Add SQL Server diagnostics#23621
Conversation
Codecov Report❌ Patch coverage is Additional details and impacted files🚀 New features to boost your workflow:
|
🎉 All green!❄️ No new flaky tests detected 🎯 Code Coverage (details) 🔗 Commit SHA: 9b8b412 | Docs | Datadog PR Page | Give us feedback! |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 288359bce9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
- skip server-level VIEW SERVER STATE probe on Azure SQL Database and validate via sys.dm_exec_sessions (VIEW DATABASE STATE) - probe msdb.dbo.syssessions when agent_jobs is enabled and not on RDS Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Validation ReportAll 20 validations passed. Show details
|
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9b8b4122a3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if not azure and not _has_server_permission(cursor, "VIEW SERVER STATE"): | ||
| self._fail(code, diagnosis="The Datadog login does not have VIEW SERVER STATE.") | ||
| return | ||
| _execute_read_probe(cursor, "SELECT TOP 1 session_id FROM sys.dm_exec_sessions") |
There was a problem hiding this comment.
Validate Azure database-state permissions explicitly
When the target is Azure SQL Database and the login lacks VIEW DATABASE STATE, this probe can still succeed because Microsoft documents that everyone can see their own sys.dm_exec_sessions row, while VIEW DATABASE STATE is required to see all connections in the current database (https://learn.microsoft.com/en-us/sql/relational-databases/system-dynamic-management-views/sys-dm-exec-sessions-transact-sql). As a result datadog-agent diagnose reports this permission as granted even though DBM/query-activity collection remains under-permissioned; the Azure branch should explicitly check HAS_PERMS_BY_NAME(..., 'DATABASE', 'VIEW DATABASE STATE') or otherwise verify visibility beyond the current session.
Useful? React with 👍 / 👎.
Summary
Validation