Foglight for SQL Server (Cartridge) 5.7.5.50

SQL PI configured SQL PI not configured Manual configuration required by all users

Supported monitoring platforms Supported monitored databases Supported monitored BI services PI aggregation and retention Permissions for monitored databases

Permissions for Oracle databases Permissions for SQL Server databases Permissions for Sybase databases Permissions for DB2 for LUW databases

Permissions for monitored operating systems

Install the DB cartridge and DB agent

Install the DB cartridge Install a single DB agent

Install a single SQL Server or Oracle agent Install a single DB2 agent Install a single Sybase agent

Special configurations

High Availability Federation Concentrator (Proxy)

Permissions for SQL Server databases

If you are using SQL Server®, ensure that these permissions are set.


	NOTE: Monitoring mirroring requires sysadmin privileges.

Table 11. SQL Server Permissions
Instance Level		Database Level
VIEW ANY DEFINITION VIEW SERVER STATE ALTER TRACE	Granted for: Tracing a Session Deadlocks monitoring PI Change-Tracking	CREATE USER* db_datareader db_ddladmin	Granted for: Running DBCC commands for indexes

* Creation of a new user is not required if a domain group with the appropriate permissions is used.

Grant Execute on these master database objects:

Table 12. Master database objects requiring Execute permission

xp_enumerrorlogs xp_readerrorlog	Granted for Error log monitoring

Grant Select on these msdb database objects:

Table 13. MSDB database objects requiring Select permission

log_shipping_monitor_primary log_shipping_monitor_secondary log_shipping_primaries log_shipping_secondaries syscategories sysjobactivity sysjobs sysjobhistory dbm_monitor_data dbm_monitor sysalerts	Granted for Log Shipping monitoring Granted for Jobs and Replication monitoring Granted for Mirroring monitoring Granted for Agent alerts and services

Permissions for Sybase databases

If you are using Sybase®, ensure that these permissions are set.

Permission required — Sybase MDA Agent requires mon_role

In case the agent is created with a non-sa user, procedures need to be manually created on the monitored instance. This is achieved by executing the scripts available at the following directory:

<Agent Manager installation directory>\agents\SybaseCartridge\<version#>\config\Sybase\scripts\

Permissions for DB2 for LUW databases

If you are using DB2 LUW, ensure that these permissions are set.

Set Account Privileges on:

•

SYSMON authority

Grant Select privilege on:

•

SYSIBMADM.PRIVILEGES

•

SYSCAT.VIEWS

•

SYSCAT.ROUTINES

Grant Execute on:

•

AUTH_LIST_AUTHORITIES_FOR_AUTHID

Required Monitor Switches

Table 14. Required Monitor Switches
9.5 to 9.7	9.7 and above*
UOW STATEMENT LOCK SORT TABLE BUFFERPOOL TIMESTAMP	MON_REQ_METRICS MON_ACT_METRICS MON_OBJ_METRICS

*Should be set to at least the base level.

Permissions

Table 15. Permissions — All versions
General
ADMIN_CMD ENV_GET_PROD_INFO DB_PARTITIONS ENV_GET_SYS_INFO SNAP_GET_APPL_INFO SNAP_GET_BP SNAP_GET_APPL SNAP_GET_BP_PART SNAP_GET_DBM SNAP_GET_HADR SNAP_GET_DBM_MEMORY_POOL SNAP_GET_FCM_PART SNAP_GET_STMT SNAP_GET_LOCKWAIT SNAP_GET_SWITCHES SNAP_GET_STORAGE_PATHS PD_GET_DIAG_HIST

Table 16. Permissions — Version-specific
9.5	9.7.0.1	10.1
SNAP_GET_DB_V91	ENV_GET_SYSTEM_RESOURCES	ENV_GET_SYSTEM_RESOURCES
SNAP_GET_TAB_V91	MON_GET_PKG_CACHE_STMT	MON_GET_PKG_CACHE_STMT
SNAP_GET_TBSP_V91	MON_FORMAT_LOCK_NAME	MON_FORMAT_LOCK_NAME
SNAP_GET_CONTAINER_V91	WLM_GET_SERVICE_CLASS_AGENTS_V97	WLM_GET_SERVICE_CLASS_AGENTS
SNAP_GET_DYN_SQL_V91	MON_GET_WORKLOAD	MON_GET_WORKLOAD
	MON_GET_TABLESPACE	MON_GET_TABLESPACE
	ENV_GET_DB2_SYSTEM_RESOURCES	ENV_GET_DB2_SYSTEM_RESOURCES
	ON_GET_SERVICE_SUBCLASS_DETAILS	MON_GET_SERVICE_SUBCLASS_DETAILS
	MON_FORMAT_XML_TIMES_BY_ROW	MON_FORMAT_XML_TIMES_BY_ROW
	MON_GET_UNIT_OF_WORK	MON_GET_UNIT_OF_WORK
	MON_GET_BUFFERPOOL	MON_GET_BUFFERPOOL
	MON_GET_TABLE	MON_GET_TABLE
	MON_GET_CONTAINER	MON_GET_CONTAINER
	MON_GET_FCM_CONNECTION_LIST	MON_GET_FCM_CONNECTION_LIST
	MON_GET_CONNECTION	MON_GET_CONNECTION
	SNAP_GET_TBSP_V91	SNAP_GET_TBSP
	SNAP_GET_DB_V91	MON_GET_TRANSACTION_LOG
		SNAP_GET_DB DB2_GET_INSTANCE_INFO ADMIN_GET_STORAGE_PATHS

Table 17. Permissions - 10.5 and later
10.5 and later
ENV_GET_SYSTEM_RESOURCES MON_GET_INSTANCE MON_FORMAT_LOCK_NAME MON_GET_PKG_CACHE_STMT MON_GET_AGENT MON_GET_WORKLOAD ENV_GET_DB2_SYSTEM_RESOURCES MON_GET_DATABASE ADMIN_GET_STORAGE_PATHS DB2_GET_INSTANCE_INFO MON_GET_TRANSACTION_LOG MON_GET_CONNECTION MON_GET_FCM_CONNECTION_LIST MON_GET_CONTAINER MON_GET_TABLE MON_GET_BUFFERPOOL MON_GET_UNIT_OF_WORK MON_FORMAT_XML_TIMES_BY_ROW MON_GET_SERVICE_SUBCLASS_DETAILS MON_GET_TABLESPACE

Grant Select on these SYSIBMADM administrative views:

•

•

•

•

•

•

•

•

•

SYSIBMADM.ENV_PROD_INFO

* For DB2 version 9.7.0.1 or later

PureScale environments

Grant Execute on to these table functions:

•

MON_GET_CF

•

MON_GET_GROUP_BUFFERPOOL

•

BP_HITRATIO

Grant Select on these views:

•

ENV_CF_SYS_RESOURCES

•

SNAPDB

•

SYSIBMADM.DB2_MEMBER

Permissions for monitored operating systems

For details, see the following topics:

•

General Unix requirements

•

VMware permissions

•

Windows permissions

General Unix requirements

The OS user account for each agent requires:

•

Silent log-in — in particular, there must be no user-input required and no special login banners displayed

•

For connections using SSH, the sshd daemon must be installed and running.

In addition to these general UNIX® system requirements, each agent user account requires additional privileges depending on the operating system, as specified in the following table.


	NOTE: When monitoring DB2, SYSMON role and privileges for OS user is not required but is recommended to allow the installation to provide more information when discovering DB2 databases.

Linux/UNIX permissions

Table 18. Linux/UNIX Permissions
Permission	Linux®	Solaris®	AIX®	HP-UX
Execute	df iostat uptime sed ps hostname awk free uname /proc/ vmstat netstat getconf lsnrctl sysstat	df iostat uptime netstat vmstat ps hostname awk mpstat /usr/sbin/prtconf uname pagesize lsnrctl psrinfo db2ptree	df iostat uptime netstat vmstat ps hostname awk lsdev lsattr oslevel pagesize uname lsnrctl	bdf uptime sar netstat vmstat ps hostname awk /usr/sbin/ ioscan uname getconf iostat lsnrctl lsattr lsdev pagesize bindprocessor oslevel
Read	/proc/net/dev /proc/stat /proc/vmstat on Linux >= 2.6 /proc cpuinfo getconf sysstat package* /proc/net/dev* /proc/cpuinfo* free* /proc/cpuinfo*			/var/adm/syslog/syslog.log

VMware permissions

To monitor VMware®, users must have read only access to the virtual center.

Windows permissions

Foglight support monitoring Windows® operating system in one of two ways: WinRM and WMI. The preferred method is WinRM when no WinRM connection WMI connection is used.

WinRM (default) - Based on Kerberos authentication or Basic authentication uses standard HTTP headers. For more information, see http://support.quest.com/technical-documents/foglight-agent-manager/5.9.2/foglight-agent-manager-guide/advanced-system-configuration-and-troubleshooting/configuring-windows-remote-management-winrm.

WMI (fallback) — Permission to access both DCOM and WMI. For more information, see

http://support.quest.com/technical-documents/foglight-agent-manager/5.9.2/foglight-agent-manager-guide/advanced-system-configuration-and-troubleshooting/configuring-windows-management-instrumentation-wmi.