Voice of the DBA

Tag: Database Weekly

  • The SQL Server 2016 Plan

    SQL Server 2016 went out of support this week, on Jul 14, 2026. This is the end of the Extended support, according to the Support Lifecycle page. Microsoft posted an article on next steps for SQL Server 2016, which looks like the AI read of an article at the top. There’s a lot of header info, so scroll down. I’m sure none of you want to listen to 10 minutes of an AI voice reading an article.

    I know some of you still run SQL Server 2016. In fact, I still run into some companies on older versions, and the last (ever) update from Brent also showed 6% on 2014 and older. There are probably still plenty, albeit a minority, of systems on older versions. I know when I worked in a non-regulated industry, we weren’t in a hurry to upgrade as many of our applications ran fine on older versions. Especially with VMs these days, I could see people sticking with 2016 for a while if it’s running well. Just be sure your server is well protected by firewalls.

    The blog gives 3 upgrade paths: Azure (IaaS or PaaS), SQL Server 2025, or Extended Security Updates. That latter one goes until 2029 if you want to pay for it. This is certainly a marketing post more than a technical one. Moving to Azure PaaS isn’t necessarily easy or quick. IaaS doesn’t help you here, so I’m sure whoever wrote this post (or whatever AI) isn’t thinking this through. An Azure VM isn’t going to get me any support.

    SQL Server 2025 is likely the easiest if you want to upgrade, as you could continue to use an older compatibility level in your database on SQL Server 2025. It will cost something, but it does give you 9-ish years of support and updates. I’d certainly prefer this over paying for ESU. It might not be a seamless upgrade, but I’d give it a quick go and see if my application worked on a restored 2016-on-2025 database. That’s an easy test and helps me make a decision.

    I suspect some in regulated industries need support for their compliance goals, and they might pay for ESU if their staff is busy and they need to mitigate an audit finding. I think this option is there, and it’s expensive, as a carrot/stick combo for organizations to upgrade. I can’t be upset about this, as I think there should be a plan in organizations to keep their software up to date. Either deliberately plan to remain on an older version and accept the risk, or ensure you have plans (and time) in place to regularly upgrade systems.

    If you’re on SQL Server 2016, what are your plans? Upgrading soon? Sticking with the platform? And if you’re on 2017 or 2019, you ought to be thinking forward and be ready to handle the end of support for those versions.

    Steve Jones

  • Is Fabric a Reliable Service or a Ripped Resource?

    Over the last few weeks, I’ve noticed a few complaints from different friends and customers about issues with Microsoft’s Fabric service. I had assumed these were isolated incidents in just a few places, and customers were being refunded according to an SLA. Then I saw Joey D’Antoni’s post this week about Fabric going down. It lists quite a few of the incidents in June, including a few global ones.

    However, the most surprising thing in the post was this link, noting Fabric doesn’t have a dedicated SLA. Instead, it’s under the general Microsoft support agreement, meaning your organization needs to have a support plan to get help. I think that makes some sense, but I’d really expect that a data service in the cloud, including an analytic service that touts itself as real-time, would have a high SLA. Some agreement on the order of 4 9s at least, if not 5.

    For those of you who think you can do better on premises, I’ll remind you that four 9s mean you get 52 minutes of downtime a year, or 1 minute a week (roughly). Five 9s is 5 minutes a year, and the weekly calculation doesn’t matter. I’ve had systems run for a year, but a lot, and not a lot of databases, especially with patching 6 times a year. This year, with AI (my guess) finding lots of holes and GDR releasing quite often, I would guess that three nines is out the window for most SQL Server systems that aren’t HA clustered in some way.

    As a point of reference, Denny notes that Azure SQL database, Business Critical, has a four-and-a-half 9s level of reliability and financial refunds for costs if that’s exceeded. You will need some sort of business insurance if you worry about revenue issues, but my guess is that most of us live with the downtime and work around it (and hopefully, plan for it).

    I’ve been skeptical of Fabric (outside of Power BI). It feels cobbled together, so many issues are reported, and I feel like it’s immature. If I were working on a new analytics project, and we didn’t have a solution, I might PoC it, but I’d be more likely to consider Databricks, Snowflake, or Redshift rather than Fabric.

    Perhaps you have a different view, or you have had success with Fabric. I know some people who have, but it seems one-sey two-sey and not commonplace. There seem to be so many workarounds and issues; it makes me skeptical that Fabric is really ready for primetime if Microsoft won’t stand behind it. Databricks only gives credit up to three 9s, but if they fall below 95%, they issue a 100% credit. Snowflake offers four 9s.

    I feel that if Microsoft were confident in their reliability, they’d offer refunds if they didn’t perform.

    Steve Jones

  • Liability for AI Errors

    This week there was an article that speculated that doctors in the UK could be liable for errors made by AI tools unless rules are changed. The argument is that AI tools should be treated as products, which isn’t necessarily the case right now. Right now doctors may face all the liability instead of AI tool makers having some responsibility. From my reading, this doesn’t appear to say that doctors aren’t still accountable for mistakes, but they aren’t wholly accountable. The Medical Protection Society wants the technology vendors to bear some responsibility.

    I have to admit I’m torn here. If doctors are using tools, they should be sure the tools work well and they agree with the recommendations or results. However, I think AI changes things somewhat. If I read a medical device, say one that analyzes blood, I expect that the results are deterministic and accurate. If they aren’t, how could I, as a doctor, know that. The companies the built (or maintain) the device would be culpable for errors.

    Using AI assistance, however, is a little different. This is a non-deterministic interpretation of data. In the same situation, if an AI were to interpret blood results and summarize them, perhaps failing to point out a deviation of a value and this impacted patient care, is the AI responsible? The doctor for not realizing there is an issue? Joint responsibility?

    I think it’s unclear. I’m not 100% sure how I feel here, and I lean towards both being liable. If someone is training an AI model to help with medicine, then they ought to bear (and feel) accountable for results.

    This seems different than software engineering to me. In medicine we have humans overloaded and AI is supposed to help, but has to be responsible. I don’t think the stakes are as high in producing software. It’s an arbitrary decision to say we need to get xx work done with yy resources. AI can help, perhaps amplify the abilities of people to produce code, but the people still have to verify the AI results. Any time pressure is a decision we make, not one brought on by medical issues.

    Perhaps this seems hypocritical, and I will admin I’m not 100% sure how I feel, but I’m more concerned with AI technology bearing responsibility in healthcare than software. Do you feel the same way? Or perhaps in either case the AI is just a tool? Let me know what you think,

    Steve Jones

  • The New Wave of Security Threats

    We’ve had quite a few GDR patches for SQL Server released this year. If I glance at the Build Lists I maintain, I see Sept 2025, Nov 2025, Jan 2026, and Mar 2026 GDR patches. That seems rather frequent as the history of builds for recent versions has often seen them without any GDR, out-of-band patches. Just CU after CU every other month.

    That pattern of rare security updates might be changing for lots of software, not just SQL Server. There was an article recently that noted AI tools might start exposing lots of bugs, including security holes, in software that has been around for years. Someone recently used AI found bugs in both PostgreSQL and MariaDB that have been around for years. They are patched, so if you run those platforms, make sure you patch things. The information is out there and someone is looking to take advantage of it.

    Anthropic built a new model, Mythos, which has not been released publicly. It’s been given to a few customers who have used it in testing, and it seems that it might be more capable than expected at finding bugs. Hopefully, we will find out how good it is soon and lots of companies can use it to examine software. It’s certainly a danger as hackers and criminals might use it, but I believe that (responsible) information disclosure is better for everyone.

    This is also a good reminder that you need to patch your systems. I certainly get wary about updating on day 1, but I do try to patch without too much of a lag. There are no shortage of zero-day attacks, but I also weigh the risk of instability from patches of questionable quality. Many vendors do a great job of patches and upgrades most of the time, but “many” and “most” aren’t “all”, so I prefer to let others test early. Someone has to apply the patches on day 1, but I don’t want it to be me.

    Security is getting harder, it’s getting more burdensome, and it’s becoming more important. At the same time, lots of people are building better security with new tools, including AI. Just make sure you apply those patches to take advantage of their work.

    Steve Jones