Identify source of a SQL Server job running nightly - sql-server

I am looking into performance issues with an app that uses SQL Server Express (Microsoft SQL Server 2014 (SP2) (KB3171021) - 12.0.5000.0 (X64)) for the back end database.
I'm logging slow running queries using Extended Events. Looking at these I have identified a job that runs every night a series of queries, some of which take quite an extended period. The longest single query takes 10 minutes or so. It seems to be some sort of reporting, gathering broad information about everything in the tables it is looking at.
This seems to be an automated process that is running nightly at exactly the same time and takes about the same length of time to execute each night (around 20 minutes).
It runs on a Windows account with Administrative privileges that connects to SQL using Windows authentication. There is other legit stuff we do know about also running on this account.
The client doesn't know what it is.
The app name logged is just ".Net SqlClient Data Provider" which I believe is a generic default.
This is different than the client application which identifies itself correctly. I have identified with the client everything else that is running against the database- there are a few other jobs that generate accounting emails for example.
I can't find anything in Windows Scheduled Tasks that corresponds and SQL Express obviously doesn't have SQL Server Agent- everything other SQL job I have identified is scheduled in Windows Scheduled Tasks.
I've tried turning login auditing on and I can see the login occurring but it gives even less information as to what it is, it doesn't even give me the client app name.
I have no reason to believe it is in any way malicious, it is likely something that was set up years ago and simply forgotten.
Any ideas for how I could pinpoint where exactly this is coming from?

You will need to do this while you think the mystery program is running.
Open a Remote Desktop windows session on the actual SQL server since you are pretty sure that is where it is running.
Have TaskMgr.exe ready. Go to the “Details” tab so that you can search by TaskManager PID (not SQL PID) . Sort by this TaskMgr PID.
Right Click on the Columns at the top of this Details tab.. Choose “Select Columns”
Add this column …
Command line
While you think the mystery program is running run the following sql.
select x.host_process_id as USE_ME_TaskMgr_PID_OnClient_PC
, x.host_name as PCNameFromClient
, x.program_name as ProgNmFromClient
, x.client_interface_name
, x.original_login_name
, x.login_name
, x.nt_domain
, x.nt_user_name
, x.*
FROM sys.dm_exec_sessions x
order by x.host_name DESC
, x.program_name DESC
GO
Look at the first column of this sql. Find your mystery program in the list. Take the first value. This is the Program PID that will be the PID on the TaskMgr PID. Then you will see the command line full execution directory path.

By using something like sp_who you can find the hostname for each user connecting. Maybe that can give you a hint on where to look?

Related

SQL Server 2017 monitor and alert of stored procedure duration while it is still running

SQL Server 2017 CU6 Enterprise. Is there a way to monitor and alert on running stored procedures on specific database if more than - say two minutes - has passed - but, while it is still running. I know multiple resources exist to capture that after it was done - e.g. xEvents, QueryStore, .. - but I need to capture that while stored procedure is still running and then write to eventlog or sending email with powershell or else.
Thanks.
For this I would use Adam Mechanic's sp_WhoIsActive.
This well documented procedure is a go-to in the community to see what is running on your server. By default, it doesn't return sleeping SPIDs.
To capture the results, check out this part of the documentation.
You will also want to limit it to a specific database or host or whatever. For that, Check out deciding what not to see.
You can find all of the help by running sp_WhoIsActive #help = 1 or just reading the full docs.

Couldn't connect to database when using Top Resource Consumers QueryStore Report

We recently upgraded our SQL server to 2016 and I turned on QueryStore to do the analysis that it provides. I'm encountering a problem where, even if the time period of the report is Last hour, it will generate a message that says "Couldn't connect to database" even when running it on the database server itself. Sometimes if I keep refreshing the report it will eventually display some data, but it's intermittent at best. I'm running SSMS 17.5 on a sql server 2016 server.
We are having a somewhat similar issue with another program that connects to the database where it will sometimes not be able to connect, but every time I run my queries in SSMS, run reports in SSRS, or even use activity monitor, I never see any connection drops, so I'm not sure if it is related.
Thank you in advance for any help!
I find it works fine with the statistic set to Avg, StdDev, or Total. Max and Min give the error.
I found this happens when the query store runs out of space and gets into cleanup mode.
In database properties in SSMS try playing around with Query Store settings: for how many days it stores the query stats and does it get into "size cleanup" mode. More info on how to keep it adjusted: https://learn.microsoft.com/en-us/sql/relational-databases/performance/best-practice-with-the-query-store?view=sql-server-ver15#Configure

How to stop a running query?

I use RODBC to send queries to an SQL-Server. Sometimes they take too much time to run, so I need to cancel them.
Clicking the red "stop" button in RStudio yields this error message:
R is not responding to your request to interrupt processing so to stop
the current operation you may need to terminate R entirely.
Terminating R will cause your R session to immediately abort. Active
computations will be interrupted and unsaved source file changes and
workspace objects will be discarded.
Do you want to terminate R now?
And if I click yes my session is indeed terminated. (note: using Rgui instead of RStudio doesn't make things better)
However:
when I use another software (named "Query ExPlus") to connect to this same SQL-Server, I have a similar stop button, and clicking it instantly interrupts the query, without any crash.
when I connect to a PostgreSQL database using the RPostgres package I can also interrupt the query at any time.
These two points lead me to think that there should be a way to solve my problem. What can I do?
So far my workaround is:
library(RODBC)
library(R.utils)
withTimeout(mydf <- sqlQuery(myconnection, myquery), timeout=120)
Note: I don't have permission to kill queries from the database side.
I've just stumbled upon the odbc package. It allows to interrupt a query at any time.
Basic usage goes like this:
library(DBI)
myconnection <- dbConnect(odbc::odbc(),
driver = "SQL Server",
server = "my_server_IP_address",
database = "my_DB_name",
uid = "my_user_id",
pwd = "my_password")
dbGetQuery(myconnection, myquery)
I don't have a deep understanding of what happens behind the scenes, but for what I've seen so far in my personal use this package has other advantages over RODBC:
really faster
get the column types from the DB instead of guessing them (see here)
no stringsAsFactors and as.is arguments necessary
Most SQL Server users use SQL Server Management Studio (which is free and can be downloaded from Microsoft) to connect to SQL Server or execute commands from the command line via a tool called SQLCMD.
If you can determine the session id that the SQL Command is being run in you can kill the session which would stop any executing command(s). SQL Server will still need time (could be a 'long' time) to rollback any changes made during the execution of the command.
Terminating a session (depending on the software) can take a while to communicate to SQL Server that the session has been terminated. When I connected to DB2 from SQL Server using linked servers DB2 would buffer the terminate command and it would frequently take up to an hour for DB2 to realize the session had been terminated.
To determine what the session you are running in you can try:
select ##spid;
once you have the spid (lets say 86)
you can then issue (depending on if you have permission to do so)
kill 86;
but as Microsoft notes:
Terminates a user process that is based on the session ID or unit of work (UOW). If the specified session ID or UOW has a lot of work to undo, the KILL statement may take some time to complete, particularly when it involves rolling back a long transaction.
Try to close your "tab query" on SQL Server Management Studio
Then it will appear pop-up,
This Query is currently executing. Do you want to cancel this query ?
Cancel anyway, choose "yes".
try to set your connection prior to query:
sql = odbcConnect('Database name')
Then use same line to run your query:
mydf <- sqlQuery(sql, " myquery ")
Note: The running time is dependant on both database and R server but setting up the connection this way should resolve termination problem.

Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON' - MS SQL Server - possibility of being unable to solve the issue

Why not asking on dba.stackexchange: the description says it is for professionals, which I am not and SO has its "for enthusiasts" part.
I have an error
"Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'"
This is a common error with several possible reasons and solutions. The problem is that I have no knowledge of the database and server administration and credentials authentication topics, thus I will need to spend some significant time understanding what is being said and proposed.
Before I do that I would like to ask if it might be possible for me not to be able to solve the problem due to technical limitations. I will describe the situation in more detail now.
There is an MS SQL Server A with database Adb and table dbo.At. I can read from it. There is also an MS SQL Server B. I can read and write here.
I have MS SQL Server Management Studio 2012 open on my computer. I have a connection with server A open with query "select * from Adb.dbo.At" which works just fine. The connection used Windows Authentication.
I have a connection with server B (Windows Authentication as well) with query "select * from A.Adb.dbo.At" which results in the aforementioned error.
At this point I do have read access to A, I have read and write access to B. I can export data from A and then import it to B using my computer, i.e. I can do a kind of a copy paste and I will end up having what I want. There is no insurmountable wall between these 2 servers with me being the middle man. I simply would like to make it easier. Before I dwell on SPNs, delegations, Kerberos, Active Directory and whatnot I would like to ask if, assuming that I have nothing more than read on A and read/write on B, I might not be able to solve the issue?
It seems I have a "double hop" problem.
https://blogs.technet.microsoft.com/askds/2008/06/13/understanding-kerberos-double-hop/
I have found a workaround. I can use Server Agent on server B. Using this I can use the server to perform some actions, for example query other servers. The Agent jobs are of a specific type (like T-SQL script). For specific job types the Agent can run the jobs in "run as" mode (requires a proxy). I created a proxy referring to my normal Windows login. Sadly T-SQL script type job cannot be executed in "run as" mode. But PowerShell type job can. PowerShell can also execute SQL statements. Thus I have created PowerShell job running with proxy with the command being:
SQLCMD -Q "select * into Bdb.dbo.Bt from A.dbA.dbo.At" -E
This solved my problem.

merge replication - can't create snapshot - timeout - sql server 2008

I have a SQL Server 2008 database, and I need a mergereplication because i want to sync with mobile devices afterwards.
So I created a replication but when it comes to start the snapshotagent, the agent tries to start for about 20 minutes and then it shows the message
The replication agent has not logged a progress message in 10 minutes.
This might indicate an unresponsive agent or high system activity.
Verify that records are being replicated to the destination and that
connections to the Subscriber, Publisher, and Distributor are still
active.
There aren't any other errormessages, neither in the snapshot-agent-status-window nor in the agent-log-window.
I don't have the administrator of the domain, but the local administrator and a domainuser with admin-privilegs. Both have all rights to database, are in the access-list of the replication.
The server agent runs on the local administrator-account and there are 3 MergeReplications on the server, working
The job runs also under the local administrator.
Thank you for your help, Karl
So it works again...
Maybe someone else has got the same issue one day, so i post the solution here:
I researched on the server and found out, the sql server service is running under a local user. The reason for this is, that there were problems with the backupsystem, used by our customers and so they changed it years ago.
Because of the local user account a 15404-Error occures.
Knowing, that i mustn't use domain-accounts, I also solved the initial problem with my snapshot-agent. I searched for hours (nearly days ;) ) and it was just this little change:
When the Replication is created, the job is created too. The job has three steps. The Job-owner is the local-admin, also for the server-agent-service. But the second step of my job (replictionsnapshot) has one setting: run as. And by default this isn't the job-owner but the user running the creation, in my case my domain-account.
Now, that I set it to the local-administrator as well everything works fine again.
Thanks, Karl
I had the same issue, And the below fixed the issue. The replication agent was timing out after 10 minutes and changing the heartbeat from 10 to 30 minutes solved the issue,
Run the below command
exec sp_changedistributor_property #property = 'heartbeat_interval', #value = 30;
and then restart the sql agent on the subscriber to continue syncing.

Resources