Database Mirroring Encryption

Hi,
Our security team, scanned database server (SQL 2005) and mentioned that there are two connections (ref: below screenshot) which are not being encrypted. When we looked at the connections, they were database mirroring related. (Engine
level: we implemented SSL certificate).
So, we started working on to encrypt these connections as well. We created certificate and assigned it to the Endpoints, successfully. (Ref: http://msdn.microsoft.com/en-us/library/ms191140(v=sql.90).aspx). The only thing that we didn't follow is "CREATE
LOGIN" part and Database mirroring is running & synchronizing. But we still can see those two connections exists.
QUESTION: What are we missing? Any ideas will be a great help. Thank you very much.
If you feel that I have answered your question then please "Mark as Answer".

Data Encryption in Database Mirroring Transport Security (http://technet.microsoft.com/en-us/library/ms186360.aspx), and
Encrypting Connections to SQL Server (http://technet.microsoft.com/en-us/library/ms189067.aspx).
Best Regards,Uri Dimant SQL Server MVP,
http://sqlblog.com/blogs/uri_dimant/
MS SQL optimization: MS SQL Development and Optimization
MS SQL Consulting:
Large scale of database and data cleansing
Remote DBA Services:
Improves MS SQL Database Performance
SQL Server Integration Services:
Business Intelligence

Similar Messages

Lack of support for FIM database mirroring

The official line is that database mirroring is not a supported architecture for the FIM deployment. I am not proposing using this, however I'd like to understand 1) What the issues really would be with a mirrored database deployment, 2) Will support
ever be added for this, and will it come in the form of SQL AlwaysOn?
Really appreciate help and input.
Rgds,
David

Database mirroring comes has two modes regarding transactions: synchronous or asynchronous.
Synchronous requires that the data be committed in both places before releasing the transaction. This has a big performance impact on the FIM Service database and to a lesser extent on the FIM Sync Database.
Asynchronous means that data isn't committed in both places at the same time, the mirror can fall behind and then in failover you could be behind. In order to have automatic failover with Mirroring you have to be able to modify the connection string to include
the failover partner or the client has to support getting that data at first logon. While you can modify the FIM database connection strings, it is not understood if FIM is using database clients that support mirroring. I believe it is. Even with asynchronous
you still have performance hit for copying every transaction to the mirror.
SQL Always On combines the best of mirroring and clustering to allow you to group databases together into an availability set, and then automatic failover the whole group to another server. It should be noted that Always On makes use of a similar underlying
mechanisms as mirroring to copy the data -- this is evident when you read that Always on also has an asynchronous and synchronous mode. You will most likely run into the same performance quandary.
Will the product group add support for it? My guess is that it depends on if they find a good way to address the performance issues.
David Lundell, Get your copy of FIM Best Practices Volume 1 http://blog.ilmbestpractices.com/2010/08/book-is-here-fim-best-practices-volume.html

Error in Starting Database Mirroring

Hai Everyone.. I have an issue in mirroring which i described below.
I am getting the above error when i click on "start mirroring" button. I turned off firewall in my antivirus.
And i also executed the below script in both my principal and mirror server. Because i created both the instances in my system only. And i am accessing those instances with windows authentication.
Go
GRANT CONNECT ON ENDPOINT:: EMP1_MIRRORING TO [DEVLAP5170\login];
Go
-- Thanks and Regards Srikar Reddy Gondesi, Trainee SQL Server Database Administrator Miracle Software systems, Inc.

Hi,
How’s everything going?
Also, see prerequisites for database mirroring:
For a mirroring session to be established, the partners and the witness, if any, must be running on the same version of SQL Server.
The two partners, that is the principal server and mirror server, must be running the same edition of SQL Server. The witness, if any, can run on any edition of SQL Server that supports database mirroring.
The database must use the full recovery model.
Verify that the mirror server has sufficient disk space for the mirror database.
When you are creating the mirror database on the mirror server, make sure that you restore the backup of the principal database specifying the same database name WITH NORECOVERY. Also, all log backups that were created after
that backup was taken must also be applied, again WITH NORECOVERY.
Helpful link:
Prerequisites, Restrictions, and Recommendations for Database Mirroring
http://msdn.microsoft.com/en-us/library/ms366349.aspx
Thanks.
Tracy Cai
TechNet Community Support

Alert: SQL Server Service Broker or Database Mirroring Transport stopped

Hi Team,
I got this error message even no one DB configured as mirroring ???
Alert: SQL Server Service Broker or Database Mirroring Transport stopped Priority: 0 Severity: 2 Resolution state: New
Alert description: The Database Mirroring protocol transport has stopped listening for connections.

Can you check the rule. By default the configurations are disabled state that is the reason you are getting the alert.
If it's not configured properly then you might need to override it
--Prashanth

Database Mirroring

If database in suspect mode what is going to be happen in mirroring? will it failover?

Yes I would say yes because suspect mode mostly likely occurs due to Hardware failure,
improper shutdown of the database server,
corruption of the database files, and of course unavailable database files and so on...
And as we all know in mirroring
unplanned downtime can be caused by hardware failures such as storage failure, by power outages, by human error, or by natural disasters, all of which can cause the production server as suspect mode or data center to be unavailable.
However if we talkling about Suspect_pages The principal recognizes a page read error, marks the page with an 829 error (restore pending), inserts a row into the suspect_pages
table in MSDB with the error status, and requests the page from the mirror. If the mirror is victorious in reading the page, it returns the page to the principal who applies it. After the page is repaired, the principal marks the page as restored — that is,
event_type =
5 in the suspect_pages table. Then any deferred transactions are resolved.
You can use this code SELECT
* FROM
sys.dm_db_mirroring_auto_page_repair
catalog view to displays corrupted pages in the data mirroring environment.
If the mirror fails, then the principal continues functioning, so the database continues to be available to the clients. The mirroring state is DISCONNECTED, and the principal
is running exposed in this case. You can use the sys.database_mirroring
catalog view to see the mirroring state on the principal server. Make sure you have plenty of disk space for the transaction log to grow on the principal and be sure to bring the mirror server online before you run out of disk space and your other option
will be using this code to break the database mirroring session ALTER DATABASE
<database_name> SET PARTNER OFF if you have to.
If the
witness is lost, the database mirroring session will continue functioning
without interruption, and the database will be available.
However If the
principal server is lost, the failover scenario
depends on the transaction safety (FULL or OFF) and whether a witness is present. if we talk about
FULL with a witness If Server A fails, then Server B will be the Principal but witness down Server B will not be able to Serve. so if we talk about
without a witness if the Principal fails the database is not accessible to client unless you don't have to go several
steps to make it available. Finally we talk about Principal with OFF (no witness) if the
principal is lost the database will be unavailable and then your option is to FORCE FAILOVER
I hope this will help and give you idea to make more research about it and overcome your problem. Good Luck

Monitor SQL Database mirroring using powershell script

I am trying use the below powershell script to monitor SQL Database mirroring. The motive here is to determine if there are databases which are in "Disconnected" or "Suspended" mode.
I am running the script on the Principal Server:
$returnStateOK = 0
$returnStateWarning = 1
$returnStateCritical = 2
$returnStateUnknown = 3
$NagiosStatus = ""
# Load SMO extension
[System.Reflection.Assembly]::LoadWithPartialName("Microsoft.SqlServer.Smo") | Out-Null;
# Servers to check
$sqlservers = @("$env:computername");
foreach($server in $sqlservers)
$srv = New-Object "Microsoft.SqlServer.Management.Smo.Server" $server;
# Get mirrored databases
$databases = $srv.Databases | Where-Object {$_.IsMirroringEnabled -eq $true -and $_.MirroringStatus -eq "Suspended" -or $_.MirroringStatus -eq "Synchronizing" -or $_.MirroringStatus -eq "Disconnected"
-or $_.MirroringStatus -eq "None" -and $_.Name -ne "Master" -and $_.Name -ne "model" -and $_.Name -ne "msdb" -and $_.Name -ne "tempdb"};
if ($databases -ne $null)
$databases | Select-Object -Property Name, MirroringStatus | Format-Table -AutoSize;
exit $returnStateCritical
} Else {
Write-Host "All Databaes are Mirrored"
exit $returnStateOK
I have Suspended few databases for testing purpose but when I run the above script the output says "All Databaes are Mirrored"
If I make changes to $database and use it below i.e. I am changing the AND operator to OR after "$_.IsMirroringEnabled -eq $true"
$databases = $srv.Databases | Where-Object {$_.IsMirroringEnabled -eq $true -or $_.MirroringStatus -eq "Suspended" -or $_.MirroringStatus -eq "Synchronizing" -or $_.MirroringStatus
-eq "Disconnected" -or $_.MirroringStatus -eq "None" -and $_.Name -ne "Master" -and $_.Name -ne "model" -and $_.Name -ne "msdb" -and $_.Name -ne "tempdb"};
I get the below output:
Name
MirroringStatus
DB1
Synchronized
DB2
Synchronized
DB3 Synchronized
DB4
Suspended
DB5 Suspended
DB6
Suspended
DB7
Synchronized
DB8
Synchronized
I only want the databases which are Suspended or Disconnected to be listed.

I only want the databases which are Suspended or Disconnected to be listed.
Hi raul-133,
Based on your description, to list the databases which are Suspended or Disconnected ,I recommend you execute the following Transact-SQL statements in SQL Server firstly. If you can get the expected results from this query, then use the SQL Server query
in powershell script. For more details, please review this similar blog:
Monitor database mirroring.
Use master
go
select d.name, m.mirroring_state_desc
from sys.database_mirroring m,
sys.databases d
where m.database_id = d.database_id and (m.mirroring_state in (0,1))
For more details about mirroring state, you can review this article:
sys.database_mirroring (Transact-SQL).
Thanks,
Lydia Zhang

Mirror Database shows Recovery state in Database mirroring in sql 2012

Hi I am working on DBmirroring and have encountered problem of mirror database showing recovery state.
I tried to resolve issue by removing database mirroring from principal ,removing endpoints from both the nodes and
finally firing alter database db1 set partner off statement also.But when reconfigure dbmirroring on principal it does not allow
start dbmirroring and mirror database db1 comes in to recovery state from restoring stage.
srm_2010

ok in that case why it is not allowing me to configure db mirroring when I am trying from SSMS.It gives an error.tell me????
srm_2010
And what is the error ? If while configuring mirroring it fails for some reason you have to make sure the mirror database which has gone in recovery state needs to be brought in restoring state.
Please mark this reply as answer if it solved your issue or vote as helpful if it helped so that other forum members can benefit from it
My Technet Wiki Article
MVP

Database Mirroring - Witness Server

Hi,
Can I have a setup where both the Primary and the Mirror servers are running on SQL Server 2008 and Witness is running on SQL Server 2005? Somehere, I read that the witness can be of any edition, however the version has to match with the Primary and the
Mirror setup.
Could someone please confirm?
Also, if SQL Server 2008 Standard Edition supports automatic failover on Database Mirroring?
Thanks,

In the Microsoft SQL 2014 docs I see:
"We strongly recommend that the witness reside on a separate computer from the partners. Database mirroring partners are supported
only by SQL Server Standard edition and by SQL Server Enterprise edition.
Witnesses, in contrast, are also supported by SQL Server Workgroup and by SQL Server Express."
I figured I'd post this, since I ended up here looking for an answer to this question.

Database Mirroring Idea

Hi Senseis
I was thinking about this concept and I want to know if someone else think the same idea before. As I say in other Thread, I will use database mirroring on top of MSCS to protect our systems. The mirror site will be in Miami and the primary in Cancun, Mexico. In the documentation says that the distance and bandwitch is essential for the succed of this configuration, so I will implement the high performance method. But (and is here where I want to know your opinions), if I recreate my production enviorement in the mirror site (I mean everything, disk distribution, SID, NSID, everything), apply the DB Mirroring and, in case of crash in my production site, just redirect the traffic to my mirror site... this will work?
Thanks for your help

I could imagine using a name in the SAPLogon to connect to the original system. If it fails you change one DNS entry to point to the other system and it should work.
But there are other things to consider:
- printers
- interfaces to other systems (BW)
- mounted file systems
Those need to be made aware too of the fact, that the systems IP changed.
Markus

Database Mirroring Scenarios

Hi Everyone,
I am doing some test for database mirroring. I come with come with these two scenarios i unable to test out.
1) The principal database server disks full. In these case is the database mirroring failover will happen?
2) The principal database server and mirror database server disk full. In these case what will happen to database mirroring?

Hi,
No. Database mirroring endpoints use Transmission Control Protocol (TCP) to send and receive messages between the server instances participating database mirroring sessions. Automatic failover will occur if the principal
server has lost communication with the rest of the database mirroring configuration, while the mirror and witness retain quorum. If all server instances lose communication, however, and the witness and the mirror server later regain communication, automatic
failover does not occur.
See ‘Conditions required for an Automatic failover’ section in the below link:
http://technet.microsoft.com/en-us/library/ms189590(v=sql.105).aspx
Additional information:
Possible Failures During Database Mirroring
http://technet.microsoft.com/en-us/library/ms190913(v=sql.105).aspx
Thanks.
Tracy Cai
TechNet Community Support

Database Mirroring Login Accounts

I need to setup database mirroring between 2 separate SQL 2012 instances. The documentation states that if the 2 server instances are running under different user accounts then these need to be manually created on both instances. Is this login account the
account that was used when installing SQL or is it the account assigned to run the SQL server service account?
Thanks
Alistair

If the server instances run as different user accounts, user logins on the server instance that hosts the principal server or primary replica must be manually reproduced on the server instance that hosts the mirror server or on every server instance that
hosts a secondary replica. For more information, see Create a Login for a Different Account and Grant
Connect Permission, later in this topic.
I am still unsure what it means when it refers to
'If the server instances run as different user accounts'. Is this the account that shows in services under our instance 'SQL Server (MSSQLSERVER)?
Thanks
Did you read below example(http://technet.microsoft.com/en-us/library/ms366346.aspx#CreateLogin)
For example, for the server instance sqlA, which runs under loginA, to connect to the server instance sqlB, which runs under loginB, loginA must be in the
syslogins table on sqlB, and loginB must be in the syslogins table on sqlA. In addition, for a database mirroring session that includes a witness server instance (sqlC) and in which the three server instances run under different
domain accounts, the following logins must be created:
On instance...
Create logins for and grant connection permission to ...
sqlA
sqlB and sqlC
sqlB
sqlA and sqlC
sqlC
sqlA and sqlB
Note
It is possible to connect with the network service account by using the machine account instead of a domain user. If the machine account is used, it must be added as a user on the other server instance.
Is it still unclear
Please mark this reply as the answer or vote as helpful, as appropriate, to make it useful for other readers

Database Mirroring problem

I'm getting an error setting up Mirrroring that I cannot seems to fix. I'm using a setup of two SQL servers with no witness, both running SQL Server 2008 R2. I setup the perms on Primary, Backup Full the database in question (MMS Database to test) and then
restore that using NO Recovery on the Secondary. I then setup the Security Wizard on the Primary, after which it sets up the end-points correctly on both servers using the service account which is local admin and Sysadmin on both boxes. However, when I then
choose to start mirroring, I consistently get a 1418 error saying that the server cannot be reached or does not exist. I have verified that the FQDN and port 5022 is open using Netstat and using telnet and TCP protocol is enabled on both boxes.
Any other suggestions? Any obvious perms I might have forgotten to copy across? I've copied App Pool, CA, Content Access, Cache and Service accounts to the secondary box as logins with no fixed roles. Both End Points for Database Mirroring list as started.

Hi Robin,
According to your description, my understanding is that the error occurred when mirroring the databases.
Did you use Kerberos authentication in SharePoint?
If yes, when you run the SQL Server service under a domain account or under a local account, the attempt to create the SPN will fail in most cases because the domain account and the local account do not have the right to set their own SPNs. When the SPN
creation is not successful, this means that no SPN is set up for the computer that is running SQL Server, so the communication between the servers will fail.
So I recommend to configure the SPN for SQL, please refer to the link below:
http://support.microsoft.com/kb/811889/en-us
Here is a similar issue for you to take a look:
http://www.sqlteam.com/forums/topic.asp?TOPIC_ID=191014
Best regards.
Thanks
Victoria Xia
TechNet Community Support

Database Mirroring failover

Hi,
I have configured mirroring, server A and server B, suppose if server A down, what are the action we need to tak bring up principal server.
Thanks in advance
Shashikala

Thank you. If we configured as safety with automatic failover. In this case mirror server will come online automaticaly if pricipl server down? or do we need to follow above steps to come nline.
Thanks
Shashikala
If witness is configured and principal is down and witness is able to form quorum with mirror automatic failover will happen. If quorum is not being formed anyhow for some reason no automatic failover will happen and then mnual failover will be required.
See various scenarios mentioned in below link (Database Mirroring Availability Scenarios)
Database mirroring in SQL server
Please mark this reply as answer if it solved your issue or vote as helpful if it helped so that other forum members can benefit from it.
My TechNet Wiki Articles

Database mirroring Enpoints Error

Hi,
I am getting below error while i configuring mirroring in my laptop (Local System).
Please help me.

Hi,
Did you try using different port number while creating endpoint? According to the description, I know you have multiple instances installed on one machine.
For two instances of three are running on the same machine, make sure that the endpoints on them are listening on the different TCP ports.
Please check below articles for more information.
http://msdn.microsoft.com/en-us/library/ms179511.aspx
You can follow this article to troubleshoot 1418 error:
Database Mirroring Error 1418 Troubleshooter
http://blogs.msdn.com/b/grahamk/archive/2008/12/08/database-mirroring-error-1418-troubleshooter.aspx
Thanks.
Tracy Cai
TechNet Community Support

Database mirroring and service accounts

Hi,
I am trying to configure database mirroring with sql server 2012.
My principal instance and my mirror instance are on different server.
Both SQL Server service run with NT SERVICE\MSSQLSERVER.
Now when I am configuring database mirroring, which service account should I use ?
database account or server account ?
Instead of using domain account, can I :
1- create local account on my two server
2- Add these 2 logins in my 2 instances.
3- use these local account for configuring database mirroring.
regards

You should use domain account as I consider them more secured. What is database account there is nothing like that account here means valid windows login or domain account having privileges oon system.
Please read below
http://msdn.microsoft.com/en-us/library/ms189434.aspx
Setup a login account for DB Mirroring
Please mark this reply as answer if it solved your issue or vote as helpful if it helped so that other forum members can benefit from it
My Technet Articles

Database Mirroring Encryption

Similar Messages

Maybe you are looking for