Voice of the DBA

Tag: upgrades

  • Reasons to Upgrade

    I ran across a good article from Glenn Berry about reasons to upgrade to SQL Server 2017. In the piece, Glenn talks about the fact that SQL Server 2008 and 2008 R2 will fall out of Extended Support in 2019. That’s about the time that SQL Server 2014 falls out of mainstream support, which is the support that most of us have. SQL Server 2012 has fallen out of mainstream support already. While I don’t worry too much about support, some of you may, especially if you are in a regulated industry. Or you’re in the EU, in which case the lack of support might be an issue if there is ever some security breach.

    The upgrade question is one that most of us ask ourselves constantly. Many of us use plenty of different software packages, and regularly need to decide if we want to pay for a new version of Windows, Office, SQL, SAP, Dynamics, etc. In some cases we may find valid reasons that will give us a nice ROI and are worth the cost. In others, we may wonder if we really need some new feature? I certainly find that in some software, there isn’t a compelling reason to upgrade to every new version.

    These days so much software is being released at a rapid pace that we regularly have to make decisions. I get a new version of Visual Studio Code, Evernote and TweetDuck, etc. every few weeks. Often I skip these upgrades because of convenience, and only upgrade rarely to prevent being too far behind. That’s a concern because if your software is too old, sometimes the upgrade is painful.

    At Redgate, we release patches and enhancements every few weeks, though we don’t expect many customers to necessarily upgrade more than once a quarter. There are monthly releases of SSMS and SQL Operations Studio, which I may or may not apply. Often I don’t because they’re an interruption to my work. Some of us rent software, like visualstudio.com, and we get upgrades whether we want them or not, though often we can use an older version for some period of time.

    Many of these decisions aren’t that impactful to our work as they are minor changes with little or no cost. Some aren’t, and these are the ones that many technical professionals will make recommendations on whether to proceed or not. The database platform is certainly a significant decision as the costs often can significantly impact a budget. This can be especially true for mission critical applications that might require more than one server to meet HA requirements.

    Do you tend to lean towards or away from upgrades? I’ve tended to lean away, with my default answer being I don’t want to upgrade. That’s if I don’t have a compelling reason. If things are roughly equal, I’ll stick with what works. That doesn’t mean that I don’t evaluate the new version and spend some time trying to determine what features or functions might be valuable. Certainly if any of Glenn’s features are useful, you might consider moving to SQL Server 2017. If you’re coming from SQL Server 2014 or earlier, than you ought to really look at the changes in SQL Server 2016, which are significant as well.

    We recently moved SQLServerCentral to SQL Server 2017. We had been on an older OS, with limited .NET support, and when we made the decision, we decided to go ahead and choose the latest version. That’s certainly a decision I do endorse. If I’m leaving 2012, 2008, or some earlier version, why stop at  SQL Server 2014 or 2016. Go ahead and get to the latest version, which means you might delay your next upgrade just a bit longer.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 4.7MB) podcast or subscribe to the feed at iTunes and Libsyn.

  • We Do Need To Upgrade

    I advocate that we should get a long life from our database platforms. In fact, I like to think about a 7-10 year lifetime for many of my database instances. That means I’ll get beyond the 5 year lifetime that Microsoft provides and move into the extended support. Actually, for most of my career, I’ve run instances without support and haven’t had issues. We invest a lot in databases, and I want companies to invest a lot because they are important. That means I need a good payback.

    Microsoft should provide security patches for products throughout the Extended Support period, which means that I should be able to run SQL Server and Windows securely for 10 years. that probably stretches the lifetime, but certainly that gives me time after five years to begin planning and prepping for an upgrade.

    The problems for many customers come when other vendors don’t bother to keep supporting older software and providing patches. Even if Microsoft releases a security fix for your OS, the vendor that makes software you run on top of Windows or SQL Server might not. That’s an issue, and it’s one that will become more of an issue as companies become reluctant to change software that works well.

    This article shows that older ATM machines running XP and Windows 7 are having issues. Some of this is physical access, but some is related to issues in the OS. While Windows 7 should be getting patches, Windows XP is not and needs to be upgraded. In fact, I’d argue that any losses here should be born by ATM owners and not covered by insurance for not having upgraded their systems.

    While I like to get as much time as I can from a system, it’s irresponsible to expect software to run without security patches being actively applied, which includes any upgrades from vendors. In some cases, this might be negligent by the companies doing so, especially for embedded systems. I don’t know that I want governments to force vendors to provide patches, but I’d like companies to write contracts that ensure that patches will exist for come lifetime of the products. In the event the company can’t provide patches (or certification), then they’d need to release their code as open source so that someone can provide a patch.

    The world becomes more intertwined and dependent on computing, from things like convenience services or core systems. We can’t have those systems becoming more vulnerable because companies are unwilling to upgrade and vendors abandon older software. Some sort of compromise is needed to ensure that computer systems are protected from known vulnerabilities.

    Steve Jones

  • It’s Time to Patch and Upgrade

    I don’t want to be chicken little here, but the Meltdown/Spectre bugs have me concerned. I don’t know the scope of the vulnerabilities, as far as exploits go, but I do know the lax ways in which humans interact with machines, including running code, opening untrusted documents, and just making silly mistakes. No matter how careful you think you are, can you be sure everyone else in your organization is just as careful? Are you sure they won’t do something silly from a database server? Or do something from a server (or workstation) that has access to a database server? Or use a browser (yes, there’s an exploit)

    PATCH your system, soon.

    Vulernabilities in hardware are no joke, and even if you think you’re fairly safe, it’s silly to let this one go by and assume you won’t get hit. The advent of widely deployed scripting tools, botnets, and more mean that you never know what crazy mechanism might end up getting to your database server. Is it really worth allowing this when you can patch a system? This is a no brainer, a simple decision. Just schedule the patches. With all the news and media, I’m sure you can get some downtime approved in the next few weeks. After all, your management wouldn’t want to explain to their customers any data loss from this any more than you’d want to explain it to your boss.

    We’ve got a page at SQLServerCentral that summarizes the links I’ve found for information, patches, etc. I’m sure things will change rapidly, and I’ll update the article as I get more information. The important things to note are that not all OSes have patches yet, and there are situations where you might not need to change anything. That’s good, as there are some preliminary reports of patches causing issues with performance (degrading it) for PostgreSQL And MongoDB systems. I did see this tweet about no effects on SQL Server, which is good, but YMMV.

    Most of us know patching matters, and we need to do it periodically (even if it’s a pain), however, many of you are like me in that you rarely upgrade systems. Once they work, and because I have plenty of other tasks, I don’t look to necessarily upgrade a database platform for years. One downside to that is that a major vulnerability like the Meltdown/Spectre attacks is that patches likely won’t come out for old system and versions of SQL Server. That is the case here.

    That means that if you’re on SQL 2005-, or even on older Windows OSes, you might really consider planning an upgrade. Even if you aren’t overly worried about this exploit, you won’t want a vulnerability to live for a long time in your environment. You never know when a firewall will change, server will move, or some malware will slip through (did I mention the browser exploit?). Plan on an upgrade. I’ve started asking about accelerating our upgrade plans, and you might think about that as well. I know management doesn’t want to spend money unneceesarily, but this feels necessary, and a good time to refresh your system to a supported version.

    In general I like to delay my patches slightly from the world and not be on the bleeding edge. That’s fine, but don’t wait too long with this one. I would hope that most people get systems patched in the next month. If not, don’t expect any sympathy if you lose data.

    Steve Jones

    The Voice of the DBA Podcast

    Listen to the MP3 Audio ( 5.4MB) podcast or subscribe to the feed at iTunes and Libsyn.

  • How Long Before You Upgrade?

    This editorial was originally published on Apr 11, 2014. It is being re-published as Steve is out of town, with a few minor changes to dates and values.

    It’s 2017. SQL Server 2000 is 17 years old, but there are still quite of you managing instances. SQL Server 2005 is 12 years old, and I’m sure more of you still deal with that version. I know because I work for a software vendor and I’m constantly asked if our software will run against those two versions of SQL Server. Most of our software is no longer supported on those versions, as they’re too far out of date.

    For many of you, however, if you’re managing a SQL Server 2000 instance, it might only be 10 or 12 years old. Your company might still have been installing SQL Server 2000 in the year 2005. The same is true for SQL Server 2005. I wouldn’t be surprised to find companies still installing 2005 instances in 2008 or even 2009.

    Companies don’t care much about versions. They tend to mostly care about databases getting the job done, and sometimes, support. Many organizations don’t see value in upgrading too often because of the overhead. I suspect many managers would prefer to get many years usage out of a platform before they change in order to minimize work that doesn’t add value to their business.

    The question this week asks you about the longevity of your database instances. Think about the average instance, or even the majority of your applications and how long they will remain on a particular version.

    How many years will you run a platform before you upgrade it?

    Years ago I heard someone at a large Fortune 100 company say their stated policy was to get 10 years of service out of a database server. At the time I thought that was a long time, but the more I think about it, the more I think that might be a minimum amount of time I’d want from a platform.

    Let us know this week what you experience, and perhaps what you’d prefer.

    Steve Jones