I have a Microsoft ASP.NET MVC web application with SQL Server 2008. Currently running on a single server, performance is reasonable. However I now need to deploy the same application to support much higher volumes. There are also a number of high-load services (for real-time route scheduling and processing of data feeds).

I believe that I will need a separate database server and one or two web-servers.

If I host at somewhere like 1&1 or Rackspace I presume they will advise. However I would like some idea before I start any discussions.

One area I’m not sure about is the windows server versions I should be using, CPU/memory requirements, whether these hosting providers offer load-balancing and kinds of costs involved.

EDITED:

I agree this is quite vague still. Perhaps I should post a question regarding the techniques for estimating server requirements? I’ll search some previous posts.

However I now need to deploy the same application to support much higher volumes – 10,000 basic
orders per week

Bad programmer? 10.000 oders per week are not a lot. assuming they come in 5 days and 8 hours (not all week long) that is still only 0.069 orders per second, or 4 orders per minute. Assuming a 3 times peak this still is just 12 orders per minute.

You need multiple servers for one order every 5 seconds? Maybe you did not use any index on your database?

A small virtual server should be good enough.

Check more discussion of this question.

This is my first attempt at virtualizing SQL server on VMWare and I want to make sure I am doing things correctly.

Should I have SQL server installed on the C: drive / same partition as the OS,
Then add a virtual disk for the Data files, say 300GB, and then another virtual disk for the log files say 100GB?

Or should I add 2 300GB vdisks, for the data files mirror them in the operating system, and then add a non mirrored vdisk of 100GB for LogFiles??

If the virtual disks are all on the same underlying spindles, then it doesn’t really matter. If they’re on different sets of spindles and your use case will benefit from the extra IO, then do that. It’s really up to you to profile your usage and determine whether or not you would benefit from this.

That said, if they’re all on the same spindles now, but you plan to grow to separate sets later on, separate virtual disks now will make that migration easier down the road.

At no point in this process does it make sense to introduce Windows software RAID unless you have no other RAID factoring in anywhere.

Check more discussion of this question.

I have just been given access to a new Windows Web Server 2008 R2 which has SQL Server 2008 R2 installed on it. When I open up SQL Server Management Studio and try to connect, it does so with Windows Authentication, however, it does not ask me for a password, and it successfully connects.

I am worried that (hopefully not) someone who shouldn’t be accessing the server does so, and can then easily connect to SQL Server Management Studio without even being asked for a password, and then have access to the databases. For example, someone who has stolen the Windows Web Server login details. They now are logged onto the Web Server, and because the login details they used identify that user the privileges to access SQL Server with Windows Authentication (no password needed), they can then access the databases and data.

What would be the best approach here to ensure that anyone who wants access to my databases, must enter a password?

I know I can create user accounts inside SQL Server and assign users to specific databases (SQL Server Authentication), but this doesn’t get around the issue of a user who shouldn’t be on the server, just selecting Windows Authentication type, enter no password, and have full access to my databases.

Can someone please advice this on this?

Thanks folks.

If you’re worried about securing the database against a malicious user that gains access to the box, there’s not a lot you can do. If a Windows login on your server is compromised, they can just as easily put the database in single user mode and get at anything in it without needing valid credentials. This is why you’ll typically see scenerios where the web tier is in the DMZ and the database tier is on the trusted side of the firewall with only specific ports open between the two.

Worry about keeping your box patched and well-secured, don’t worry that if someone hacks your box and has privileged credentials, that they might be able to see your database. If they’re already at that point, they have everything they need already.

Just selecting Windows Authentication type, enter no password, and have full access to my databases.

I think you might be misunderstanding how this works. It doesn’t grant any Windows user the ability to access the databases, only ones that you’ve specifically allowed. Unless a user has been granted a logon to the SQL Server instance, a Windows user can’t just get it. I’m assuming that you can because your user account has been granted access.

If want to see all of the logins (users, groups, and SQL logins) that have access, you can run select loginname from master.dbo.syslogins. You can check this list against who should be allowed access to verify that you haven’t accidentally given rights where they aren’t needed.

Check more discussion of this question.

Possible Duplicate:
How to Deploy an ASP.NET Web API- and Browser-based Application to a Production Environment

We have an ASP.NET Web API server that serves up a SQL Server data driven website. The API uses JSON to transfer data from SQL Server to the front end.

We need to move it to an internal production environment (nothing will be exposed on the public Internet) and we’re having problems – or just not understanding what needs to be done.

There are two domains:

1. The corporate domain – where all users login normally.
2. The process domain – contains the database the Web API needs to access.

The IT staff wants to put a DMZ between the two domains to house the IIS app and shield the users on the corporate domain from having access into the process domain directly.

The ideal configuration is:

corp domain (end users) <–> firewall (open port 80) <–> DMZ (web server running IIS) <–> firewall (open port 80 or 1433????) <–> process domain (IIS for Web API and SQL Server)

We don’t really understand how to deploy our browser/Web API application in this scenario.

1. Do we need to break up our application so that all the client code is on the IIS server in the DMZ, while the Web API gets installed on the server in the process domain?
2. Does the entire app (client code and Web API) stay together on the IIS server in the DMZ, which then somehow accesses the SQL Server instance to get data?
3. From the IIS server and app in the DMZ, would you simply access the Web API on the server in the process domain by going to http://server/appname/api/getitmes?
4. In the second firewall between the DMZ and the process domain, would you have to open port 1433 or just port 80 since the Web API is a HTTP endpoint?
5. Or, is there some better way of deployment (i.e., how ASP.NET Web API single page applications written all in HTML5 and JavaScript supposed to be deployed to production environments?)?

NB: The servers are Win2k8 R2, SQL Server 2k8 R2, and IIS 7.5.

Typically speaking your code is going to be deployed on the IIS server. This means your “web api” and website.

Quite frankly I don’t think your using the correct terms here as what you seem to be saying is that you have a web site which communicates with a web service that then communicates with the sql server for data access.

The web service and website would be on one or more web servers outside the DMZ. The database server would be inside the DMZ. The DMZ should be configured to only allow requests from your web server(s) to go to the database server. Usually over port 1433 or whatever port SQL is configured to use.

Outside the DMZ, a firewall should be in place to limit access to that web server on ports 80 or 443. 80 if it’s not SSL, 443 if SSL is enabled.

Check more discussion of this question.

I am collecting PerfMon counters on a SQL Server 2008 server (which is hosted on a VM), and I am getting different Page File % Usage values for _Total and C:\pagefile.sys. The C:\pagefile.sys values are consistently at zero, and the _Total values are consistently around 26. Other counters (Memory Grants Pending, Page Life Expectancy, Processor Queue Length, Available MBytes) all are showing values indicative of memory and cpu pressure, so I would think that there would be some indication of paging to disk (which the _Total pagefile usage value agrees with but the C:\pagefile.sys instance value does not).

Would anyone have insight into how I should evaluate these two Pagefile % Usage values to determine the actual pagefile usage on the server? Does the fact that the Server is a Virtual Machine have anything to do with why there are two values?

Would anyone have insight into how I should evaluate these two Pagefile % Usage values to determine the actual pagefile usage on the server?

There are a few things that can be happening here, I’ll list them in order of likelihood:

1. You don’t have a pagefile at C:\pagefile.sys. It’s incredibly rare for there to be absolutely zero usage. You can check the location of your pagefile(s) by running wmic pagefile /format from an elevated command prompt.

2. You have more than one pagefile and the one on c:\ just isn’t getting any use. Still pretty uncommon but possible. Run the command above to verify.

3. You’re reading the Perfmon graph incorrectly. Pretty unlikely, since it’s straight forward, but worth mentioning since you didn’t post a screenshot of it.

Does the fact that the Server is a Virtual Machine have anything to do with why there are two values?

No.

Check more discussion of this question.

we have a medium sized SQL db of around 40GB, and are about to move it to a new box with server 2008 r2 x64

some expensive contractor blokey has just come in and said we need 72gb of ram so that the whole DB can live in RAM i guess.. , I find that ludicrous, but maybe its me being a wally..

wonder if there is a ‘rule of thumb calculation’ that hints at a good amount of ram to use on a SQL instance..

EDIT:
DB has up to 150 people hitting it at any one time, used to run a booking system. very nasty old DB schema, hideous amounts of columns in alot of the tables, vast arrays of semi pointless indexes.
accessed by .net hitting some sprocs, but also chucking raw sql, and whatever VisualDataFlex uses.

thanks

nat

There is no good rule of thumb.

The usefulness additional RAM depends very much on how your database is designed and the query patterns or your users. As an extreme example, if you have 1 TB of data in total, good indexing and 1000 simultaneous users that only ever go after 1 particular row (select * from dbo.BigTable where pkey_id = 42), you could get by with very little RAM. The impact of more RAM can also depend on how fast your disk storage subsystem is. If you have super fast storage (a good SAN, good DASD or SSD) you may not notice lag when the server needs to read data.

Ideally, you want all of the data that the database is likely to need during the day cached in RAM. This is sometimes referred to as “hot data” or “hot pages” (In SQL Server, data is organized in units called “pages”). An example of hot data might be orders taken today or yesterday, that will be needed by workers shipping those orders. An example of cold data might be orders taken two years ago, but that still exist in the system so that CSRs can look up old orders.

With a well-designed OLTP system with 40 GB of data in total (as opposed to data files that add up to 40 GB), it might be possible that the hot data only comes to 10 GB, 5 GB, 1 GB or even less. In olden days, the difference between only buying 64 GB of RAM and 8 GB (or even less) was astronomical and getting the amount of RAM to be purchased right was worth spending a lot of time on.

You always want a little extra RAM for “overhead” like the OS, virus scanners, RDP sessions. You also want to take database growth into account.

Another thing to keep in mind is that RAM comes in “chunks”. You can’t decide between 48 GB and 49 GB, you have to step up, probably from 48 to 64 GB. The size of the chunk depends on the RAM technologies currently being marketed and how many channels your memory has. Old servers had one change to memory, then servers started having two and now most beefy servers have three memory channels. So, you can’t just add one stick, you need to add two three at a time.

If you have a poorly designed and badly indexed database, as you say you do, SQL will wind up reading lots of data that it would not have to with a better designed database. Having that data all in RAM doesn’t mean that it doesn’t read through it all. It just means that it reads through all of the data in RAM faster than it could if the data was sitting on disk storage. That isn’t necessarily going to fix all of your problems; reading data from RAM is fast but still takes a finite time and you can still get blocking and deadlock issues which can cause performance problems.

Another thing is that more RAM helps when people run large reports on the system that do utilize last year’s data. People treat OLTP systems like reporting systems all the time. This may not be a rare occurrence, particularly with haphazard SQL queries.

You could spend time (and money) on developers and testers to improve the database design and make whatever changes to the front end that this would require.

A very quick trip to hp.com shows that I can get a (very) stripped-down server with 96 GB of RAM for about $9,000 US.

(That’s less than $100 US per GB, without factoring out any of the other parts in the server. Parts like the power supply or the processor. Old people like me remember when RAM was $5,000 US per Mega Byte. With an M.)

How fast can you spend $9,000 US on development and testing time? (At corporate rates in my area, that would barely get you one whole person for one whole month.) Will that be enough time to fix everything in the database? What if a bug in the changed code slips through?

A server outage to add RAM might take an hour, and nearly anyone can do the work. Migrating onto a totally new server might take a couple of days of prep work and an hour of down time, and you will need someone with experience (a DBA, probably).

Adding RAM is unlikely to cause any bugs. Migrating to a new server is unlikely to cause any hard to find problems. (Generally, stuff either works or it is obviously broken. It’s usually “oops, wrong password” or “oops, forgot to copy a linked server”, it’s never “hey, this calculation suddenly doesn’t work correctly”.)

So, assuming that we are going to keep everything in RAM and we have a 40 GB database, we want some room for overhead. I’d be thinking a server with 48 GB or so. Plus, we want some room for growth. Let’s just say 25% growth from here, which is 12 GB and takes us up to 60 GB. The next level up (which I can actually buy) is 64 GB. If your consultant is recommending a triple-channel server, the next level up might be 72 GB. So, his suggestion isn’t necessarily outlandish. Maybe you don’t need as many cores/sockets, and that might drop you back down to a dual-channel server (which would be cheaper anyway) and you could buy a little bit less RAM.

TLDR:

In short, which I rarely am, RAM is cheap and time is expensive. If you don’t have the money, time or inclination to fix the database or you don’t want to risk adding bugs to your application, throwing RAM at the problem is hard to question. The other good move is to improve the responsiveness of the disk storage system (IOW, add more spindles, more RPM or go with SSD).

I would be asking why the consultant didn’t want you to spend a year and a $100,000 US for him to rewrite the system.

Check more discussion of this question.

I checked my SQL Server 2008R2 log in Log File Viewer and found out that someone from China keeps trying to login as ‘SA’ all the time, but failed of course.

Is there anyway to prevent these hackers attacking my server?

Thanks in advance.

Use firewalls – why on earth is that port (or any ports on an SQL server) open to the rest of the world?

Most business have multiple network tiers;

• start with a firewalled/load-balanced web tier which has a firewall between it and the application tier allowing just the specific IPs and ports of known web servers in the web tier to talk to specific application servers in the application tier.
• the application tier can only talk to specific IPs and ports in the web tier and can only talk to the DB server, again firewalled, by IP and port.
• the DB tier which again is firewalled and only allowed to talk to the application tier servers by IP and port.

Some (myself included) also have a secure tier behind the DB tier to handle any data that’s particularly sensitive or contractually has to be more secure.

This is a model used extensively and generally proves to be very safe. The idea of exposing your SQL management port outside literally made my spine shiver, please stop this or you WILL be back looking for THIS.

Check more discussion of this question.

I have a Windows Server 2008 R2 running Microsoft SQL Server 2008 R2. I have some how lost 300 GB of disk space, and I can’t seem to find it anywhere. The Hard Drive is 500GB and I can only account for 200GB. I have “Show Hidden Files” on and “Hide Protected Files” off. I have check the details for every folder top level folder, and I still can only find 200 GB of a 500 GB Hard Disk. The disk is almost full and this doesn’t make any sense. Any one have any ideas of where I might be able to find this lost space? On a weekly basis I delete old back ups of the databases. Maybe that might have something to do with it?

Use Windirstat. It’ll give you a graphical view of your disk space usage, as well as sort your folders by space used. A lot easier than trying to hunt through Windows Explorer for what’s chewing up your disk space.

Check more discussion of this question.

Is there a tool from Amazon or Microsoft to automatically upgrade an ec2 instance’s sql server 2008 to 2012? Or do I have to create a new instance and then import all the databases?

One of the joys of EC2 is that you can create instances so easily, for the tiny cost of a few hours of runtime. I’ve had so many system upgrades (win/mac/unix) go wrong that I would recommend doing a test run on a different instance no matter what.

But to answer your question, I know of no Amazon tools for updating an instance from 08 to 12. Microsoft’s website contains enough Notes and Cautions that I would be careful with any tools from them as well.

That web page does say specifically:

Upgrade of an earlier version of SQL Server to SQL Server 2012 is not
supported on a computer that is running Windows Server 2008 R2 Server Core SP1.

Check more discussion of this question.

I have a big problem with the SQL Server Agent hostory. it has become VERY VERY slow when i try to view it. If I try through Management Studio I often get a timeout and if I try viewing it with sp_help_jobhistory it is just running for a long time.

I tried reducing the hostory size and the sysjobhistory table has only 8000 rows….

Is there any way to optimize this somehow?

Thx a lot
Nicolaj

Ensure that the sysjobhistiory table is not fragmented. The easiest thing to do is reindex it. Since the table is so small, the reindex should happen quickly.

Check more discussion of this question.