cancel
Showing results for 
Search instead for 
Did you mean: 

SQL Server : Permissions and Job

hkadoun
Level 4
Partner

Hello All,

I had a discussion with a SQL admin today, and he asked me some questions I would like to share with you:

  •  First, it's about sql permissions: Are the "Database Creators" and the "Alter Any Login" mandatory after the configuration of EV?
    As I understand, "Database creators" is needed for databases creation during the installation for the directory db and the monitoring db (eventually the auditing db) and when an EV admin creates a Vault Store Group or a Vault Store. So, if there is no change in the configuration ( no creation of VS or VSG), it is possible to remove this permission?
    As mentionned in this kb ( http://www.symantec.com/business/support/index?page=content&id=HOWTO28089), "Alter Any Login" is needed If the Enterprise Vault databases are on Microsoft SQL Server 2008 to run Reporting Configuration utility and can be removed after. The KB applies to 8.0 -> 8.0.2 version but I dont know it's applicable to version 9.
     
  • Second, it's about the SQL jobs that EV uses. The SQL team needs to know what are the jobs, when do they start, for how along,...I know it's related to the archiving task,archive retrieval, manual archiving,...
    In fact, they need to know what kind of activity will be on the SQL server and if they will dedicate a SQL server for EV. I know it's difficult to answer because there are too many variables but they want to have a description of the job and the associated load : is there any documentation on the subject? ( the Enterprise Vault Performance Guide doesn't really discuss this point)
     

Thanks.

1 ACCEPTED SOLUTION

Accepted Solutions

TonySterling
Moderator
Moderator
Partner    VIP    Accredited Certified

Yes, you can remove those permissions after the configuration is done.  Just be sure to leave the VSA (vault service account) the DBO for the databases.  Be sure to remember you have done so if you need to change the configuration in the future.  :)

This technote even says it: Article URL http://www.symantec.com/docs/HOWTO28087

"Adding or removing ALTER ANY LOGIN permission for the Vault Service account

If the Enterprise Vault databases are on Microsoft SQL Server 2008, you must grant ALTER ANY LOGIN permission to the Vault Service account before you run the Reporting Configuration utility. You may remove this permission from the Vault Service account when you have quit the Reporting Configuration utility."

EV doesn't use sql jobs for archiving or restoring or anything like that.  It will be sql intensive during archiving as it will be adding rows to sql tables.  Personally, I always like to SQL dedicated to EV, it makes it easier to manage.

Discovery Accelerator will create SQL jobs, but if you aren't using DA then you don't need to worry about it.

View solution in original post

4 REPLIES 4

TonySterling
Moderator
Moderator
Partner    VIP    Accredited Certified

Yes, you can remove those permissions after the configuration is done.  Just be sure to leave the VSA (vault service account) the DBO for the databases.  Be sure to remember you have done so if you need to change the configuration in the future.  :)

This technote even says it: Article URL http://www.symantec.com/docs/HOWTO28087

"Adding or removing ALTER ANY LOGIN permission for the Vault Service account

If the Enterprise Vault databases are on Microsoft SQL Server 2008, you must grant ALTER ANY LOGIN permission to the Vault Service account before you run the Reporting Configuration utility. You may remove this permission from the Vault Service account when you have quit the Reporting Configuration utility."

EV doesn't use sql jobs for archiving or restoring or anything like that.  It will be sql intensive during archiving as it will be adding rows to sql tables.  Personally, I always like to SQL dedicated to EV, it makes it easier to manage.

Discovery Accelerator will create SQL jobs, but if you aren't using DA then you don't need to worry about it.

hkadoun
Level 4
Partner

Thanks Tony.

The technote applies to EV 8, do you think it's still relevant for EV 9 ?

Concerning SQL job, I understand your point. I have checked on a platform ( without Discovery, just exchange mailbox archiving,PST migration) and only two jobs are created on SQL:

  • EV Monitoring History Purge Job
  • syspolicy_purge_history

TonySterling
Moderator
Moderator
Partner    VIP    Accredited Certified

Yes, would still be the same for EV 9.

Oh yeah, good catch on the Monitoring History Purge Job.   Those would both be low overhead jobs, I can't see either of them being very intensive.  You could always run a SQL Profiler on the two jobs and see what kind of impact they are having.

Honestly, though, I have not ever had anyone ask about them so I have never looked into them too much.

hkadoun
Level 4
Partner

Ok I also get the confirmation from the support for the technote.

In fact, it's also the first time i've been asked about and it's an opportunity to learn more about Enterprise Vault ;)