Showing posts with label track. Show all posts
Showing posts with label track. Show all posts

Friday, February 17, 2012

Dependency Info

I am under the impression that either there are deficiencies in the way SQL
Server 2000 is keeping track of depedencies or perhaps the dependencies
simply need to be re-evaulated / recompiled.

What is the best and/or easiest way to ensure that the dependency info is
accurate?

Is there a way to tell MSSQL to rebuild/reexamine them all?

Thanks in advance to the MVPs and other generous and knowledgable posters
who have helped me recently.

ChadChad (chad.dokmanovich@.unisys.com) writes:
> I am under the impression that either there are deficiencies in the way
> SQL Server 2000 is keeping track of depedencies or perhaps the
> dependencies simply need to be re-evaulated / recompiled.
> What is the best and/or easiest way to ensure that the dependency info is
> accurate?

To forget about it!

Seriously, the nature of SQL Server makes it very difficult for the
server to really keep track of dependencies. If you drop a procedure and
recreate it - of course now SQL Server cannot know which procedure
that refers to it. (The same happens if you alter a procedure. Now, that
is stupid.) Also, SQL Server permits you to create a procedure that
refers to a table that does yet not exist. And you can drop and recreate
a table.

In my daily work, I often use the dependency information to get a
quick information about references to tables and individual columns.
I often have access to an empty database that I have built from scripts,
so this information should be correct. (Since my build tools loads tables
before procedures, and anyway tells me if I refer to something non-
existing.

But if I am looking for where a procedure is being referenced, I run
a tool that searchces SourceSafe. In that case I am also interested in
references from client code, so SQL Server would not be sufficient, even
if the information was correct and complete.

> Is there a way to tell MSSQL to rebuild/reexamine them all?

Not really. What you can do is to generate scripts for your database
and then build a database from that script. But since that script
would sort the objects according to the known dependency information,
you might still not get everything loaded in the right order.

(And anyway, you should have all your source code under version control.)

--
Erland Sommarskog, SQL Server MVP, esquel@.sommarskog.se

Books Online for SQL Server SP3 at
http://www.microsoft.com/sql/techin.../2000/books.asp|||I check dependencies in several ways.

The least effective is to check sysdepends. As Erland pointed out,
it's not usually up-to-date or complete in the face of schema changes.
There are some ways to keep it more up-to-date though. A major problem
with sysdepends is that it doesn't keep track of cross-database
references.

You can also do a text search of stored procedure code via syscomments.

The best approach for checking dependencies I have found is to simply
script out the entire database to text files, then use a text search
utility to search for table or procedure names. This is fast and
complete. I use textpad to "find in files", it works really well. I
automatically script the databases out every day to have a current
snapshot.

My dream is to have a T-SQL parser which reads through all the code and
compiles exactly which procs, tables and fields are being used and
which operations are being done on them. And compile the results into
a set of user tables. Some day.

Tuesday, February 14, 2012

Deny Administrator Access to DB

Hey all,
I am developing an application to track very sensitive company personnel
information. This of course raised the issue of protecting this sensitive
information from everyone not authorized to see it.....including the DB
Administrator. The DB Server (SQL 7) has many databases on it, but the
System Administrator must not be able to access the data in those tables
containing the sensitive information. I have tried denying an SA user
rights to SELECT from a table, but I could still select and view all the
data.
Any ideas?
Jeremy Byron
jbyron@.cynaptec.nb.ns.ca <remove ns to email me>You cannot stop SA from looking at the tables...
HOWEVER - you CAN log the users that view the data.
For the tables that contain sensitive information, you can put a trigger on
the select, update, and delete to generate a log entry.
Of course, you would ask - "But the DBA can delete those rows". Sure they
can - but you can also log it so that you also have it generate a MSMQ
transaction where you can have a service that processes those records into
an external file store.
I would also reccommend seeing the July 2004 edition of SQL Server
Magazine - p.15 on "Privacy Matters" for some other suggestions as well.
=-Chris
"Moi" <moi@.here.com> wrote in message
news:7FF1D2C9B9DB6525.1907DEF59F04D933.8248BD072E33C3AD@.lp.airnews.net...
> Hey all,
> I am developing an application to track very sensitive company personnel
> information. This of course raised the issue of protecting this sensitive
> information from everyone not authorized to see it.....including the DB
> Administrator. The DB Server (SQL 7) has many databases on it, but the
> System Administrator must not be able to access the data in those tables
> containing the sensitive information. I have tried denying an SA user
> rights to SELECT from a table, but I could still select and view all the
> data.
> Any ideas?
> Jeremy Byron
> jbyron@.cynaptec.nb.ns.ca <remove ns to email me>
>|||> you can put a trigger on the select,
Are you sure about that? Books Online doesn't seem to agree:
CREATE TRIGGER trigger_name
ON { table | view }
[ WITH ENCRYPTION ]
{
{ { FOR | AFTER | INSTEAD OF } { [ INSERT ] [ , ]
1; UPDATE ] [ , ] [
DELETE ] }
http://www.aspfaq.com/
(Reverse address to reply.)

Deny Administrator Access to DB

Hey all,
I am developing an application to track very sensitive company personnel
information. This of course raised the issue of protecting this sensitive
information from everyone not authorized to see it.....including the DB
Administrator. The DB Server (SQL 7) has many databases on it, but the
System Administrator must not be able to access the data in those tables
containing the sensitive information. I have tried denying an SA user
rights to SELECT from a table, but I could still select and view all the
data.
Any ideas?
Jeremy Byron
jbyron@.cynaptec.nb.ns.ca <remove ns to email me>
In article <7FF1D2C9B9DB6525.1907DEF59F04D933.8248BD072E33C3A D@.lp.airnews.net>,
Moi <moi@.here.com> wrote:
>Hey all,
>I am developing an application to track very sensitive company personnel
>information. This of course raised the issue of protecting this sensitive
>information from everyone not authorized to see it.....including the DB
>Administrator. The DB Server (SQL 7) has many databases on it, but the
>System Administrator must not be able to access the data in those tables
>containing the sensitive information. I have tried denying an SA user
>rights to SELECT from a table, but I could still select and view all the
>data.
>
AFAIK, this is not possible. Much like the root user in UNIX, sa must and
does, have access to everything.
|||Actually there may be a way:
1. setup a username and role for yourself with the appropriate rights.
2. have someone who should have access to the information change the sa
password at the console.
The downside is that if you ever need to do something with SA privledges,
you will need to have the person who created the password give it to you so
you can get in and do whatever you have to do.
This is more secure, but no foolproof. A sly DBA will be able to setup
their role in such a way that they won't need the SA password.
Tom
Moi <moi@.here.com> wrote in message
news:7FF1D2C9B9DB6525.1907DEF59F04D933.8248BD072E3 3C3AD@.lp.airnews.net...
> Hey all,
> I am developing an application to track very sensitive company personnel
> information. This of course raised the issue of protecting this sensitive
> information from everyone not authorized to see it.....including the DB
> Administrator. The DB Server (SQL 7) has many databases on it, but the
> System Administrator must not be able to access the data in those tables
> containing the sensitive information. I have tried denying an SA user
> rights to SELECT from a table, but I could still select and view all the
> data.
> Any ideas?
> Jeremy Byron
> jbyron@.cynaptec.nb.ns.ca <remove ns to email me>
>

Deny Administrator Access to DB

Hey all,
I am developing an application to track very sensitive company personnel
information. This of course raised the issue of protecting this sensitive
information from everyone not authorized to see it.....including the DB
Administrator. The DB Server (SQL 7) has many databases on it, but the
System Administrator must not be able to access the data in those tables
containing the sensitive information. I have tried denying an SA user
rights to SELECT from a table, but I could still select and view all the
data.
Any ideas?
Jeremy Byron
jbyron@.cynaptec.nb.ns.ca <remove ns to email me>
You cannot stop SA from looking at the tables...
HOWEVER - you CAN log the users that view the data.
For the tables that contain sensitive information, you can put a trigger on
the select, update, and delete to generate a log entry.
Of course, you would ask - "But the DBA can delete those rows". Sure they
can - but you can also log it so that you also have it generate a MSMQ
transaction where you can have a service that processes those records into
an external file store.
I would also reccommend seeing the July 2004 edition of SQL Server
Magazine - p.15 on "Privacy Matters" for some other suggestions as well.
=-Chris
"Moi" <moi@.here.com> wrote in message
news:7FF1D2C9B9DB6525.1907DEF59F04D933.8248BD072E3 3C3AD@.lp.airnews.net...
> Hey all,
> I am developing an application to track very sensitive company personnel
> information. This of course raised the issue of protecting this sensitive
> information from everyone not authorized to see it.....including the DB
> Administrator. The DB Server (SQL 7) has many databases on it, but the
> System Administrator must not be able to access the data in those tables
> containing the sensitive information. I have tried denying an SA user
> rights to SELECT from a table, but I could still select and view all the
> data.
> Any ideas?
> Jeremy Byron
> jbyron@.cynaptec.nb.ns.ca <remove ns to email me>
>
|||> you can put a trigger on the select,
Are you sure about that? Books Online doesn't seem to agree:
CREATE TRIGGER trigger_name
ON { table | view }
[ WITH ENCRYPTION ]
{
{ { FOR | AFTER | INSTEAD OF } { [ INSERT ] [ , ] [ UPDATE ] [ , ] [
DELETE ] }
http://www.aspfaq.com/
(Reverse address to reply.)