Return
-
Title
"The EXECUTE permission was denied on the object agent_datetime" in SQL Server logs -
Description
Errors for the Execute permission on agent_datetime object similar to the following appear in the SQL Server log file for numerous collections such as
ERROR [AGENTNAME-lowPriorityPool-2-[DBSS_Replication_Agents][]] com.quest.qsi.fason.core.collection.processor.InstanceProcessor - Failed to run DBSSReplicationAgentsProcessor processor of DBSS_Replication_Agents collection.java.lang.RuntimeException: Failed to execute collection [DBSS_Replication_Agents], reason=[Foglight][SQLServer JDBC Driver][SQLServer]Error Number 229 at Replication Agents Script.Error Message: The EXECUTE permission was denied on the object 'agent_datetime', database 'msdb', schema 'dbo'. Profile:MSSQLProfile{host='HOSTNAME', instance= 'DEFAULT_INSTANCE', username='DOMAIN\USERNAME'andERROR [AGENTNAME-lowPriorityPool-1-[DBSS_Agent_Job_List][]] com.quest.qsi.fason.core.collection.processor.InstanceProcessor - Failed to run DBSSAgentJobListProcessor processor of DBSS_Agent_Job_List collection.java.lang.RuntimeException: Failed to execute collection [DBSS_Agent_Job_List], reason=[Foglight][SQLServer JDBC Driver][SQLServer]The EXECUTE permission was denied on the object 'agent_datetime', database 'msdb', schema 'dbo' -
Cause
CAUSE 1
Missing permissions. The permissions script had not been run since the 5.5.8 version of the SQL Server cartridge in 2011. There have been significant changes in permissions requirements since this time specifically for the Agent Job List collection to determine the start and end date/times of jobs.
CAUSE 2
An instance may lose specific msdb database permissions after their weekly/monthly SQL Server Critical Update patching rounds. This forces the users to re-grant these permission for all post-patched SQL Server instances. -
Resolution
RESOLUTION 1
Workaround
Rerun the SQL Server permissions script using the validate connection functionality in the database agent or using the grant permissions script.
Status
The deployment guide only includes requiring the SELECT permission on agent_datetime and this additional requirement should be added. Enhancement ID FOG-8387 was logged to document the execute permission requirement on msdb.agent_datetime. This will be included in a future release of the Foglight for SQL Server documentation and Foglight for Databases deployment guide.
RESOLUTION 2
Workaround
Rerun the SQL Server permissions script using the validate connection functionality in the database agent or using the grant permissions script.
Status
Enhancement ID FGSS-I-103 has been logged to change the collections not to use msdb.agent_datetime for the Agent Job List collection when working with the start and end date for jobs. One possibility may be using two variables for the date and time parts, then concatenating and casing them into a valid date time. This will be reviewed by Product Management for consideration in a future release of the SQL Server cartridge.