Pro SQL Server 2008 Pol icy-based. Management. Ken Simmons. Colin Stasiuk. Jorge Segarra. Apress8

Transcription

1 Pro SQL Server 2008 Pol icy-based Management Ken Simmons Colin Stasiuk Jorge Segarra Apress8

2 Contents Contents at a Glance Contents About the Authors About the Technical Reviewers Acknowledgments Introduction iv v xii xiii xiv xv Chapter 1: Introduction to Policy-Based Management 1 What Is Policy-Based Management? 1 Why Use Policy-Based Management? 1 Policy-Based Management Requirements 2 Policy-Based Management Components 3 Targets 3 Facets 4 Conditions 5 Policies 6 Policy Behavior 7 Evaluation Modes 7 Server Restrictions 8 Policy Management 9 Categories 9 Central Management Servers 9 Enterprise Policy Management Framework 10 v

3 Alerts 11 Summary 11 Chapter 2: Creating Policies 13 Manually Creating Policies 13 Creating a Condition 13 Creating a Policy 16> Viewing Dependent Policies 21 Importing Policies 24 Exporting Policies 27 Exporting Existing Policies 28 Exporting Current State As Policy 33 Creating Policies with T-SQL 35 Managing Policy Categories 37 Creating Policy Categories 37 Subscribing to Categories 39 Creating Advanced Conditions 40 Defining Conditions for System Databases 44 Summary 47 Chapter 3: Evaluating Policies 49 Evaluation Modes 49 Evaluation on Demand 50 Evaluating a Single Policy on Demand 50 Evaluating Multiple Policies on Demand 55 Evaluating Policies Against a Different Instance 57 Evaluation on Schedule 60 Creating a Schedule 61 Adding Policies to an Existing Schedule 66 vi

4 Evaluation on Change: Log Only 67 Evaluation on Change: Prevent 74 Using a Central Management Server 76 Creating a Central Management Server 77 Creating a Central Management Server Group 78 Adding Servers to Central Management Server Groups 80 Registering a Server to a Group 80 Importing Registered Servers and Groups 81 Evaluating Policies against a Central Management Server Group 84 Summary 87 Chapter 4: Policy-Based Management Using PowerShell 89 Creating a Basic PowerShell Script 89 Using T-SQL 89 Using SQL Server Management Objects 91 Interrogating for Members and Properties 93 Running a Policy Against a SQL Server Instance 95 Invoking a Policy from a File 95 Getting Detailed Results 96 Invoking a Policy Defined on the Server 97 Running Multiple Policies Against a SQL Server Instance 98 Invoking Multiple Policies from the Cmdlet 98 Invoking a Category of Policies from the File System 99 Invoking a Category of Policies from an Instance 100 Querying and Storing Policy Execution Results 101 Creating a Staging Table 102 Loading Policy Evaluation History 102 Querying the History 103 Evaluating Against a Central Management Server 105 vii

5 Summary 108 Chapter 5: Receiving Alerts for Policy Violations 109 Configuring Database Mail 109 Setting Up Database Mail 109 Testing Database Mail 111 Cleaning Up Database Mail History 113 Creating SQL Server Agent Operators 116 Enabling SQL Server Agent Notifications 118 Creating Alerts 120 Troubleshooting Policies 126 Viewing Policy History 126 Viewing History Based on Policies 126 Viewing History Based on Objects 127 General Troubleshooting 129 Summary 130 Chapter 6: Policy-Based Management Internals 131 Policy-Based Management Properties 131 Policy-Based Management Architecture 134 On Demand 134 On Change: Prevent 135 On Change: Log Only 135 On Schedule 135 Policy-Based Management Security Issues 136 Policy-Based Management Tables and Views 137 Tables 137 Contents of System Policy Tables 138 Checking for New Tables 141 Views 141

6 syspolicy_conditions 141 syspolicy_configuration 142 syspol icy_object_sets 142 syspolicy_policies 142 syspolicy_policy_categories 143 syspolicy_policy_category_subscriptions 143 syspolicy_policy_execution_h istory 143 syspolicyjolicy_execution_history_details 144 syspolicy_system_health_state 144 syspolicy_target_setjevels 144 syspolicy_target_sets 144 Combining Views 145 Checking for New Views 146 Stored Procedures 146 Summary 148 Chapter 7: Practical Uses of Policy-Based Management 149 A DBA Checklist 149 Custom Policies 150 Database Free Space 150 Successful Transaction Log Backups 153 SQL Server Agent Is Running 158 All SQL Server Agent Jobs Have Notification on Failure 160 Data Purity Flag Enabled 163 Best Practices Policies 166 Summary 168 IX

7 Chapter 8: Reporting 169 EPM Framework Prerequisites 169 Setting Up the EPM Framework 170 The Setup Script 170 The PowerShell Script 171 Reporting Services Reports 175 Viewing EPM Framework Reports 179 Automating the EPM Framework 182 Summary 183 Chapter 9: Enforcing Compliance 185 Compliance Overview 185 Compliance Regulations 186 Gramm-Leach-Bliley Act 186 The Sarbanes-Oxley Act 187 Health Insurance Portability and Accountability Act 187 Payment Card Industry Data Security Standard 187 Server Configuration 188 Service Account 189 Log Retention 191 Surface Area Configuration 194 Security 195 Administrative Accounts 196 Removing the BuiltinXAdministrators Login 197 Disabling the sa Login 197 Best Practice Security Policies 198 Encryption 199 Transparent Data Encryption 199 Extensible Key Management 201 x

8 Best Practice Encryption Policies 202 Auditing 202 SQL Server Audit 203 Login Auditing 203 Default Trace 204 Best Practice Audit Policy 206 Summary 206 Chapter 10: Where to Go from Here 207 Upcoming Releases 207 SQLServer WebSites 207 Blogs 208 White Papers 208 Podcasts 209 Free Training Events 209 Social Networking 210 Microsoft Support Options 211 SQL Server Books Online 211 Webcasts 211 SQL Server Troubleshooting and Support Resources 212 Microsoft Technical Communities 212 Paid Support 212 Summary 213 Appendix: Microsoft SQL Server Best Practice Policies 215 Best Practice Policy Descriptions 215 Best Practice Policy Conditions and Facets 230 Index 235 XI