replication\Subscription\<Subscription> ACCESS DENIED  Desired Access: Write
 RegCreateKey  HKLM\SOFTWARE\Description  ACCESS DENIED  Desired Access: Maximum Allowed
 RegOpenKey  HKLM\Software\Microsoft\MSSQLServer\Client\SNI10.0  ACCESS DENIED Desired Access: Write
 RegOpenKey  HKLM\System\CurrentControlSet\Services\WinSock2\Parameters  ACCESS DENIED  Desired Access: All Access
 RegOpenKey HKLM\System\CurrentControlSet\Services\WinSock2\Parameters ACCESS DENIED Desired Access: All Access


 


Ensure that the current logged on account has adequate permissions over these registry keys (or whichever they turn out to be in ProcMon Logs.)

Viewing all 36 articles
Browse latest View live




Latest Images