Tuesday, March 23, 2010

The xp_CMDShell Curse

I interviewed a couple guys for a DBA position the other day and I asked one of my usual questions which is simply to discuss xp_cmdshell and its implications.  Without hesitation, I got the same answer twice.  Both guys gasped and talked about the evils of xp_cmdshell.  So I let them go on and then presented them with a couple scenarios that we discussed.  And again, all of this just makes me think about true evil and how xp_cmdshell just doesn’t fit.  See, this xp was developed for a reason;  It filled in the gap on some missing functionality, and it does it very well.  In fact, it does it so well, and the gap is so big, that xp_cmdshell gained in popularity and became an instant success.  And in fact, it was used too much and this is where it got its bad reputation.  Don’t hold that against xp_cmdshell though.  Just because everyone recognizes its usefulness doesn’t mean that it’s bad.  The problem started because everyone wanted to use it and the security was opened wide allowing damage to be done. 

But it’s not evil;  it’s just misused.  If you keep it locked down there’s no reason why you can’t have a fairly nice relationship with xp_cmdshell.  The same goes for cursors.  Cursors have also fallen prey to the cmdshell curse.  And again, it’s through misuse. So don’t kick either of these out of your shop because so many other devs are stupid.  Use them both wisely and they’ll do good things for you.

Wednesday, March 10, 2010

People Leave Jobs

One thing I see from time to time is when someone leaves a gig they’ve been at for a long time, their workmates get upset.  It’s like they’re personally offended that the guy is choosing to work somewhere else.  Look, I know it’s easy to build relationships with people you work with and it’s easy to bond with people you spend so much time with.  Hell, you might even say that you’ve been in battle together.  What you have to realize though is that people have to do what’s good for them.  I can almost promise you that the guy’s not leaving to spite you.  He’s probably just tired of one thing or another.  Maybe he’s not getting paid what he thinks he should.  Maybe the new job is just closer to home.  Maybe the new job allows more training or flexibility.  Whatever the reason, it’s almost certain it’s not to piss you off.

I know what it’s like because I went through that many years ago.  I got a couple guys I worked with that I got along with great and we all worked very well together.  Coming to work wasn’t a chore at all.  Then the first cool dude left.  I was crushed.  How could he do that to me?  After all we’ve meant to each other!!  Then the next one left, and then the next.  Finally I was all alone.  I want along this way until I went to my next job and found a couple guys I really liked (you know what I’m talking about, huh).  Then I left that gig because I got something better and I labored over whether to leave those guys or not.  Finally I decided that taking care of my family was more important.  Then I got it.  Those other guys weren’t leaving ME, they were just moving on to a better gig. 

So really guys, if someone you work with leaves for another gig, wish him well.  He’s only doing what’s best for him.  And if you really are a friend, that’s how you’ll look at it.

SSIS Email Chain

Today's blog is actually an email chain between me and a user. It's only a single question and reply, but I think it's good info.

Q:
Hey, would you agree that a monthly load process is better served as an SSIS – even if you have to push/pull from text files for now – than as a series of SPs or DLLs?

A:
if you're staying on the same box for the load then SPs can be an attractive offer because they're very fast and the memory stays in sql and can be managed quite well... if you move that process to ssis, and ssis is on the same box, then you have to allocate memory away from sql to run the pkg and house the data while in the buffer...



if ssis is on another box, but the data is still being moved to different dbs on the same box... so if the data is being moved from server1.db1 to server1.db2 and ssis is on server2, then you don't have to fight sql for memory, but now you incur the network cost of moving the data from the box, and then back to it...



if you're moving between boxes, then y, ssis is a better choice because in SPs you have to manage linked servers or openrowset to make that happen and that's not cricket...



however, what makes ssis attractive in the single box scenario is that it handles errors easier and alerting is much richer and easier to come by... you can also more easily fix problems in the data itself and it's easier to extend... so if your requirements change and you need to switch it to another box, or if you need to send a copy somewhere else, etc then that's much easier in ssis... ssis also gives you parallelism that you cant do in sps... you can load several tables at once in ssis where they have to be serialized in sps...



a good compromise in the single box scenario is to keep things moving like they are if possible, and where not stupid... so if they've already got an sp that inserts data into the 2nd db, then just call that sp from ssis... this way you get the insert and select process in sql where it belongs, and the workflow and error handling of ssis, and everything else that goes with it... if a single sp inserts several tables serially though, i'd create several sps and call them individually in ssis tasks... even if you have to keep them seialized (like for PK/FK issues)... because now you can even add things like checkpoints and individual error flows to your pkg steps and have a richer experience...



these things are meant to allow your process to grow and change much easier than is possible with an sp... so if one of the DBs gets too big and has to move to another box, it's a simple matter in ssis... but in an sp, that means you have to create and manage a linked server, which is just one more thing and they come with their own problems...



as for the DLLs... these processes NEVER belong in a DLL... not only do you have to steal memory from sql, but it's not optimized for data flow tasks... it's just a plain DB connection... you can have parallelism though by calling the windows threading model, but they have to manage those threads manually and mistakes can be made... and that takes extra memory, etc... not only that, but the code isn't available for admins to fix problems, and making changes to the compiled code can be dangerous, right... so no, that's not a good idea...



does this answer... i realize you prob wanted more of a yes, do this, but it's not that simple...
Tuesday, March 09, 2010

Deleting Production Data

While talking to a group of devs late last week the topic of deleting prod data came up.  Since I’m the big MVP of the group they wanted to know what the official word from on-high is.  The question is simple, and the answer is even simpler and frankly it’s one of those that was solved so long ago it just doesn’t hold any interest for me anymore.  I’ll hash it out here again though because I know there are plenty of you out there who haven’t solved this problem yet. 

The question is, what’s the best way to delete gazillions of rows out of a prod table.  The issue is with both concurrency  and rollback.  The problem is that if you do a huge delete in a single transaction you don’t leave any room for anyone else to access the table during that time.  So your delete can bring a DB to a complete halt if you don’t do it right.  As well, you put your system at risk should something go wrong and the transaction has to rollback.  So why would the transaction have to rollback?  Well, there are a couple reasons really.  The first, and most likely, is that it could fill up the log and with no more log the transaction can’t continue.  The other possibility is that the server or the service gets restarted because someone didn’t know you were doing a big operation.  And while I’m at it, there is one more logical possibility.  Someone could get impatient with the operation and stop it without realizing that it has to rollback.  This is actually a scenario that I’ve seen played out many times and the result is always the same.  The system has to wait for at least as long as it was going.  And what’s even better is when the DB doesn’t come back online right away, that same user will bounce the service again and again. 

And of course this counts for updates as well… in SQL2K this was accomplished like this:

SET RowCount 1000

While (1=1)

Begin

Begin Transaction

--Delete stmt here--

if @@RowCount = 0

Begin

   Commit Transaction

   Break

End

    Commit Transaction

End

However, this doesn’t work in SQL2K5 and above where you have to do something more like this:

set nocount on

while 1=1

begin

delete top(1000)

from table1

where conditions…

if @@rowcount = 0

end

 

So ok, that’s how you batch delete/update in prod.  Only under very controlled and specific circumstances should you ever do these types of ops in a single batch.

Wednesday, February 10, 2010

What makes Powershell Awesome?

I was asked to write a quick blog on what makes PS so awesome. And while it's a huge topic with many many examples, I'll give you a couple just to get you going on how cool it is.

1. It makes it really easy to add things to your process that you never could before. Let's take for example that you want to make a change to your DB but you want to backup the schema for an object or a set of objects first. This is so easy in PS it's not even funny. The code to script out objects is:

gci| %{$_.Script()}

That's it!!! And all you have to do is add a filter if you want to script only a certain schema, or a certain object. And the code doesn't change if you want to script tables, views, function, SPs, etc. All you have to do is change the node of the tree you're in... and for that you manage it like DOS. So to script out a table you would type this code:

cd sql:\sqlserver\servername\default\databases\MyDB\Tables
Then just run the script code above.

AND to script out the SPs, you just change the contest to StoredProcedures like this.

cd ..
cd StoredProcedures

That will put you in:
cd sql:\sqlserver\servername\default\databases\MyDB\StoredProcedures

Then just run the same script method from above.
So you can see that scripting objects is wicked easy. And now you can backup the schema of a table before you mess with it, or now you can automate the scripting of SPs before you deploy a new version so you can easily rollback.

2. Now since scripting things like we did above will just print the script out to the screen, you'll want to do something more permenant with them. Have you ever tried to write to a txt file from tsql? You know, you either have to mess with xp_cmdshell or go to one of the sp_OA procedures and make those external calls, right? Well PS solves that problem. So let's script out the objects from above and save them to a file.

gci| %{$_.Script()} | out-file c:\MyTables.txt

That's it!!! So now you can save those things to a file and you've got them to use again.

That's not all you can do with files. You can also get the stuff back out of the files pretty easily. Let's say that you have a list of servers you want to connect to and check that the services are running and you want to turn on the ones that aren't. I'm not going to show you the code for all of the operations here, but to use a txt file as a list of servers you have but to call the txt file and automatically cursor through the items. So here I'll just get the list of servers from a file and print them to the screen. Because what you do with them isn't nearly important here as being able to get them easily.

get-content c:\ServerList.txt | %{$_}

So really, I just listed the servers to the screen one at a time.
The % character is an alias for 'for-each'. So for each item in that txt, print it to the screen. Easy huh?

And just for completion, you can easily work with services by calling the get-service cmdlet or the wmi class for remote boxes.

3. Getting info for objects has never been easier. Let's say you want to get all of the sizes for all of the tables in the DB and do something based on the size. While we're not going to do the entire script, I'll show you how to get the size for all the tables.

First, switch to the tables node.

cd sql:\sqlserver\servername\default\databases\MyDB\Tables

Then run this code:

gci | %{$_.DataSpaceUsed}

That'll just print them out to the screen, or you could pipe them to a txt file like above, or you could continue working with them in the pipeline and manipulate certain tables based off of whatever you like.


There are so many more things you can do with it to make your DBA job so much easier that it would make your head spin. I don't know how we ever got along without it.

Ok, so before I go I'm gonna do just one more because I do this one a lot.
I'm not going to give the code right now, but I'll tell you about it.

Let's say you've got a new employee and you need to add his acct to a Windows group on 30 boxes, and you need to add him to SQL groups and give him access as well. So He's got to be able to TS into these 30 boxes and have certain rights in all DBs on these servers.

With PS I can create a list of servers and either keep them in a table, or put them in a txt file and iterate through them and add the user both to Windows groups, and to SQL groups in a single script. So when's the last time you were able to do that without logging into all the servers individually yourself? And it's really not that hard.

So PS is well worth your time getting to know. If you need help getting started with resources, then ping me and I'll be glad to hook you up.

I've got some really good stuff on PS on MidnightDBA so go out there and check them out.

Here's a overview vid I did back in 2008:
http://midnightdba.itbookworm.com/VidPages/PowerShellOverview/PowerShellOverview.aspx

And you can see most of my other PS vids on the powershell tab of this page:
http://midnightdba.itbookworm.com/Admin.aspx

Good Luck.

About Me

My Photo
Sean McCown
I am a Contributing Editor for InfoWorld Magazine, and a frequent contributor to SQLServerCentral.com as well as SSWUG.org. I live with my wife and 3 kids, and have practiced and taught Kenpo for 22yrs now.
View my complete profile

Labels

Blogumulus by Roy Tanck and Amanda Fazani

Page Views