Access the Release Notes

Transcription

1 Access the Release Ntes Designed in partnership with majr auditing firms and leading security experts, SQL cmpliance manager prvides a pwerful auditing and cmpliance slutin fr Micrsft SQL Server users. SQL cmpliance manager is a secure, lightweight auditing and reprting slutin fr Micrsft SQL Server designed t meet the needs f enterprise-scale SQL Server implementatins. SQL cmpliance manager prvides unparalleled auditing and reprting services that help yu meet the stringent requirements f tday s internal and external security standards. T get a quick glimpse int the newest features, fixed issues, and knwn issues in this release f SQL cmpliance manager, review the Release Ntes. Learn abut key new features in this release Review issues fixed by this release Review previus features and fixed issues See knwn issues See list f recmmended Idera Slutins 4/3/2012 2:13 PM

2 Get Started Use the fllwing checklist t get started using SQL cmpliance manager. Fr mre infrmatin abut hw t best cnfigure auditing fr yur envirnment, see the Auditing Checklist. Get started with these steps... Learn hw auditing wrks. Learn abut the SQL Server events that can be audited. Register the SQL Server instances yu want t audit, and set yur server and database settings. Track the cllected SQL Server events ver time and fine tune yur audit settings as needed. Cnfigure Event Alerts t ntify yu when suspicius events ccur in yur envirnment. Cnfigure Status Alerts t ntify yu when SQL cmpliance manager experiences an issue.

3 Upgrade t this build Yu can quickly and easily upgrade t SQL cmpliance manager versin 3.7 frm versin 2.0 r later. Upgrading SQL cmpliance manager allws yu t take advantage f the new features available in versin 3.7. Upgrade checklist Fllw these steps... Ensure the cmputers n which yu want t upgrade SQL cmpliance manager meet r exceed the hardware, sftware, and permissins requirements fr versin 3.7. Fr example, ensure.net Framewrk 2.0 SP1 r later is running n the target cmputer. Ensure yur Windws lgn accunt has lcal administratr permissins n the cmputers yu intend t upgrade. Clse all pen applicatins n the cmputers running the SQL cmpliance manager cmpnents. Upgrade yur SQL cmpliance manager Repsitry, Cllectin Server, and Cnsle. When prmpted, schedule a time fr SQL cmpliance manager t perfrm maintenance n yur Repsitry databases. Ensure yur prduct license is current. If yu are upgrading frm versin 2.1 r earlier, yu will need t upgrade yur license key. Upgrade yur previusly deplyed SQLcmpliance Agents. Ensure yur upgrade includes any new reprts by redeplying the SQL cmpliance manager Reprts. If yu are upgrading frm versin 3.0 r earlier and yu use Micrsft Reprting Services, yu must redeply the SQL cmpliance manager Reprts in rder t generate reprts using the upgraded Repsitry databases as the data surce. Test yur upgrade by cllecting and reprting n yur audit data.

4 Upgrade the prduct cmpnents Yu can use the setup prgram t upgrade all cmpnents r any individual cmpnent. The setup prgram detects whether SQL cmpliance manager cmpnents are running r installed n the lcal cmputer. The setup prgram autmatically upgrades the Management Cnsle, the Cllectin Server, and the SQLcmpliance Agent accrding t yur implementatin. If yu plan t audit instances running SQL Server 2005 r SQL Server 2008, install the Cllectin Server n a cmputer hsting a SQL Server 2005 r SQL Server 2008 instance. Fr example, t accept event data frm audited instances running SQL Server 2005, the Repsitry databases must reside n a SQL Server 2005 instance. T upgrade SQL cmpliance manager: 1. Lg n with an administratr accunt t the cmputer n which yu want t upgrade the Cllectin Server. 2. Run SETUP.EXE in the rt f the installatin kit. 3. Click INSTALL n the Setup tab f the setup prgram. 4. On Install windw, click SQL cmpliance manager. 5. On the Idera SQL cmpliance manager dialg, click Yes t start the upgrade prcess. 6. On the Upgrade Wizard fr Idera SQL cmpliance manager windw, click Next. 7. On the Repsitry Hst windw, select the authenticatin type and enter the SQL credentials, if necessary, and then click Next. 8. On the Setup Wizard Cmpleted windw, click Finish t end the upgrade prcess. 9. Start the Management Cnsle. When prmpted, schedule a time fr SQL cmpliance manager t perfrm maintenance n yur Repsitry databases. 10. Upgrade yur SQLcmpliance Agents.

5 Upgrade yur prduct license key SQL cmpliance manager versin 3.0 and later uses a new license key. If yu are upgrading frm versin 2.1 r 2.0, yu will need t update yur existing prduct license key within 45 days f upgrading t versin 3.7. T request a new license, cntact licensing@idera.cm.

6 Upgrade yur deplyed SQLcmpliance Agents Befre upgrading yur SQLcmpliance Agents, review the permissins requirements and hw the SQLcmpliance Agent wrks. TIP If yu manually installed the SQLcmpliance Agent n the audited SQL Server cmputer, use the setup prgram t upgrade the agent lcally. Upgrade an agent deplyed t a remte server Yu can upgrade the SQLcmpliance Agent remtely using the Management Cnsle. Use this apprach t upgrade agents n any registered SQL Server where yu remtely installed the agent. T upgrade a remte SQLcmpliance Agent: 1. In the Navigatin pane, click Administratin, and then select Registered SQL Servers in the Administratin tree. 2. In the view pane, right-click the SQL Server instance fr which yu want t upgrade the SQLcmpliance Agent. 3. Select Upgrade Agent frm the cntext menu. Upgrade an agent lcally Yu can use the SQL cmpliance manager setup prgram t upgrade the SQLcmpliance Agent n the lcal cmputer that is running the registered SQL Server instance. Use this apprach when yu are upgrading the SQLcmpliance Agent n a registered SQL Server where yu manually installed the agent. Upgrade an agent in a clustered envirnment Yu can easily upgrade a SQLcmpliance Agent fr a SQL Server instance lcated in a Windws cluster by running the setup prgram. Perfrm the fllwing steps n each nde (cmputer) f the cluster. TIP When yu upgrade the SQLcmpliance Agent, the assciated CLI trigger is deleted and recreated. This update can take several minutes. During this time, the SQLcmpliance Agent status will shw that it is unavailable due t a CLR errr. Use the Activity Lg t track when the new CLI trigger install cmpletes. T upgrade an agent n a cluster nde: 1. Lg n with an administratr accunt t the cluster nde. Start with the currently active nde. 2. Bring the SQLcmpliance Agent generic service fr this SQL Server resurce grup ffline. 3. Run SETUP.EXE in the rt f the installatin kit. 4. Click INSTALL n the Setup tab f the setup prgram. 5. On the Install windw, click Cluster Cnfiguratin Cnsle. 6. On the Idera SQL cmpliance manager Cluster Cnfiguratin dialg, click Yes t start the upgrade prcess, and then Next t cntinue. After the upgrade cmpletes, the Cluster Cnfiguratin Cnsle autmatically starts. 7. When prmpted, specify the directry lcatin yu want SQL cmpliance manager t use t stre CLR trigger assemblies. 8. Bring the SQLcmpliance Agent generic service nline.

7 What is SQL cmpliance manager? Designed in partnership with majr auditing firms and leading security experts, SQL cmpliance manager prvides a pwerful auditing and cmpliance slutin fr Micrsft SQL Server users. SQL cmpliance manager is a secure, lightweight auditing and reprting slutin fr Micrsft SQL Server designed t meet the needs f enterprise-scale SQL Server implementatins. SQL cmpliance manager prvides unparalleled auditing and reprting services that help yu meet the stringent requirements f tday s internal and external security standards. SQL cmpliance manager prvides many critical features: Lw verhead data cllectin Central Repsitry f audit data Central Management Cnsle Pre-defined cmpliance reprts Secure ad-hc queries fr auditrs Reprting and frensic analysis Efficient, secure data archival SQL cmpliance manager is the nly slutin that lets yu quickly, easily, and securely answer the demands f n-the-spt reprts, rutine audits, and lng-term event trending acrss yur SQL Server envirnment.

8 Hw des SQL cmpliance manager help me? As a database administratr, yu need a cmprehensive and easy-t-use auditing and reprting slutin that helps ensure cntinuus cmpliance while prtecting the integrity f yur audit data and SQL Server envirnment. SQL cmpliance manager has been specifically designed t meet these requirements. SQL cmpliance manager helps yu meet multiple gals, whether yu are fulfilling the requirements f internal auditrs r simply need t feel cmfrtable with yur database security mdel. Ensure cntinuus cmpliance SQL cmpliance manager ges beynd traditinal auditing appraches by prviding mnitring and auditing f all data access, updates, data structure mdificatins, and changes t security permissins. The audit data captured is stred in a central Repsitry fr reprting, querying, and analysis. Yu can easily cnfigure SQL cmpliance manager t audit nly the events yu need t track. This flexibility ensures yu have a cntinuus stream f audit data t ensure cntinual cmpliance with internal and external security standards. Achieve lw verhead data cllectin SQL cmpliance manager emplys an efficient, lw verhead data cllectin technlgy. A llght agent mnitrs the SQL Server trace data stream, cllects the audit data, and sends it back t the Repsitry. Yu can cnfigure the type and detail f audit data yu want t cllect n an individual SQL Server instance r database. N changes t applicatins r prductin databases are required. Leverage pwerful reprting and analytics SQL cmpliance manager is the nly slutin that prvides secure and cmprehensive reprting n and analysis f yur audit data. SQL cmpliance manager prvides many pre-defined reprts that yu can immediately use t track audited events. SQL cmpliance manager als leverages the flexibility and pwer f Micrsft SQL Server Reprting Services (Reprting Services). Thrugh Reprting Services, yu can mdify the pre-defined reprts r create custm reprts that meet yur specific auditing needs. Prtect integrity f audited data SQL cmpliance manager leverages yur existing SQL Server security mdel t enfrce data access. Yu can easily and securely cntrl wh has the ability t cnfigure, view, r reprt n audit data. SQL cmpliance manager integrates with and cnfrms t yur internal security plicies, allwing granular access cntrl at the database level. SQL cmpliance manager has been engineered t prvide a trusted, immutable surce f audit data. Its pwerful self-auditing features ensure that yu are alerted t any changes t data cllectin settings r attempts t tamper with the audit data repsitry. Realize rapid deplyment and scalability With DynamicDeplyment technlgy, a light agent is dynamically deplyed t the specific SQL Server instances yu want t audit. This apprach enables yu t cnfigure and deply SQL cmpliance manager in minutes. There is n need t perfrm timecnsuming sftware installs n each target server. The agent eliminates risk and increases perfrmance by running as a separate prcess utside the SQL Server prcess space. SQL cmpliance manager has been specifically designed t supprt large SQL Server installatins. SQL cmpliance manager scales frm auditing a single SQL Server instance t thusands f SQL servers arund the glbe, frm databases with nly a few tables t databases with thusands f tables and large vlumes f data.

9 Find answers using this dcumentatin This dcumentatin set includes a cmprehensive nline Help system as well as additinal resurces that supprt yu as yu install and use the prduct. Yu can als search Idera Slutins, available at the Idera custmer service prtal (

10 Dcument cnventins Idera dcumentatin uses cnsistent cnventins t help yu identify items thrughut the printed nline library. Cnventin Bld Italics Fixed Fnt Straight brackets, as in [value] Curly braces, as in [value] Lgical OR, as in value 1 value 2 Specifies Windw items Bk and CD titles Variable names New terms File and directry names Cmmands and cde examples Text typed by yu Optinal cmmand parameters Required cmmand parameters Exclusively cmmand parameters where nly ne f the ptins can be specified

11 Use the help system This Help system can be accessed either thrugh the Start menu, thrugh the Help menu n the Management Cnsle, r by pressing F1 n yur keybard while n the windw fr which yu wuld like mre infrmatin. TIP The nline Help requires Internet Explrer versin 7.0 r later.

12 Abut Idera At Idera, we deliver a new generatin f tls fr managing, administering, and securing yur Micrsft Windws Servers, including SQL Server, SharePint, PwerShell and Micrsft Dynamics. We emply numerus industry experts wrldwide wh are devted t bringing prven slutins t yu, the administratr. Idera prvides slutins that help yu ensure server perfrmance and availability and reduce administrative verhead and expense. Our award-winning prducts install in minutes, cnfigure in hurs and deply wrldwide in days. Idera is a Micrsft Gld Certified Partner headquartered in Hustn, Texas, with ffices in Lndn, UK, Melburne, Australia, and Sa Paul, Brazil.

13 Cntacting Idera Please cntact us with yur questins and cmments. We lk frward t hearing frm yu. Fr supprt arund the wrld, please cntact us r yur lcal partner. Fr a cmplete list f ur partners, please see ur Website. Sales GO.IDERA ( ) (nly in the United States and Canada) Sales sales@idera.cm Supprt Website GO.IDERA ( ) (nly in the United States and Canada)

14 Idera prducts Our tls are engineered t scale - frm managing a single server t enterprise deplyments with thusands f servers. Idera prducts cmbine ease f use with a design that installs in minutes, cnfigure in hurs, and deply wrldwide in days. T learn mre abut Idera prducts, visit

15 Legal ntice Idera, Inc., DTx, IntelliCmpress, Pint admin tlset, Pintbackup, Pintcheck, PwerShellPlus, SharePint enterprise manager, SharePint security manager, SharePint diagnstic manager, SharePint backup, SharePint perfrmance mnitr, SQLcheck, SQL change manager, SQLcnfig, SQL cmparisn tlset, SQL cmpliance manager, SQLcmpliance, SQLcm, SQL defrag manager, SQL diagnstic manager, SQLdm, SQL mbile manager, SQLpermissins, SQLsafe, SQLsafe Freeware Editin, SQLsafe Lite, SQLscaler, SQLschedule, SQL schema manager, SQLsecure, SQLsmarts, SQLstats, SQLtl, SQL tlbx, SQL virtual database, SQLvdb, virtual database, Idera, BBS Technlgies and the Idera lg are trademarks r registered trademarks f Idera, Inc., r its subsidiaries in the United States and ther jurisdictins. All ther cmpany and prduct names may be trademarks r registered trademarks f their respective cmpanies Idera, Inc., all rights reserved. THIS DOCUMENT AND THE SOFTWARE DESCRIBED IN THIS DOCUMENT ARE FURNISHED UNDER AND ARE SUB- JECT TO THE TERMS OF A LICENSE AGREEMENT. EXCEPT AS EXPRESSLY SET FORTH IN SUCH LICENSE AGREE- MENT, IDERA, INC., PROVIDES THIS DOCUMENT AND THE SOFTWARE DESCRIBED IN THIS DOCUMENT "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SOME STATES DO NOT ALLOW DISCLAIMERS OF EXPRESS OR IMPLIED WARRANTIES IN CERTAIN TRANSACTIONS; THEREFORE, THIS STATEMENT MAY NOT APPLY TO YOU. YOU ARE ENCOURAGED TO READ THE LICENSE AGREEMENT BEFORE INSTALLING OR USING THIS DOCUMENTATION OR SOFTWARE. Sme cmpanies, names, and data in this dcument are used fr illustratin purpses and may nt represent real cmpanies, individuals, r data. This dcument culd include technical inaccuracies r typgraphical errrs. Changes are peridically made t the infrmatin herein. These changes may be incrprated in new editins f this dcument. Idera, Inc., may make imprvements in r changes t the sftware described in this dcument at any time Idera, Inc., all rights reserved. U.S. Gvernment Restricted Rights: The sftware and the dcumentatin are cmmercial cmputer sftware and dcumentatin develped at private expense. Use, duplicatin, r disclsure by the Gvernment is subject t the terms f the Idera, Inc., standard cmmercial license fr the sftware, and where applicable, the restrictins set frth in the Rights in Technical Data and Cmputer Sftware clauses and any successr rules r regulatins.

16 Installatin and deplyment Installing SQL cmpliance manager is bth quick and easy, allwing yu t take immediate advantage f SQL cmpliance manager auditing technlgies. Use the fllwing checklist t help yu prepare yur envirnment t successfully install and deply SQL cmpliance manager. Fllw these steps... Ensure the cmputer n which yu want t install SQL cmpliance manager meets r exceeds the hardware requirements. Fr mre infrmatin, see Hardware Requirements. Ensure the cmputer n which yu want t install SQL cmpliance manager meets r exceeds the sftware requirements. Fr mre infrmatin, see Sftware Requirements. Ensure yur Windws lgn accunt has administratr permissins n the cmputers where yu want t install SQL cmpliance manager cmpnents. Review the supprted installatin scenaris t understand hw t set up SQL cmpliance manager in yur envirnment. Fr mre infrmatin, see Implementatin Scenaris. Identify the Windws accunt under which the SQLcmpliance Agent shuld run. Accunt Name: Passwrd: Fr mre infrmatin, see Permissin Requirements. Identify the Windws accunt under which the Cllectin Server shuld run. Accunt Name: Passwrd: Fr mre infrmatin, see Permissin Requirements. Ensure yu understand hw licensing f yur SQL Server instances wrks with SQL cmpliance manager. Fr mre infrmatin, see Hw Licensing Wrks. Ensure yu install SQL cmpliance manager as instructed. Fr mre infrmatin, see Installing SQL cmpliance manager. If yu are installing SQL cmpliance manager n a Windws cluster, see Hw t Audit a Virtual SQL Server Instance.

17 Prduct cmpnents and architecture SQL cmpliance manager cnsists f a light, unbtrusive architecture that easily runs in yur SQL Server envirnment with minimal cnfiguratin. All SQL cmpliance manager cmpnents run utside and separate frm SQL Server prcesses. SQL cmpliance manager des nt add t r mdify any f yur native SQL Server files r services. Architecture SQL cmpliance manager prvides a rbust, easy-t-use SQL Server audit and reprting slutin. Behind a friendly user interface, SQL cmpliance manager ffers a unique, lsely cupled architecture that is bth flexible and extremely pwerful. SQL cmpliance manager fits yur envirnment, n matter hw simple r cmplex. The fllwing diagram illustrates the cmpnents f the SQL cmpliance manager architecture. Management Cnsle The Management Cnsle is a centralized, intuitive user interface that allws yu t easily and quickly mdify audit settings, mnitr events, and reprt n audit data. This user interface als prvides the fllwing infrmatin: Real-time status f audited SQL Server instances SQL Server lgin permissins Detailed lgging f change activity Track and prve cntinual cmpliance using reprts Repsitry databases The SQL cmpliance manager Repsitry (Repsitry) is the central repsitry that tracks:

18 SQLcmpliance cnfiguratins, such as audit settings, server registratins, and cnsle security Audited SQL Server events Alert messages SQLcmpliance Agent activity The Repsitry cnsists f the fllwing databases. Fr mre infrmatin, see Hw auditing wrks. Repsitry Database Name SQLcmpliance SQLcmpliance.Prcessing SQLcmpliance.Instance SQLcmpliance.Instance_Time_ Partitin Descriptin Stres alert messages, audit settings, SQLcmpliance Agent events, Activity Reprt Card statistics, and ther SQL cmpliance manager cnfiguratins Stres event data that was received frm the SQLcmpliance Agent and is being prcessed Stres prcessed events cllected frm a registered instance Stres archived events cllected frm a registered instance Cllectin Server The Cllectin Server prcesses trace files received frm the SQLcmpliance Agent, stres audit data in the events and archive databases, and sends audit setting updates t the SQLcmpliance Agent. The Cllectin Server runs under the Cllectin Service accunt. By default, the Cllectin Server cmmunicates with the Repsitry every 5 minutes (heartbeat) t write prcessed audit data t the event databases assciated with the registered SQL Server instances. SQLcmpliance Agent The SQLcmpliance Agent gathers SQL Server events written t the SQL trace, caching these audited events in trace files. By default, the SQLcmpliance Agent calls the Cllectin Server every 5 minutes (heartbeat) t receive audit setting updates, and sends trace files fr prcessing every 2 minutes. The SQLcmpliance Agent runs under the SQLcmpliance Agent Service accunt. Fr mre infrmatin, see Hw the SQLcmpliance Agent wrks. Cmmand line interface The cmmand line interface (CLI) prvides an interface fr third-party tls s yu can autmate and schedule regular tasks, such as audit data archival and grming, and perfrm diagnstic tasks. Yu can als perfrm integrity checks thrugh the CLI. The CLI supprts the fllwing peratins. CLI Operatins agentsettings archive checkintegrity grm Descriptin Lists the settings fr the SQLcmpliance Agent running n a specific SQL Server instance Archives audited events cllected fr registered SQL Server instances Verifies the integrity f audited events cllected fr a specific registered SQL Server instance Deletes audited events lder than a specified age

19 CLI Operatins help serversettings timeznes updateindex Descriptin Displays the CLI Help Lists the settings fr the Cllectin Server Displays the time znes recgnized by the cmputer hsting the Cllectin Server Applies ptimized Repsitry index cnfiguratins t existing events and archive databases Fr mre infrmatin abut these peratins, see the CLI Help. Access the CLI Help using the cmmand SQLcmCmd help [peratin]. Trace files and the trace directry Trace files cntain audited SQL Server events cllected by the SQLcmpliance Agent. The SQLcmpliance Agent stres these temprary files in a secure directry n the audited SQL Server instance. When the set directry size threshld is reached, the SQLcmpliance Agent stps the SQL trace until the trace files are sent t the Cllectin Server fr prcessing. When the set file size threshld is met, the trace file is cycled. Yu can cnfigure the SQLcmpliance Agent trace file directry lcatin as well as hw the SQLcmpliance Agent manages these files, such as hw ften the agent sends trace files t the Cllectin Server. Fr mre infrmatin, see Hw the SQLcmpliance Agent wrks.

20 Hardware requirements The fllwing sectins prvide the hardware requirements fr each SQL cmpliance manager cmpnent. Fr mre infrmatin, see Prduct cmpnents and architecture. Audited SQL Server The audited SQL Server cmputer is the cmputer that hsts the SQL Server databases yu want t audit. In a clustered envirnment with virtual SQL Servers, the audited SQL Server is the virtual SQL Server. Hwever, each nde (physical cmputer) in the cluster that hsts the virtual SQL Server must meet r exceed these requirements. T achieve ptimal perfrmance, ensure each SQL Server cmputer meets r exceeds the fllwing hardware requirements. Hardware Type CPU Memry Hard Disk Space Requirement 1 GHz 512 MB 2 GB Cllectin Server The Cllectin Server cmputer is the cmputer that hsts the Cllectin Service and prcesses trace files. This cmputer als hsts the Repsitry databases. T achieve ptimal auditing perfrmance and data strage, ensure the Cllectin Server cmputer meets r exceeds the fllwing hardware requirements. Hardware Type CPU Memry Hard Disk Space Requirement 2 GHz 2 GB 30 GB fr Repsitry Management Cnsle The Cnsle cmputer is the cmputer that hsts the SQL cmpliance manager Management Cnsle. Yu can install the cnsle n the Cllectin Server cmputer, r any client cmputer fr remte access t yur audit data. Ensure each cnsle cmputer meets r exceeds the fllwing hardware requirements. Hardware Type CPU Memry 10 GB fr trace directry Requirement 300 MHz 128 MB

21 Hardware Type Hard Disk Space Requirement 58 MB

22 Permissins requirements SQL cmpliance manager requires specific permissins and rights t successfully audit events. By default, the setup prgram assigns the Cllectin Service and SQLcmpliance Agent Service accunts read and write permissins n the respective trace directry. Management Cnsle user permissins Actins Administer SQL cmpliance manager and cnfigure audit settings Generate and view audit reprts Deply SQLcmpliance Agent t registered SQL Server instance Cnnect t the SQL Server that hsts the Repsitry databases Permissins Requirements sysadmin rights n the Repsitry databases Read permissins (public rights) n the Repsitry databases Administratr permissins n the cmputer hsting the target instance SQL Server lgin Operating system permissins Actins Stre audit settings and manage archive databases in the Repsitry Prcess trace files Manage trace directry Run as a service Permissins Requirements sysadmin rights n each Repsitry database Read, write, and delete permissins n the Cllectin Server trace directry Lcal Administratr permissins n the cmputer that hsts the Cllectin Service Lg n as a Service right n the cmputer that is running the audited SQL Server instance SQL cmpliance Agent service permissins Actins Starting and stpping traces, and managing SQLcmpliance stred prcedures Manage trace files Manage trace directry fr an audited SQL Server instance Manage trace directry fr an audited virtual SQL Server Run as a service Permissins Requirements sysadmin rights n the audited SQL Server instance r database Read, write, and delete permissins n the SQLcmpliance Agent trace directry Lcal Administratr permissins n the cmputer that hsts the registered SQL Server Administratr permissins n each nde in the cluster hsting the virtual SQL Server Lg n as a Service right n the cmputer that is running the audited SQL Server instance

23 SQL Server service permissins n the Cllectin Server Actins Lad trace files s the Cllectin Server can prcess these events Permissins Requirements Read permissins n the Cllectin Server trace directry SQL Server service permissins n the registered SQL Server Actins Write events t trace files fr the registered SQL Server instance and audited databases Permissins Requirements Write permissins n the SQLcmpliance Agent trace directry Using Windws Authenticatin The SQL cmpliance manager cnsle and agent require Windws authenticatin. Windws authenticatin uses the lgged n user accunt t establish trusted cnnectins thrugh the perating system. The credentials f the lgged n user accunt are passed t the SQL Server database servers. Yur database server then verifies the user matches an established SQL Server lgin accunt that has the apprpriate permissins. Only after verificatin will a cnnectin pen. When using Windws authenticatin, the accunt lgged n t the Management Cnsle cmputer must have the apprpriate SQL cmpliance manager permissins. Using SQL Server Authenticatin The SQLcmpliance Cllectin Service leverages existing SQL Server lgins that have been granted the apprpriate SQL privileges. Hwever, SQL cmpliance manager des nt supprt SQL Server authenticatin.

24 Prt requirements T ensure the SQLcmpliance Agent and Cllectin Server can successfully audit instances in yur envirnment, pen the fllwing prts. Fr mre infrmatin, see Implementatin Scenaris. Envirnment Type Prt Requirements Typical Prt 5201 n the Cllectin Server cmputer Prt 5200 n each cmputer hsting an audited SQL Server instance Clustered Prt 5201 n the Cllectin Server cmputer Prt 5200 n each cluster nde hsting a virtual SQL Server yu want t audit Nn-trusted Prt 5201 n the Cllectin Server cmputer Prt 5200 n each cmputer hsting an audited SQL Server instance in a nn-trusted dmain r wrkgrup

25 Sftware requirements The fllwing sectins prvide the sftware requirements fr each SQL cmpliance manager cmpnent. Fr mre infrmatin, see Prduct cmpnents and architecture. Supprt fr MS SQL Server sftware includes case-sensitive servers and databases. Supprt fr Windws perating systems includes English and internatinal versins. All SQL cmpliance manager cmpnents require.net 2.0 r later. If an perating system service pack is nt mentined, a service pack is nt required fr that versin f the perating system. TIPS Idera is beginning t phase ut all Itanium supprt in SQL cmpliance manager 3.5 and all subsequent 3.x versins. While 3.x will cntinue t perate with Itanium and supprt is available thrugh Nvember 2012, SQL cmpliance manager 4.0 will nt supprt the Itanium prcessr architecture. SQL cmpliance manager 3.7 is SQL Server 2012 RTM cmpatible. This versin f SQL cmpliance manager is nt certified against newer builds f SQL Server and shuld nt be used with these builds in a prductin envirnment. Idera prvides experimental supprt while yu use yur installatin in a testing envirnment t ensure the features yu rely n mst are wrking as, r better than, expected. Des SQL cmpliance manager supprt Windws clusters? Yes. Yu can install SQL cmpliance manager n a Windws 2003 r 2008 cluster. Fr mre infrmatin, review the supprted installatin scenaris and Hw t Audit a Virtual SQL Server Instance. Audited SQL Server The audited SQL Server cmputer shuld meet r exceed the sftware requirements recmmended by Micrsft t run and manage SQL Server databases. In a clustered envirnment with virtual SQL Servers, the audited SQL Server is the virtual SQL Server. Hwever, each nde (physical cmputer) in the cluster that hsts the virtual SQL Server must meet r exceed these requirements. SQL cmpliance manager supprts auditing the fllwing Micrsft SQL Server versins. SQL Server Versin MS SQL Server 2012 RTM Operating System Windws Server 2008 SP2 MS SQL Server 2008 R2 Standard and Enterprise Editins Windws Server 2008 R2, Windws Server 2008 MS SQL Server 2008 Standard and Enterprise Editins Windws Server 2008, Windws Server 2003, r Windws 2000 Server SP4 r later MS SQL Server 2005 Standard and Enterprise Editins Windws Server 2003 r Windws 2000 Server SP4 r later MS SQL Server 2000 Standard Editin SP3a r later Windws Server 2003 MS SQL Server 2000 Standard Editin SP2 r later MS SQL Server 2000 Enterprise Editin Windws 2000 Server SP4 r later Windws 2000 Server SP4 r later Cllectin Server Ensure each Cllectin Server cmputer meets r exceeds the fllwing sftware requirements. The Cllectin Server hsts the

26 Cllectin Service and the Repsitry databases, which stre SQL cmpliance manager cnfiguratin and audit data. If yu plan t audit instances running SQL Server 2005 r later, install the Cllectin Server n a cmputer hsting the highest versin f SQL Server running in yur envirnment. Fr example, t accept event data frm audited instances running SQL Server 2012, the Repsitry databases must reside n a SQL Server 2012 instance. Sftware Type Operating System Micrsft SQL Server Requirement The Cllectin Server requires ne f the fllwing perating systems: Windws 2000 Server SP4 r later Windws Server 2003 Windws Server 2008 Windws Server 2008 R2 The Cllectin Server requires ne f the fllwing versins f Micrsft SQL Server: MS SQL Server 2012 RTM MS SQL Server 2008 R2 Standard and Enterprise Editins MS SQL Server 2008 Standard and Enterprise Editins MS SQL Server 2005 Standard and Enterprise Editins MS SQL Server 2000 Standard Editin SP3a r later n Windws Server 2003 MS SQL Server 2000 Standard Editin SP3a r later n Windws 2000 Server MS SQL Server 2000 Enterprise Editin Management Cnsle Ensure each cnsle cmputer meets r exceeds the fllwing sftware requirements. Yu can install the cnsle n the Cllectin Server cmputer, r any client cmputer fr remte access t yur audit data. Sftware Type Requirement The Cllectin Server requires ne f the fllwing perating systems: Windws Server 2008 R2 Windws Server 2008 Windws Server 2003 Windws 2000 Server SP4 r later Windws 2000 Prfessinal SP4 r later Windws XP Prfessinal Windws Vista Windws 7 The Management Cnsle cmputer als requires Micrsft Data Access Cmpnents (MDAC) 2.6 r later. If yu plan t audit SQL Server 2005 instances, upgrade t MDAC 2.8 r later. SQL Server 2005 requires MDAC 2.8 t cmmunicate with ther applicatins. Operating System Dcumentatin Internet Explrer 7.0 r later

27 Supprted installatin scenaris Yu can install and deply SQL cmpliance manager t meet yur unique auditing and SQL Server envirnment needs. Fr example, yu can select which specific databases n yur SQL Server instances yu want t audit. Typical envirnment The fllwing figure illustrates a typical SQL cmpliance manager implementatin scenari. This cnfiguratin includes the fllwing installatins: Management Cnsle n yur wrkstatin (and, ptinally, the Cllectin Server cmputer) Cllectin Service and Repsitry n a SQL Server database server SQLcmpliance Agents n each cmputer hsting databases yu want t audit Clustered envirnment Yu can install and cnfigure SQL cmpliance manager t audit virtual SQL Servers. A virtual SQL Server is a SQL Server running n a Micrsft failver cluster managed by Micrsft Cluster Services. This cnfiguratin includes the fllwing installatins: Management Cnsle n yur wrkstatin Cllectin Service and Repsitry n a SQL Server Database Server SQLcmpliance Agents n each cluster nde hsting the virtual SQL Server yu want t audit Fr mre infrmatin, see Hw t Audit a Virtual SQL Server Instance. Nn-trusted envirnment Yu can install and cnfigure SQL cmpliance manager t audit SQL Server instances running in nn-trusted dmains r wrkgrups. This cnfiguratin includes the fllwing installatins: Management Cnsle n yur wrkstatin Cllectin Service and Repsitry n a SQL Server database server SQLcmpliance Agents n each SQL Server instance yu want t audit in a nn-trusted dmain r wrkgrup

28 Hw t install SQL cmpliance manager Befre installing SQL cmpliance manager, cnsider the fllwing best-practices: Ensure yu review the hardware, sftware, permissins, and prt requirements. Decide whether yu shuld install the Cllectin Server n a dedicated SQL Server instance. If yu plan t audit instances running SQL Server 2005 r later, install the Cllectin Server n a cmputer hsting the highest versin f SQL Server running in yur envirnment. Fr example, t accept event data frm audited instances running SQL Server 2012, the Repsitry databases must reside n a SQL Server 2012 instance. By default, SQL cmpliance manager installs with a trial license. Fr mre infrmatin abut trial licenses r upgrading yur license, see Licensing. T install SQL cmpliance manager: 1. Lg n with an administratr accunt t the cmputer n which yu want t install SQL cmpliance manager. 2. Run SETUP.EXE in the rt f the installatin kit. 3. On the Welcme t SQL cmpliance manager windw, click INSTALL. 4. On the Install windw, click SQL cmpliance manager t begin the installatin prcess. 5. On the Welcme t the Setup Wizard fr Idera SQL cmpliance manager windw, click Next. 6. Read the Trial Sftware License Agreement, select I accept the terms in the license agreement and click Next t cntinue. 7. Accept the default flder fr yur SQL cmpliance manager installatin, r click Brwse t specify a different flder. 8. Select whether yu want the SQL cmpliance manager applicatin t be available t all users wh lg n this cmputers, and then click Next. If yu select this ptin Anyne wh uses this cmputer Only fr me Setup cnfigures the user lgn prfile t Display icn n desktp when anyne lgs nt this cmputer using a valid dmain user accunt Display icn n desktp nly when the current user accunt lgs nt this cmputer 9. Select the apprpriate setup type, and then click Next. Setup Type Typical Cnsle Only Agent Only Custm Descriptin Allws yu t install all SQL cmpliance manager cmpnents n this cmputer Allws yu t install nly the SQLcmpliance Management Cnsle Allws yu t install nly the SQLcmpliance Agent Allws yu t select the individual SQL cmpliance manager cmpnents yu want t install

29 10. If yu chse the Custm type, select ne r mre SQL cmpliance manager cmpnent, and then click Next. Using the Custm setup type, yu can install SQL cmpliance manager cmpnents in the fllwing ways: Cllectin Server and Repsitry with SQLcmpliance Agent Cllectin Server and Repsitry Management Cnsle with SQLcmpliance Agent Management Cnsle nly SQLcmpliance Agent nly The setup prgram installs the Repsitry when yu install the Cllectin Server. T install all SQL cmpliance manager cmpnents at the same time, use the Typical setup type. 11. If yu chse t install the Cllectin Server and SQLcmpliance Agent using the Typical r Custm setup, cmplete the fllwing prcedure: a. Specify the lcatin where the Cllectin Server shuld stre audit data received frm the SQLcmpliance Agent, and then click Next. The specified flder will be the trace file directry n the Cllectin Server. b. Specify the Windws user accunt the Cllectin service and SQLcmpliance Agent service shuld run as t access the Repsitry, and then click Next. c. Click Brwse t select the SQL Server instance n which yu want t install the Repsitry. The setup prgram creates the Repsitry databases n the specified instance. d. Specify the authenticatin the setup prgram shuld use t cnnect t the selected SQL Server and create the Repsitry, and then click Next. e. If yu want t audit the Repsitry r ther databases assciated with the selected SQL Server instance, click Yes, and then click Next. f. Specify the lcatin where the SQLcmpliance Agent shuld stre cllected audit data, and then click Next. The specified flder will be the trace file directry n the audited SQL Server instance. g. Select whether yu want t start the services immediately after install, and then click Next. 12. If yu chse the Agent Only setup, cmplete the fllwing prcedure: 13. Click Install. a. Specify the lcatin where the SQLcmpliance Agent shuld stre cllected audit data, and then click Next. The specified flder will be the trace file directry n the audited SQL Server instance. b. Specify the Windws user accunt the SQLcmpliance Agent service shuld run as t access databases assciated with the audited SQL Server instance, and then click Next. If yu are installing the agent n a cmputer that belngs t a wrkgrup r nn-trusted dmain, specify a valid lcal accunt (MyCmputer\AccuntName). c. Type the name f the cmputer n which the Cllectin Server is installed, and then click Next. If yu are installing the SQLcmpliance Agent n a wrkstatin r a cmputer that belngs t a nn-trusted dmain, the setup prgram will be unable t validate a cnnectin t the specified cmputer. Click N when prmpted t specify anther Cllectin Server cmputer. d. Click Brwse t select the SQL Server instance yu want t audit, specify the authenticatin the SQLcmpliance Agent shuld use t cnnect t assciated databases, and then click Next. e. Select whether yu want t start the SQLcmpliance Agent service immediately after install, and then click Next. 14. Click Finish. If yu chse a typical setup, select Launch Idera SQL cmpliance manager t begin auditing yur SQL Server envirnment.

30 Cnfigure yur deplyment After yur initial installatin and set up, yu may want t perfrm the fllwing tasks t further custmize and streamline yur deplyment. Identify audit data vlume Exprt audit settings Manage the SQLcmpliance Agent Optimize mdel settings Optimize tempdb settings Preserve audit data using archives Register yur SQL Server instances

31 Check the prduct versin Yu can check the prduct versin at any time. The prduct versin cnsists f the release number and build number assigned t SQL cmpliance manager. T check the prduct versin: 1. Start SQL cmpliance manager. 2. On the Help menu, click Abut SQL cmpliance manager. 3. Click OK.

32 Check the SQL Server versin Yu can quickly check the versin f a SQL Server instance yu are auditing. T check the SQL Server versin: 1. Navigate t Registered SQL Servers in the Administratin tree. 2. Right-click the SQL Server instance yu want t check, and then select Prperties. 3. On the General tab, review the SQL Server versin number, and then click OK. Fr mre detailed infrmatin t help trublesht an issue, use the native SQL Server Tls t check yur SQL Server instance cnfiguratin settings.

33 Deplyment cnsideratins Befre implementing SQL cmpliance manager, review the fllwing guidelines t ensure ptimal perfrmance, security, and disaster recvery. Fr example, if yu anticipate cllecting large numbers f events (several hundred thusand r mre) in a shrt time perid, cnsider incrprating ne r mre f these guidelines in yur SQL cmpliance manager deplyment.

34 Identify audit data vlume Estimate the amunt f audit data yur cmpliance needs may generate, and ensure the Cllectin Server cmputer has ample memry and database space. Cnsider the fllwing examples: A data set f ne millin events may require 1 GB f database space t stre the audit data A trace file that is 5 MB may require 100 MB f memry t prcess the cllected events The amunt f audit data yu cllect and prcess depends n yur audit settings. Test yur audit settings t identify a baseline and set yur memry and hardware needs accrdingly. T estimate yur audit data vlume, perfrm a test audit f yur SQL Servers fr 7 days, and track hw much space is used by the Repsitry databases. Use the resultant event cllectin rate t estimate the database size yu will need t stre and prcess audit data ver time. Als cnsider hw ften yu plan t archive r grm data. Fr example, if yu cllect an average f 500 MB f audit data per day and yu plan t archive events every 14 days, then the database size shuld be set t 7 GB. Ensure yu set the Repsitry databases t autmatically grw. Fr mre infrmatin, see Optimize tempdb settings.

35 Use a dedicated cmputer Install the Cllectin Server n a dedicated cmputer running SQL Server. This cnfiguratin requires that the Repsitry databases are the nly databases hsted n this SQL Server. This cnfiguratin als helps yu ensure minimal access t the SQL Server instance and yur audit data. Fr mre infrmatin, see Prduct cmpnents and architecture.

36 Optimize mdel settings Change the fllwing mdel system database prperties t ensure ptimal perfrmance and cmplete backups f the Repsitry databases. The Repsitry databases stre yur audit settings and cllected audit data. Whenever the Cllectin Server creates an events r archive database, SQL Server uses the mdel database as a template fr the new database, applying the same prperty values. Use the fllwing guidelines t ptimize perfrmance in a typical envirnment. Fr best results, mnitr yur audit data cllectin ver a perid f time, and then set these mdel prperties t reflect yur needs. Fr mre infrmatin, see Identify audit data vlume. Prperty Name Benefits Value Autmatically grw file Allws the tempdb database t expand as needed, accmmdating cases when the cllected audit data set is larger than expected File grwth Allws SQL Server t efficiently handle any required file grwth 25% Selected Recvery Mdel Allws yu t perfrm full backups f the Repsitry database Simple Space allcated Allws ample database space fr audit data cllectin, s file grwth ccurs less frequently 200 MB

37 Optimize tempdb settings Change the fllwing tempdb system database prperties t ensure ptimal perfrmance when the Cllectin Server prcesses and archives audit data. Use the fllwing guidelines t ptimize perfrmance in a typical envirnment. Fr best results, mnitr yur audit data cllectin ver a perid f time, and then set these tempdb prperties t reflect yur needs. Fr mre infrmatin, see Identify audit data vlume. Prperty Name Benefits Value Autmatically grw file Allws the tempdb database t expand as needed, accmmdating cases when the cllected audit data set is larger than expected File grwth Allws SQL Server t efficiently handle any required file grwth 25% Selected Space allcated Allws ample database space fr audit data cllectin, s file grwth ccurs less frequently 200 MB

38 Preserve audit data using archives Include frequent archiving in yur audit data maintenance strategy. Archiving lets yu stre audit data in separate databases that can be accessed fr future reprting. Fr mre infrmatin, see Hw archives wrk.

39 Implement a disaster recvery strategy A disaster recvery strategy allws yu t plan fr unexpected utages t ensure yu can cntinue auditing SQL Server activity and plicy cmpliance. When yu implement SQL cmpliance manager in yur prductin SQL Server envirnment, cnsider preparing a disaster recvery strategy t minimize audit data lss shuld the Cllectin Server becme unavailable. Use the fllwing prcedures and guidelines t implement a new disaster recvery strategy r mdify an existing disaster recvery strategy. Identify hw ften t back up the Repsitry databases The frequency at which yu back up the Repsitry databases depends n the fllwing factrs: Hw ften yur audit settings change Hw ften yur SQL Server envirnment changes as yu add new servers and databases r remve lder servers and databases Hw much audit data yu cllect in a given time perid Hw much risk yu are willing t incur The backup frequency shuld reflect yur maintenance needs and allw yu t meet future cmpliance requirements. Schedule rutine backups f the Repsitry databases After yu identify the apprpriate backup frequency fr yur cmpliance needs, use a tl such as Idera SQLsafe t schedule rutine backups f the Repsitry databases.

40 Exprt yur audit settings Exprted audit settings are saved in an XML frmat and can be applied t ther registered SQL Server instances. This flexibility saves yu time when yu are cnfiguring audit settings n multiple SQL Server instances, and helps ensure cnsistent audit settings acrss yur envirnment. In additin, exprting allws yu t back up yur audit settings t use shuld yu need t reinstate an audited SQL Server instance. As yu cnfigure audit settings, cnsider which settings yu wuld like t save fr future use, and exprt the settings cnfigured fr that particular SQL Server instance r database. T exprt yur audit settings: 1. Navigate t Registered SQL Servers in the Administratin tree. 2. Select the SQL Server instance frm the list n the Registered SQL Servers tab that yu want t exprt. Use the Instance Summary tab r an Audit Snapsht t verity audit settings n a specified instance. 3. Click Exprt. 4. Specify the file name r use the default name. 5. Select the lcatin t save the utput file. Cnsidering saving the utput file t a central lcatin, such as a netwrk share. 6. Click Save.

41 Imprt yur audit settings As yu cnfigure r mdify audit settings fr yur SQL Server instances, yu may want t apply the same settings acrss multiple SQL Server instances in yur envirnment. Yu can imprt audit settings thrugh previusly exprted XML files, allwing yu t: Use previusly cnfigured audit settings as a baseline, r template, yu deply t multiple instances and databases s that the same events are audited acrss yur envirnment Ensure all SQL Server databases used by regulated applicatins, such as SAP, are being audited cnsistently and held t the same level f cmpliance Streamline and autmate yur cnfiguratin wrkflw If a user is assigned privileged status as part f the alert rule yu are imprting, and that user des nt yet exist in the envirnment yu are imprting t, the privileged user status will apply if the user is ever added t yur envirnment. Auditing the same events acrss multiple instances and databases Yu can imprt previusly cnfigured audit settings t use as a baseline, r template. By deplying this baseline t multiple instances and databases, yu can ensure the same events are audited acrss yur envirnment. T audit the same events acrss multiple instances r databases: 1. Navigate t Registered SQL Servers in the Administratin tree. 2. On the Registered SQL Servers tab, click Imprt. 3. On the Select File t Imprt windw, click Brwse and lcate the audit settings file, and then click Open. 4. Click Next. If yu want t audit events at the server level as well as events initiated by privileged users, select these imprt ptins. If yu want t audit events at the database level, click Database Audit Settings, and then select the database yu want t use as yur baseline r template. 5. On the Target Servers windw, select the registered SQL Server instances t which yu want t apply the selected audit settings, and then click Next. 6. On the Imprt Audit Settings windw, select the audit settings yu want t imprt, and then click Next. 7. On the Target Databases windw, select the audited databases t which yu want t apply the selected audit settings, and then click Next. 8. On the Summary windw, chse whether yu want yur imprted audit settings t verwrite the settings n the target SQL Server instances and databases r be added t the settings already present. Click Finish t imprt yur audit settings. Auditing regulated applicatins acrss yur envirnment Yu can imprt previusly cnfigured audit settings t ensure all SQL Server databases used by regulated applicatins, such as SAP, are being audited cnsistently and are held t the same level f cmpliance. T audit regulatry applicatins acrss yur envirnment: 1. Navigate t Registered SQL Servers in the Administratin tree. 2. On the Registered SQL Servers tab, click Imprt. 3. On the Select File t Imprt windw, click Brwse and lcate the audit settings file, and then click Open. 4. Click Next.

42 5. On the Imprt Audit Settings windw, specify which databases have been cnfigured with the audit settings yu want t imprt. Cmplete the fllwing steps: a. Click Database Audit Settings, and then select the Only imprt fr matching database names ptin. b. Select the databases whse audit settings yu want t apply. c. If yu als want t audit events at the server level as well as events initiated by privileged users, select these ptins, and then click Next. 6. On the Target Servers windw, select the audited SQL Server instances yu want t apply the audit settings t frm the list, and then click Next. 7. On the Target Databases windw, ensure the target database list matches the database names yu specified t match. Select the audited databases t which yu want t apply the imprted audit settings, and then click Next. 8. On the Summary windw, select whether yu want yur imprted audit settings t verwrite the settings n the target SQL Server instances and databases r added t the settings already present. Click Finish t imprt yur audit settings.

43 Manage the SQLcmpliance Agent The SQLcmpliance Agent cllects SQL events fr the Cllectin Server t prcess. Yur audit and agent prperty settings cntrl which audit data is cllected, and hw the audit data is managed and prcessed. Deply a SQLcmpliance Agent t each SQL Server cmputer that hsts the instances and databases yu want t audit.