Voice of the DBA

Author: way0utwest

  • Quick Security Mistakes

    How many of you have gotten an urgent request from someone in your organization? Maybe it’s a new database, perhaps a quick, “simple” change to an application, possibly even a new server or share that someone can use to complete their work. It’s something new that you need to do. When that happens, how many of you ensure that you follow all the same steps and protocols to comply with the urgent request?

    A few of you do, but when we’re in a hurry, many of us don’t necessarily complete every step. We may shortcut something to get work done. We may have the best of intentions to go back and complete the work, but in a busy environment, it’s easy to forget to complete that last step, which might be configuring security or running all or unit tests or even decommissioning some resource that a user is done using. Some of you will realize these are big missteps, and some of you will still make them.

    Someone at the Department of Transportation in Coloroado (CDOT) made a mistake like this (thanks to DCAC and Joey D’Antoni for the story). They stood up a virtual machine, connecting it to their local network, but failing to properly secure it. In this case, the machine was exposed to the Internet and connected with a domain admin account. As you might guess, someone got into the machine and executed a ransomware attack on CDOT.

    As Joey points out, a few mistakes were made here, but these are the types of mistakes that anyone can make. Lots of us follow a process over, and over, and over again. Until we don’t. Until we’re distracted, busy, or in a hurry. They we take a shortcut. Most of the time nothing happens, but most of the time is becoming less acceptable. All of the time is the standard, which is why we try to use a DevOps, GitOps, or other process that ensures all the steps are completed. Not most of them.

    Do yourself a favor and build processes to handle your tasks with a script or the push of a button. Ensure the operations are logged and audited. Use these processes to be sure that setting up a new system, database, application, etc. is done in a consistent and secure manner. There’s still plenty of work to do for all of us. These processes will grow and change over time, and need to be maintained. Use your brain for the hard problem solving task of building a process and let the computer execute it, the same way, to completion, every time.

    Steve Jones

    Listen to the podcast at Libsyn, Stitcher or iTunes.

  • The Art of Commenting

    This week I noticed an article on comments in PoSh over at Simple Talk. It’s a nice look at the topic from Greg Moore and discusses the various ways that you can comment in the language. Since these scripts are often shared in a corporate environment and because they may outlast your tenure, it’s a good idea to include comments in your scripts and functions.

    The idea with PowerShell is similar to what you get from docstrings in Python. Since many people can script and build modules, being able to get some help and understanding of the code is important. Even for the modules I write, I may use them for some time and then put them down. When I go to use the same cmdlet or function again, I might not remember all the parameters or what I was thinking. If you’ve ever had to dig into code to understand what is happening, you quickly learn to appreciate those well documenting help strings.

    You may quickly learn to despise those that don’t write them well or even forget to include them at all.

    Writing a useful comment is a bit of an art. The author often needs to put themselves in the shoes of a less skilled individual, or maybe one that is context switching and needs to quickly understand what the code is doing. Not necessarily exactly how it works, but what it is supposed to do. This helps us decide if we can use the code quickly, or if we might need to dig in further.

    In the article, Greg points out some nice additional comment items, such as requirements for the module to run. These are the types of quick enhancements to code that greatly improve its useability for others. I’d highly recommend everyone learn about comment based help in PoSh, docstrings in Python, and other valuable commenting techniques in your language of choice.

    Learning to write good comments is a valuable skill, one that your team will appreciate. Since most of us work on teams these days, those skills just might make you more desirable for that next promotion or even a new position when word gets out. Practice becoming a good comment writer.

    Steve Jones

  • Planning a Sabbatical

    This is a little off topic, but it’s a part of my career and something I think more companies ought to think about offering, at least to some of their staff. This series of posts documents the time away from Redgate Software. My employer, Red Gate Software, offers a sabbatical to their employees, and this year (2019) I’m taking my second one.

    It’s time for my second sabbatical from Redgate Software. This is an amazing benefit that they offer, and it’s one I greatly appreciate. I documented my first one under the Sabbatical tab on my blog, and I’ll do the same here.

    I start on Jan 13, though really my last day of work will Jan 10. I won’t be back until Feb 26, taking an extra two days as I have a conference speaking commitment in the middle of this time.

    Building a Plan

    This sabbatical has been tougher to plan. I’m really a year and a half late with this one, being unsure of what to do with my time. I haven’t had any burning desires, and a few ideas were a little hard to fit in, both from a time and a resource standpoint. Six weeks is a lot, but not a lot for many structured learning programs.

    With my kids leaving the house this year, my wife and I are starting to think about tackling some projects around the house that we’ve never had time, money, or desire to do. Our basement and garages are a mess, and there are some repair items we’ve let go for some time.

    I’ve also had the desire to do something more for myself, which I’ve often neglected in order to spend time with my kids. I don’t regret anything, but this feels like a good time to maybe change that.

    The House

    Last year I found a box in the basement that I’d packed up over a decade ago. In fact, it was one I’d packed at a previous house and never used unpacked here. That started me thinking I really need to take time and get more organized. At the same time, my wife got interested in KonMari, and we started slowly working on our bedroom.

    Six weeks isn’t a lot of time, but it is time to get things started. The previous owner framed out our basement and ran some electrical wires, but never finished anything. We’ve debated doing something over the years, and this is my time to start down there. I plan to clean out old stuff, donate lots, throw some away, and insulate the upper part of the basement. I may start some drywall, but we’ll see.

    In conjunction with that, our garage has become a holding space for lots of things and I want to rebuild some shelving and get organized there, at least enough that I’m more proud of the space than I’ve been. I have a mini wood shop, but it’s more a pile of stuff around some tools, and I’d like to fix that.

    Music and Sports

    I love music and sports, as does my wife. I think we’ve given that love to our kids, all of whom have enjoyed time on the slopes and music in their ears. I want to do a bit more in these areas myself, so I’ve allotted a bit of time here for myself.

    A couple years ago we bought a place at Keystone Lodge. We’ve used it a bit, but relatively little in a busy life. This winter I want to spend more time there, and am hoping to go spend a night a week there while on sabbatical. I’m not completely sure I will, but I do want to go skiing every week if possible.

    In line with that, I want to learn to play guitar better. My middle son played cello all though high school and then picked up guitar afterwards. He actually took an old guitar I had to college, bringing it back a few times last year. He impressed me with his skill and inspired me to do better. I’ve barely touched one in the last few years.

    As a part of my sabbatical, I wanted to play for an hour a day. That doesn’t just happen, and it’s not really even possible without prep, so I’ve been trying to spend more time every day or two building up some strength and calluses to let me focus during my break.

    I also bought an online course, so I plan to go through a module a day and try to both learn more and build some skill. We’ll see how that goes, but it’s the plan for now.

    It’s a Lot

    That’s a lot to do, and as I write this down, I know I won’t get as much done as I like. I also know that not having a specific goal of getting all this done reduces some stress. Instead, I want to work towards time. An hour on guitar, 6-7 hours on the house or skiing each day.

    Around that, I still have life, with time in the gym, coaching, cooking, and getting time with my wife. Hopefully I end up with a nice sense of accomplishment at the end, with real physical changes in my world that I can see and touch.

    I’m looking forward to it, and will try to spend a few minutes each day documenting where I am. No matter how much gets accomplished, I am looking forward to another long break of limited connectivity.

  • The Time to Patch

    Microsoft has spent years working on building a reliable and dependable patch process for their software. While some products have had more sporadic updates, SQL Server has moved to a fairly regular schedule. Not quite a predictable “Patch Tuesday” schedule, but you can count on a CU arriving every month or two for SQL Server.

    Most people don’t patch every month, but slowly customers are getting used to regular patches for SQL Server. Microsoft would prefer you use one of their “evergreen” releases, where Microsoft is in control of patching. Azure SQL Database, and Managed Instances are handled this way, but with Azure Arc, you might deploy these inside of your data center and not worry about patching anymore.

    Most of us won’t get there anytime soon, and we will need to patch our instances. This week, I’m wondering about your patching process. Not whether you patch or not, but rather the extensiveness of your patching when you do decide to apply a CU.

    If you decide to patch a particular version in your environment (2016, for example), how long does it take you to patch all your SQL Servers? Do you even get all systems patched, or are there always lingering systems that can’t be updated because of some dependency?

    Maybe one other question might be how long does it usually take you to decide to patch your systems to some level? Or do you just randomly patch instances as needed?

    I am a big fan of leaving systems alone that are running well, but it seems the quality of patches from Microsoft has improved over the years. I’m not quite sure I’m at the point where I want to patch everything to month a CU is released, but I do think a regular process is a good idea, and hopefully it’s one that completes all instances for a version in less than 30 days.

    Steve Jones

    Listen to the podcast at Libsyn, Stitcher or iTunes.