Cannot stop an Extended Event session on server
I have two extended events sessions running on a server. I do have sql jobs that automatically stop the XE sessions and import the results to working tables. I see two "ALTER EVENT SESSION XXXX ON SERVER STATE = STOP" statements that are being
executed for more than 2 days, the wait types are XE_SERVICES_MUTEX and PREEMPTIVE_XE_SESSIONCOMMIT. This is not the first time I see this behavior.
Are you aware of any bug related to this? I do not want to kill the sessions (I guess the sessions won't die anyway) neither restart the sql service
Any suggestions?
Thanks
Javier
Javier Villegas
I've emailed the PM for Extended Events to ask about this. It appears from the connect item that it is still a problem.
http://connect.microsoft.com/SQLServer/feedback/details/383878/extended-event-session-hangs
In the past the session would eventually go away in most cases, but there have been times where it gets stuck and you have to bounce the instance to clear the issue. I'll let you know when I hear more back from the PM.
Jonathan Kehayias | Principal Consultant,
SQLSkills.com
SQL Server MVP | Microsoft Certified Master: SQL Server 2008
Author of Troubleshooting SQL Server: A Guide for Accidental DBAs
Feel free to contact me through
My Blog or
Twitter. Become a
SQLskills Insider!
Please click the Mark as Answer button if a post solves your problem!
Similar Messages
-
Filtering extended event in sql server 2008 r2
This code has been generated in sql server 2012 (using the graphical interface).
CREATE EVENT SESSION [backupsmssql] ON SERVER
ADD EVENT sqlserver.sp_statement_starting(
ACTION(
sqlserver.client_app_name,
sqlserver.client_hostname,sqlserver.nt_username,
sqlserver.session_nt_username,sqlserver.sql_text,
sqlserver.username)
WHERE ([sqlserver].[like_i_sql_unicode_string]([sqlserver].[sql_text],N'%backup database%'))
WITH (MAX_MEMORY=4096 KB,EVENT_RETENTION_MODE=ALLOW_SINGLE_EVENT_LOSS,MAX_DISPATCH_LATENCY=30 SECONDS,MAX_EVENT_SIZE=0 KB,MEMORY_PARTITION_MODE=NONE,TRACK_CAUSALITY=OFF,STARTUP_STATE=OFF)
If I try to run it on sql server 2008 r2, the filtering part seems to be misinterpreted and the following error is thrown:
Msg 25706, Level 16, State 8, Line 1
The event attribute or predicate source, "sqlserver.sql_text", could not be found.
If I remove the where clause, the statement runs fine even though the sqlserver.sql_text is returned as part of the actions. So obviously the "sqlserver.sql_text" is existant. Why would I receive a message it does not exists in the
where clause? Was the "like_i_sql_unicode_string" inexistent in 2008 r2 or has the syntax changed in 2012. How can we filter sql_text in 2008 r2? I can't seem to find any doc regarding this, help would be appreciated.
p.s. There is a very similar question here but it has been closed by the moderators and does not answer the question:
https://social.msdn.microsoft.com/Forums/sqlserver/en-US/76c2719c-ea02-4449-b59e-465a24c37ba8/question-on-sql-server-extended-event?forum=sqlsecurityYou are on the right track:
The differences in the available events and predicates (source and compare) between SQL Server 2008/R2 and 2012 are quite substantial.
So the LIKE-operator is not available at all under 2008/R2 as a comparison-predicate, and sql_text is also not available as a source-predicate - only as action itself. - One has to realize, that actions really are not automatically also predicates.
For a complete list of predicates you can query like this:
SELECT dm_xe_packages.name AS package_name,
dm_xe_objects.name AS source_name,
dm_xe_objects.description
, dm_xe_objects.object_type
FROM sys.dm_xe_objects AS dm_xe_objects
INNER JOIN sys.dm_xe_packages AS dm_xe_packages
ON dm_xe_objects.package_guid = dm_xe_packages.guid
WHERE
(dm_xe_packages.capabilities IS NULL OR dm_xe_packages.capabilities & 1 = 0)
AND (dm_xe_objects.capabilities IS NULL OR dm_xe_objects.capabilities & 1 = 0)
AND dm_xe_objects.object_type
IN ( 'pred_source', 'pred_compare')
ORDER BY dm_xe_objects.object_type
Unfortunately for your specific filter there is not workaround for Extended Events.
You would have to resort to another predicate for filtering altogether.
BUT: if you are on Enterprise Edition, why not use Auditing. There is a Audit-Group for Backup/Restore.
It would be really simple like the following:
CREATE SERVER AUDIT SPECIFICATION [Audit_BackupRestores]
FOR SERVER AUDIT [AuditTarget]
ADD (BACKUP_RESTORE_GROUP)
If you are on Standard, you found yet another reason to upgrade to a supported version of SQL Server, I am afraid to say..
Andreas Wolter (Blog |
Twitter)
MCSM: Microsoft Certified Solutions Master Data Platform, MCM, MVP
www.SarpedonQualityLab.com |
www.SQL-Server-Master-Class.com -
How to enable an existing Extended Events Session or add a new Session?
Hi,
I am using Management Studio version 12.0.2000.8 and I have noticed that Extended Events for Azure SQL DB have been added to it.
However, I can't add a new session because the option is grayed out in the dropdown menu. Also, the existing sessions return an error when I attempt to start them. Here is one example of starting
azure_xe_query session:
Failed to start event session 'azure_xe_query' because required credential for writing session output to Azure blob is missing. (Microsoft SQL Server, Error: 25739)
I have an automated export assigned to my Azure database, so the database must be using a (blob) storage account. Is this the same storage account which Extended Events are trying to reach? So far, my best guess is that the storage key should be provided
while starting the session. This, obviously can't be done using the GUI.
The only thing I managed to google about this topic is
this blogpost from May.
Has anybody else tried to profile their Azure DB using Extended Events? Is this feature still in development?
Thank you,
FilipHi Bob, thank you for replying.
You mentioned 12 pre-configured event sessions. May I ask, which version of Management Studio were you using? For some reason, I only see 5 of them:
azure_xe_errors_warnings
azure_xe_object_ddl
azure_xe_query
azure_xe_query_detail
azure_xe_waits
And each fires an error just like the one in the first post. At the moment, viewing live data from 'xe_query' session would be enough for me. If I could only start it somehow ...
I should probably mention I have tried to do this on a Basic and a Standard service tier. Not yet with a Premium.
Since there is probably nothing we can do at the moment, I'm going to mark your reply as an answer. Thnx again. -
Team , Thanks for looking into this ..
As a last resort on optimizing my stored procedure ( Below ) i wanted to create a Selective XML index ( Normal XML indexes doesn't seem to be improving performance as needed ) but i keep getting this error within my stored proc . Selective XML
Index feature is not supported for the current database version.. How ever
EXECUTE sys.sp_db_selective_xml_index; return 1 , stating Selective XML Indexes are enabled on my current database .
Is there ANY alternative way i can optimize below stored proc ?
Thanks in advance for your response(s) !
/****** Object: StoredProcedure [dbo].[MN_Process_DDLSchema_Changes] Script Date: 3/11/2015 3:10:42 PM ******/
SET ANSI_NULLS ON
GO
SET QUOTED_IDENTIFIER ON
GO
-- EXEC [dbo].[MN_Process_DDLSchema_Changes]
ALTER PROCEDURE [dbo].[MN_Process_DDLSchema_Changes]
AS
BEGIN
SET NOCOUNT ON --Does'nt have impact ( May be this wont on SQL Server Extended events session's being created on Server(s) , DB's )
SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED
select getdate() as getdate_0
DECLARE @XML XML , @Prev_Insertion_time DATETIME
-- Staging Previous Load time for filtering purpose ( Performance optimize while on insert )
SET @Prev_Insertion_time = (SELECT MAX(EE_Time_Stamp) FROM dbo.MN_DDLSchema_Changes_log ) -- Perf Optimize
-- PRINT '1'
CREATE TABLE #Temp
EventName VARCHAR(100),
Time_Stamp_EE DATETIME,
ObjectName VARCHAR(100),
ObjectType VARCHAR(100),
DbName VARCHAR(100),
ddl_Phase VARCHAR(50),
ClientAppName VARCHAR(2000),
ClientHostName VARCHAR(100),
server_instance_name VARCHAR(100),
ServerPrincipalName VARCHAR(100),
nt_username varchar(100),
SqlText NVARCHAR(MAX)
CREATE TABLE #XML_Hold
ID INT NOT NULL IDENTITY(1,1) PRIMARY KEY , -- PK necessity for Indexing on XML Col
BufferXml XML
select getdate() as getdate_01
INSERT INTO #XML_Hold (BufferXml)
SELECT
CAST(target_data AS XML) AS BufferXml -- Buffer Storage from SQL Extended Event(s) , Looks like there is a limitation with xml size ?? Need to re-search .
FROM sys.dm_xe_session_targets xet
INNER JOIN sys.dm_xe_sessions xes
ON xes.address = xet.event_session_address
WHERE xes.name = 'Capture DDL Schema Changes' --Ryelugu : 03/05/2015 Session being created withing SQL Server Extended Events
--RETURN
--SELECT * FROM #XML_Hold
select getdate() as getdate_1
-- 03/10/2015 RYelugu : Error while creating XML Index : Selective XML Index feature is not supported for the current database version
CREATE SELECTIVE XML INDEX SXI_TimeStamp ON #XML_Hold(BufferXml)
FOR
PathTimeStamp ='/RingBufferTarget/event/timestamp' AS XQUERY 'node()'
--RETURN
--CREATE PRIMARY XML INDEX [IX_XML_Hold] ON #XML_Hold(BufferXml) -- Ryelugu 03/09/2015 - Primary Index
--SELECT GETDATE() AS GETDATE_2
-- RYelugu 03/10/2015 -Creating secondary XML index doesnt make significant improvement at Query Optimizer , Instead creation takes more time , Only primary should be good here
--CREATE XML INDEX [IX_XML_Hold_values] ON #XML_Hold(BufferXml) -- Ryelugu 03/09/2015 - Primary Index , --There should exists a Primary for a secondary creation
--USING XML INDEX [IX_XML_Hold]
---- FOR VALUE
-- --FOR PROPERTY
-- FOR PATH
--SELECT GETDATE() AS GETDATE_3
--PRINT '2'
-- RETURN
SELECT GETDATE() GETDATE_3
INSERT INTO #Temp
EventName ,
Time_Stamp_EE ,
ObjectName ,
ObjectType,
DbName ,
ddl_Phase ,
ClientAppName ,
ClientHostName,
server_instance_name,
nt_username,
ServerPrincipalName ,
SqlText
SELECT
p.q.value('@name[1]','varchar(100)') AS eventname,
p.q.value('@timestamp[1]','datetime') AS timestampvalue,
p.q.value('(./data[@name="object_name"]/value)[1]','varchar(100)') AS objectname,
p.q.value('(./data[@name="object_type"]/text)[1]','varchar(100)') AS ObjectType,
p.q.value('(./action[@name="database_name"]/value)[1]','varchar(100)') AS databasename,
p.q.value('(./data[@name="ddl_phase"]/text)[1]','varchar(100)') AS ddl_phase,
p.q.value('(./action[@name="client_app_name"]/value)[1]','varchar(100)') AS clientappname,
p.q.value('(./action[@name="client_hostname"]/value)[1]','varchar(100)') AS clienthostname,
p.q.value('(./action[@name="server_instance_name"]/value)[1]','varchar(100)') AS server_instance_name,
p.q.value('(./action[@name="nt_username"]/value)[1]','varchar(100)') AS nt_username,
p.q.value('(./action[@name="server_principal_name"]/value)[1]','varchar(100)') AS serverprincipalname,
p.q.value('(./action[@name="sql_text"]/value)[1]','Nvarchar(max)') AS sqltext
FROM #XML_Hold
CROSS APPLY BufferXml.nodes('/RingBufferTarget/event')p(q)
WHERE -- Ryelugu 03/05/2015 - Perf Optimize - Filtering the Buffered XML so as not to lookup at previoulsy loaded records into stage table
p.q.value('@timestamp[1]','datetime') >= ISNULL(@Prev_Insertion_time ,p.q.value('@timestamp[1]','datetime'))
AND p.q.value('(./data[@name="ddl_phase"]/text)[1]','varchar(100)') ='Commit' --Ryelugu 03/06/2015 - Every Event records a begin version and a commit version into Buffer ( XML ) we need the committed version
AND p.q.value('(./data[@name="object_type"]/text)[1]','varchar(100)') <> 'STATISTICS' --Ryelugu 03/06/2015 - May be SQL Server Internally Creates Statistics for #Temp tables , we do not want Creation of STATISTICS Statement to be logged
AND p.q.value('(./data[@name="object_name"]/value)[1]','varchar(100)') NOT LIKE '%#%' -- Any stored proc which creates a temp table within it Extended Event does capture this creation statement SQL as well , we dont need it though
AND p.q.value('(./action[@name="client_app_name"]/value)[1]','varchar(100)') <> 'Replication Monitor' --Ryelugu : 03/09/2015 We do not want any records being caprutred by Replication Monitor ??
SELECT GETDATE() GETDATE_4
-- SELECT * FROM #TEMP
-- SELECT COUNT(*) FROM #TEMP
-- SELECT GETDATE()
-- RETURN
-- PRINT '3'
--RETURN
INSERT INTO [dbo].[MN_DDLSchema_Changes_log]
[UserName]
,[DbName]
,[ObjectName]
,[client_app_name]
,[ClientHostName]
,[ServerName]
,[SQL_TEXT]
,[EE_Time_Stamp]
,[Event_Name]
SELECT
CASE WHEN T.nt_username IS NULL OR LEN(T.nt_username) = 0 THEN t.ServerPrincipalName
ELSE T.nt_username
END
,T.DbName
,T.objectname
,T.clientappname
,t.ClientHostName
,T.server_instance_name
,T.sqltext
,T.Time_Stamp_EE
,T.eventname
FROM
#TEMP T
/** -- RYelugu 03/06/2015 - Filters are now being applied directly while retrieving records from BUFFER or on XML
-- Ryelugu 03/15/2015 - More filters are likely to be added on further testing
WHERE ddl_Phase ='Commit'
AND ObjectType <> 'STATISTICS' --Ryelugu 03/06/2015 - May be SQL Server Internally Creates Statistics for #Temp tables , we do not want Creation of STATISTICS Statement to be logged
AND ObjectName NOT LIKE '%#%' -- Any stored proc which creates a temp table within it Extended Event does capture this creation statement SQL as well , we dont need it though
AND T.Time_Stamp_EE >= @Prev_Insertion_time --Ryelugu 03/05/2015 - Performance Optimize
AND NOT EXISTS ( SELECT 1 FROM [dbo].[MN_DDLSchema_Changes_log] MN
WHERE MN.[ServerName] = T.server_instance_name -- Ryelugu Server Name needes to be added on to to xml ( Events in session )
AND MN.[DbName] = T.DbName
AND MN.[Event_Name] = T.EventName
AND MN.[ObjectName]= T.ObjectName
AND MN.[EE_Time_Stamp] = T.Time_Stamp_EE
AND MN.[SQL_TEXT] =T.SqlText -- Ryelugu 03/05/2015 This is a comparision Metric as well , But needs to decide on
-- Peformance Factor here , Will take advise from Lance if comparision on varchar(max) is a vital idea
--SELECT GETDATE()
--PRINT '4'
--RETURN
SELECT
top 100
[EE_Time_Stamp]
,[ServerName]
,[DbName]
,[Event_Name]
,[ObjectName]
,[UserName]
,[SQL_TEXT]
,[client_app_name]
,[Created_Date]
,[ClientHostName]
FROM
[dbo].[MN_DDLSchema_Changes_log]
ORDER BY [EE_Time_Stamp] desc
-- select getdate()
-- ** DELETE EVENTS after logging into Physical table
-- NEED TO Identify if this @XML can be updated into physical system table such that previously loaded events are left untoched
-- SET @XML.modify('delete /event/class/.[@timestamp="2015-03-06T13:01:19.020Z"]')
-- SELECT @XML
SELECT GETDATE() GETDATE_5
END
GO
Rajkumar Yelugu@@Version : ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Microsoft SQL Server 2012 - 11.0.5058.0 (X64)
May 14 2014 18:34:29
Copyright (c) Microsoft Corporation
Developer Edition (64-bit) on Windows NT 6.2 <X64> (Build 9200: ) (Hypervisor)
(1 row(s) affected)
Compatibility level is set to 110 .
One of the limitation states - XML columns with a depth of more than 128 nested nodes
How do i verify this ? Thanks .
Rajkumar Yelugu -
Extended Events exceptions: Invalid object name '#x'
We have recently begun using Extended Events in SQL Server 2012. I noticed something that I don't understand and haven't found an explanation for. There seem to be a lot of exceptions logged for "Invalid object name '#x'", where #x is any temp
table name. This includes ones like "Invalid object name '#tmp_sp_help_category'", which is not even a table in our code.
This does not seem to happen consistently, but I have repro'd it several times. Each time there is no error shown in Management Studio. It happens on alters of stored procedures that use temp tables as well as when they are run. It happens even for a script
as simple as the one below, which logs an exception saying "Invalid object name '#x'" and indicating that it has a severity of 16.
Has anyone run across this? I am guessing these are not exceptions that should actually be logged, but then again there might be times when a temp table really is missing, so we can't just ignore them all.
Thanks,
Ron Rice
create table #x(x1 int)
select * from #x
Ron RiceThe #tmp_sp_help_category table is associated with SSMS Activity Monitor:
http://blogs.msdn.com/b/grahamk/archive/2009/10/20/troubleshooting-sql-server-management-studio-with-sql-profiler-and-debugging-tools-part-1.aspx
You may consider to report at Connect:
https://connect.microsoft.com/SQLServer
I am moving it to Tools.
Kalman Toth Database & OLAP Architect
SELECT Video Tutorials 4 Hours
New Book / Kindle: Exam 70-461 Bootcamp: Querying Microsoft SQL Server 2012 -
Cannot drop the event session 'SharePoint_Diagnostics.... Which I don't have Database?
I don't have ''SharePoint_Diagnostics_8ded6bfe00ed49b7b466ae4dae38af49_0',' database on the server. But SharePoint throwing below error in the events. How to resolve this?
Unknown SQL Exception 15151 occurred. Additional error information from SQL Server is included below.
Cannot drop the event session 'SharePoint_Diagnostics_8ded6bfe00ed49b7b466ae4dae38af49_0', because it does not exist or you do not have permission.
ItsMeSri SP 2013 FoundationHi,
From your issue, it seems that it is related to the Usage Service Application.
Go to Central Administration -> Monitoring -> Review job definitions->Search Health Monitoring – Trace Events ->Enable the job and click on ‘Run now’.
If the issue persists, you need to offer more information about how did you met the issue.
Besides, refer to the similar posts:
https://social.technet.microsoft.com/Forums/en-US/2517d4c0-9aae-434c-89e9-52d124982100/how-to-recreate-sharepointdiagnostics-database-database-missing?forum=sharepointgeneral
http://www.networksteve.com/enterprise/topic.php/%22Site_is_in_a_partially_provisioned_state%22_when_attaching/upgrad/?TopicId=69098&Posts=5Best
Regards,
Lisa ChenForum Support
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, [email protected]
Lisa Chen
TechNet Community Support -
Microsoft sql server extended event log file
Dears
Sorry for my below questions if it is very beginner level.
In my implementation I have cluster SQL 2012 on Windows 2012; I am using MountPoints since I have many Clustered Disks.
My MountPoint Size is only 3 GB; My Extended event log are growing fast and it is storing in the MountPoint Drive directly (Path: F:\MSSQL11.MSSQLSERVER\MSSQL\Log).
What is the best practice to work with it? (is it to keep all Extended events? or recirculate? or to shrink? or to store in DB?)
Is there any relation between SQL truncate and limiting the size of Extended event logs?
How can I recirculate this Extended Events?
How can I change the default path?
How can I stop it?
and in case I stop it, does this means to stop storing SQL event in Windows event Viewer?
Thank youAfter a lot of checking, I have found below:
My Case:
I am having SQL Failover Cluster Instances "FCI" and I am using Mount-Points to store my Instances.
I am having 2 Passive Copies for each FCI.
In my configuration I choose to store the Root Instance which include the logs on Mount-Point.
My Mount Point is 2 GB Only, which became full after few days of deployment.
Light Technical Information:
The Extended Event Logs files are generated Coz I have FCI, in single SQL Installation you will not find this files.
The File Maximum size will be 100 MB.
The Files start circulating after it become 10 Full Files.
If you have the FCI installed as 1 Active 2 Passive, and you are doing failover between the nodes, then you will expect to see around 14 - 30 copy of this file.
Based on above information you will need to have around 100 MB * 10 Files Per Instance copy * 3 Since in my case I have 1 Active and 2 passive instances which will = 3000 MB
So in my case My Mount-Point was 2 GB, which become full coz of this SQLDIAG Logs.
Solution:
I extended my mount point by 3 GB coz I am storing this logs on it.
In case you will need to change SQLDIAG Extended Logs Size to 50 MB for example and place to F:\Logs, then you will need below commands:
ALTER SERVER CONFIGURATION SET DIAGNOSTICS LOG OFF;
ALTER SERVER CONFIGURATION
SET DIAGNOSTICS LOG MAX_SIZE = 50 MB;
ALTER SERVER CONFIGURATION
SET DIAGNOSTICS LOG PATH = 'F:\logs';
ALTER SERVER CONFIGURATION SET DIAGNOSTICS LOG ON;
After that you will need to restart the FCI from SQL Server Configuration Manager or Failover Cluster Manager.
I wish you will find this information helpful if it is your case.
Regards -
Event ID: 1280 Server 2012 RDS - web app fail on second session host
Hello there
Topography
SBS 2011 (domain controller)
Two VM’s:
VM1 – All RDS rolls: RD Gateway , Connection broker, Licensing and RD access installed and acting as a session host with an active collection for RD web apps. A CA trusted certificate is installed.
VM2 – Session host with a second collection for RD web apps
Problem
I have a single app installed on both session hosts (the apps require their own servers). Both appear on the RDWeb site available for use. I can run the app hosted on VM1 no problem, but when I try to open the second app hosted on VM2 I get
two issues:
An error is returned
“Your computer can’t connect to the remote computer because the Remote Desktop Gateway server address and the certificate subject name do not match. Contact your network administrator for assistance".
When viewing the certificate, it actually shows the CA cert installed on the
SBS server for RWW, not the cert on VM1. This has me puzzled
Secondly on VM 2, I get
Event ID: 1280 Warning Microsoft Windows TerminalServcies-session broker client
Remote Desktop Services failed to join the Connection Broker on server sever-vm1.local.
Error: Current async message was dropped by async dispatcher, because there is a new message which will override the current one.
When I run the app internally it seems to load but then disappears.
Some further config info if it is relevant:
I have port 4043 (443 used) as the only port directed to the gateway
Am I missing something simple? DNS? Port forwarding issue on the router? Its my first deployment of this nature with RDS 2012
Regards
MIS5000Hi,
Thank you for posting in Windows Server Forum.
Firstly please check the RDP version you are using. I suggest you to update to RDP 8.1 for better feature and functionality. Now other thing verify that you have the RD Gateway certificate name matches the external FQDN of the RD Gateway Server. Also please
check that certificate is added under local computer\personal store and must be signed by trusted root authority.
Please check below article for more detail.
TS Gateway Certificates Part III: Connection Time Issues related to TS Gateway Certificates
http://blogs.msdn.com/b/rds/archive/2008/12/18/ts-gateway-certificates-part-iii-connection-time-issues-related-to-ts-gateway-certificates.aspx
In regards to resolve other issue (Event ID 1280), identify and fix any connectivity problems between the RD Session Host server and the RD Connection Broker by doing the following:
• Check network connectivity to the RD Connection Broker.
• Start the Remote Desktop Connection Broker service.
• Add the RD Session Host server to the Session Broker Computers group.
More information.
Event ID 1280 — RD Connection Broker Communication
http://technet.microsoft.com/en-us/library/ee890889(v=ws.10).aspx
Hope it helps!
Thanks.
Dharmesh Solanki
TechNet Community Support -
Thunderbird was working and then for no reason it stopped downloading emails from the web server. I can access my emails in the web server okay. I have tried to remove my account and then add it again as a new account but I get a message saying that Thunderbird cannot find the email server. I have also tried to uninstall and reinstall Thunderbird but with the same result. I have also tried to remove the default mail server but have been unable to do so. How can I fix this?
I figured out a workaround.... Since I can get e-mails to populate via iSync and my other computer is running Leopard (it's a powerpc chip and can't run Snow Leopard), I added the account on the other computer and got the new account to populate into my SL machine with iSync. I don't like that I can't actually add the account directly, but at least this got me working.
-
I have configured the Default Domain Controller's policy to log SUCCESS for Account Logon Events in the Server 2008 R2 Domain Controller, but these events are not logging in the Security Event log.
Default Domain Controllers Policy
Computer Configuration/Windows Settings/Security Settings/Local Policies/Audit Policies/Audit Account Logon Events = Success.
What tools can I use to troubleshoot this further? The results of "Auditpol.exe /get /category:*" are below.
System audit policy
Category/Subcategory Setting
System
Security System Extension No Auditing
System Integrity No Auditing
IPsec Driver No Auditing
Other System Events No Auditing
Security State Change No Auditing
Logon/Logoff
Logon No Auditing
Logoff No Auditing
Account Lockout No Auditing
IPsec Main Mode No Auditing
IPsec Quick Mode No Auditing
IPsec Extended Mode No Auditing
Special Logon No Auditing
Other Logon/Logoff Events No Auditing
Network Policy Server No Auditing
Object Access
File System No Auditing
Registry No Auditing
Kernel Object No Auditing
SAM No Auditing
Certification Services No Auditing
Application Generated No Auditing
Handle Manipulation No Auditing
File Share No Auditing
Filtering Platform Packet Drop No Auditing
Filtering Platform Connection No Auditing
Other Object Access Events No Auditing
Detailed File Share No Auditing
Privilege Use
Sensitive Privilege Use No Auditing
Non Sensitive Privilege Use No Auditing
Other Privilege Use Events No Auditing
Detailed Tracking
Process Termination No Auditing
DPAPI Activity No Auditing
RPC Events No Auditing
Process Creation No Auditing
Policy Change
Audit Policy Change No Auditing
Authentication Policy Change No Auditing
Authorization Policy Change No Auditing
MPSSVC Rule-Level Policy Change No Auditing
Filtering Platform Policy Change No Auditing
Other Policy Change Events No Auditing
Account Management
User Account Management No Auditing
Computer Account Management No Auditing
Security Group Management No Auditing
Distribution Group Management No Auditing
Application Group Management No Auditing
Other Account Management Events No Auditing
DS Access
Directory Service Changes No Auditing
Directory Service Replication No Auditing
Detailed Directory Service Replication No Auditing
Directory Service Access No Auditing
Account Logon
Kerberos Service Ticket Operations No Auditing
Other Account Logon Events No Auditing
Kerberos Authentication Service No Auditing
Credential Validation SuccessHi Lawrence,
After configuring the GPO, did we run command gpupdate/force to update the policy immediately on domain controller? Besides, please run command gpresult/h c:\gpreport.html to check if the audit policy
setting was applied successfully.
TechNet Subscriber Support
If you are TechNet Subscription user and have any feedback on our support quality, please send your feedback here.
Best regards,
Frank Shen -
Best Practice for Monitoring, on VPS 2012 Server Standard. Extended Events or Profiler?
Hi,
What tools do you use to determine if you should tweak SQL Server configuration and optimize code route, or simply bump up your virtual resources? Can someone share a bag of Extended Events to monitor at the VPS level?
I'm a reasonably decent SQL Developer but never advanced far with DBA efforts. Especially when the mainstream went virtual. Seemed to me that all SQL Servers flexibility with managing disk and memory went out the window now that everything is 'shared', NATed,
and Plesked. So I basically dropped out of the conversation and built stuff with SSIS and TSQL.
Now, I'm charged with assessing a bottleneck on a VPS Windows 2012 Standard running SQL 2012 Express. I've read that running profiler and traces are deprecated and I've looked a bit at the servers extended events on the hosted environment. I have not run anything.
My question: Does it make sense to think in terms of 'levels' in deciding what to monitor? I consider the SQL Server as a level, then the Windows Server, and finally the Virtual Level. What I'm getting at, is sure, I can monitor SQL Server with a profile tool,
but it won't know SQL is on a VPS. So do I miss something?
There used to be day when we had a dedicated physical box for SQL Server. We ran traces using profiler and got good clues on how to improve performance. In todays VPS world we can use sliders to increase virtual memory and disk space. What tools do you use
to determine if you should tweak SQL Server configuration and optimize code route, or simply bump up your virtual resources? Can someone share a bag of Extended Events to monitor at the VPS level?
What Extened Events at the VPS level tell me if SQL Server is struggling with the limited 1Gb virtual memory? I realize this is not a direct question but hopefully someone will point this developer in the right direction.
JohnHi John,
From SQL point of view it doesnt really matter whether the box is physical or virtual. So if you feel there is performance issues with sql and you are well versed with sql profiler troubleshooting go ahead with that. If you feel performance is good, then
you know where to look into.
I would first prefer to find whether it is really a problem with SQL before trying to troubleshoot sql side and I use perfmon counters to do that.
Also I would look at the SQL Error log to see if there are any obvious errors.
I havent used extended events much so leaving that for others to comment on. :)
Regards, Ashwin Menon My Blog - http:\\sqllearnings.com -
Best way to query extended events file in sql server 2012
Hello all,
is there any best way to xquery extended events async file i am having hard time sorting out data in GUI and using xquery.
Any help highly appreciated.
thanks,
ashwin.Yes, there might be better way to write it the way you did it. But since I don't know what you wrote or what you are looking for I can't give any advice. You need to be more specific.
Erland Sommarskog, SQL Server MVP, [email protected] -
Hi all
I use scripts to stop and start admin server and cluster.
After include " -Xmanagement:autodiscovery=true,authenticate=false,ssl=false,port=11202" as JVM parameters, I cannot stop the admin server using stopWebLogic.sh.
If I stop from console it works.
This error seems a port conflict when trying to start a new JVM to stop Adminserver...
Stopping Weblogic Server...
[ERROR][mgmnt ] JMX connector server communication error: null
java.lang.RuntimeException: Error: JMX connector server communication error: nul
l
at oracle.jrockit.management.server.Messages.error(Messages.java:109)
at oracle.jrockit.management.server.Messages.error(Messages.java:123)
at oracle.jrockit.management.server.Agent.main(Agent.java:165)
at oracle.jrockit.management.server.Agent.agentmain(Agent.java:101)
at oracle.jrockit.management.server.Agent.start(Agent.java:214)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.
java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAcces
sorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at jrockit.management.AgentStarter.startAgent(AgentStarter.java:135)
Caused by: oracle.jrockit.management.server.AgentError
at oracle.jrockit.management.server.JMXConnector.startNewServerImpl(JMXC
onnector.java:82)
at oracle.jrockit.management.server.RemoteJMXConnector.newServer(RemoteJ
MXConnector.java:233)
at oracle.jrockit.management.server.sun.RemoteJMXConnectorImpl.newServer
(RemoteJMXConnectorImpl.java:112)
at oracle.jrockit.management.server.RemoteJMXConnector.startNewServer(RemoteJMXConnector.java:181)
at oracle.jrockit.management.server.JMXConnector.start(JMXConnector.java:64)
at oracle.jrockit.management.server.Agent.start(Agent.java:64)
at oracle.jrockit.management.server.Agent.main(Agent.java:163)
... 7 more
Caused by: java.rmi.server.ExportException: Port already in use: 11202; nested exception is:
java.net.BindException: Address already in use
at sun.rmi.transport.tcp.TCPTransport.listen(TCPTransport.java:310)
at sun.rmi.transport.tcp.TCPTransport.exportObject(TCPTransport.java:218)
at sun.rmi.transport.tcp.TCPEndpoint.exportObject(TCPEndpoint.java:394)
at sun.rmi.transport.LiveRef.exportObject(LiveRef.java:130)
at sun.rmi.server.UnicastServerRef.exportObject(UnicastServerRef.java:190)
at oracle.jrockit.management.server.sun.SunRMIExporter.exportObject(SunRMIExporter.java:36)
at javax.management.remote.rmi.RMIJRMPServerImpl.export(RMIJRMPServerImpl.java:84)
at javax.management.remote.rmi.RMIJRMPServerImpl.export(RMIJRMPServerImpl.java:76)
at javax.management.remote.rmi.RMIConnectorServer.start(RMIConnectorServer.java:388)
at oracle.jrockit.management.server.JMXConnector.startNewServerImpl(JMXConnector.java:80)
... 13 more
Caused by: java.net.BindException: Address already in use
at java.net.PlainSocketImpl.socketBind(Native Method)
at java.net.PlainSocketImpl.bind(PlainSocketImpl.java:365)
at java.net.ServerSocket.bind(ServerSocket.java:319)
at java.net.ServerSocket.<init>(ServerSocket.java:185)
at java.net.ServerSocket.<init>(ServerSocket.java:97)
at sun.rmi.transport.proxy.RMIDirectSocketFactory.createServerSocket(RMIDirectSocketFactory.java:27)
at sun.rmi.transport.proxy.RMIMasterSocketFactory.createServerSocket(RMIMasterSocketFactory.java:333)
at sun.rmi.transport.tcp.TCPEndpoint.newServerSocket(TCPEndpoint.java:649)
at sun.rmi.transport.tcp.TCPTransport.listen(TCPTransport.java:299)
at sun.rmi.transport.tcp.TCPTransport.exportObject(TCPTransport.java:218)
at sun.rmi.transport.tcp.TCPEndpoint.exportObject(TCPEndpoint.java:393)
at sun.rmi.transport.LiveRef.exportObject(LiveRef.java:129)
at sun.rmi.server.UnicastServerRef.exportObject(UnicastServerRef.java:190)
at oracle.jrockit.management.server.sun.SunRMIExporter.exportObject(SunRMIExporter.java:36)
at javax.management.remote.rmi.RMIJRMPServerImpl.export(RMIJRMPServerImpl.java:84)
at javax.management.remote.rmi.RMIJRMPServerImpl.export(RMIJRMPServerImpl.java:75)
at javax.management.remote.rmi.RMIConnectorServer.start(RMIConnectorServer.java:388)
at oracle.jrockit.management.server.JMXConnector.startNewServerImpl(JMXConnector.java:80)
at oracle.jrockit.management.server.RemoteJMXConnector.newServer(RemoteJMXConnector.java:233)
at oracle.jrockit.management.server.sun.RemoteJMXConnectorImpl.newServer(RemoteJMXConnectorImpl.java:112)
at oracle.jrockit.management.server.RemoteJMXConnector.startNewServer(RemoteJMXConnector.java:181)
at oracle.jrockit.management.server.JMXConnector.start(JMXConnector.java:64)
at oracle.jrockit.management.server.Agent.start(Agent.java:64)
at oracle.jrockit.management.server.Agent.main(Agent.java:163)
at oracle.jrockit.management.server.Agent.agentmain(Agent.java:100)
at oracle.jrockit.management.server.Agent.start(Agent.java:213)
... 5 more
Could not create the Java virtual machine.
DoneThis is because the process to stop the JVM is also trying to use the same host/port combination for the remote JRockit monitoring as the same setDomainEnv script is likely called in either case. What you want to do is ignore those options when launching the JVM (the WLST script) that tells the server to shut down.
-
Best Way to Capture Stored Procedure Calls through Extended Events?
I am trying implement Real Simple Solution for Database Monitoring:
If any of the RPC Calls takes more than 200 milliseconds or more than 10K Reads , I want to compile the list on daily basis and sent out an email to our team. We usually did that through RPC Completed event through Profiler.
We want to Implement the same through Extended Events but SQL Text is not being captured because we are using SQL Server 2008 R2.
Whats the best way with Extended Events to Capture:
RPC Calls with Parameters and Values and Reads, Writes, CPU and Query HASH.
What we currently have is :
Has anyone done this using SQL Server 2008 R2 and please let me know.
IF EXISTS(SELECT * FROM sys.server_event_sessions WHERE name='LongRunningQueries')
DROP EVENT SESSION [LongRunningQueries] ON SERVER;
CREATE EVENT SESSION [LongRunningQueries]
ON SERVER
ADD EVENT sqlserver.module_end(
ACTION (sqlserver.client_app_name, sqlserver.client_hostname, sqlserver.database_id, sqlserver.plan_handle, sqlserver.session_id, sqlserver.sql_text, sqlserver.tsql_stack, sqlserver.username)),
ADD EVENT sqlserver.rpc_completed(
ACTION (sqlserver.client_app_name, sqlserver.client_hostname, sqlserver.database_id, sqlserver.session_id, sqlserver.sql_text, sqlserver.username)),
ADD EVENT sqlserver.sp_statement_completed(
ACTION (sqlserver.client_app_name, sqlserver.session_id))
ADD TARGET package0.asynchronous_file_target(
SET filename='G:\LongRunningQueries.xet', metadatafile='G:\LongRunningQueries.xem')
WITH (MAX_MEMORY = 4096KB, EVENT_RETENTION_MODE = ALLOW_MULTIPLE_EVENT_LOSS, MAX_DISPATCH_LATENCY = 300 SECONDS, MAX_EVENT_SIZE = 0KB, MEMORY_PARTITION_MODE = NONE, TRACK_CAUSALITY = ON, STARTUP_STATE = ON)
ALTER EVENT SESSION [LongRunningQueries] ON SERVER STATE = START
I90RunnerHello,
Please read the following resource.
https://social.msdn.microsoft.com/Forums/sqlserver/en-US/d6d51f6e-c01b-4880-abb2-4f0cfd1f4531/extended-event-trace-on-event-rpccompleted-not-capturing-sqltext-action-unable-to-retrieve-sql?forum=sqldatabaseengine
Hope this helps.
Regards,
Alberto Morillo
SQLCoffee.com -
Obtaining target database via extended events
I try to gather the database access via extended events.
It is possible to query a database from a different context and most extended events I see return the context rather then the target database.
For instance, using the event sp_statement_starting would return master as action databaseid for the following:
use master
select * from targetdb.dbo.mytable
What would be a event candidate or action to obtain the target database, targetdb in this case, instead?
For trace, the event 114, Audit Schema Object Access Event would do the job but it does not seem to exists in extended events.
Note: this is sql server 2008 R2 standard so no audit and limitted extended events available.
ThanksHello Antoine
always when trying to find out database access I advise using the most basic event that always has to occur for any database access which also cannot be circumvented: lock_aquired, specifically Shared Lock on Database level should help you
Andreas Wolter (Blog |
Twitter)
MCSM: Microsoft Certified Solutions Master Data Platform, MCM, MVP
www.SarpedonQualityLab.com |
www.SQL-Server-Master-Class.com
Maybe you are looking for
-
New Windows 7 computer. After installing Firefox, every time I bring it up I get the following message: "Could not initialize the application's security component. The most likely cause is problems with files in your application's profile directory.
-
Photoshop CC crashes frequently, with eyedropper tool (white/black/gray point setter in curves)
I get photoshop crashing all the time, multiple times an hour, regardless of various setting changes, here are a few crash logs. This is not my computer, but i have seen the same error on my laptop as well. It most often(almost always) happens on cli
-
Placing a cursor in multiplot graph to display all values at the cusor location
We are currently using NI based DAq system which uses LABVIEW 7.1.We would like to know whether it is possible in LABVIEW 7.1 to place a cursor in a graph having multiplot that will disply all the values of parameters at the cursor location?
-
Today, i opened iweb and all i am getting now is the start up page where it wants me to create a new site. I don't understand...nothing has gone wrong with the computer and i have checked that the site is still active in my idisk. Also i was creating
-
Hi, Is it possible to hide the email button when it is clicked and have it replaced with a comment of some type, ie 'Thank you for your submission!' Frank