ptg 694 CHAPTER 22 Administering Policy-Based Management Execution Modes When you are implementing policies, there are three types of execution modes. The On Change mode has two variations: . On Demand—The On Demand policy ensures that a target or targets are in compli- ance. This task is invoked manually by right-clicking on the policy in the Management folder, Policy Management folder, Policy folder, and selecting Evaluate. The policy is not enforced and is only verified against all targets that have been subscribed to that policy. You can evaluate a policy also by right-clicking on the database and selecting Policies and Evaluate. . On Schedule—Policies can be evaluated on a schedule. For example, a policy can be scheduled to check all SQL Server 2008 systems once a day. If any anomalies arise, these out-of-compliance policies are logged to a file. This file should be reviewed on a periodic basis. In addition, whenever a policy fails, the complete tree in SQL Server Management Studio displays a downward-pointing arrow next to the policy, as shown in Figure 22.1. . On Change Prevent—The On Change Prevent execution mode prevents changes to server, server object, database, or database objects that would make them out of FIGURE 22.1 SQL Server management tree illustrating failed policies for table name. Download from www.wowebook.com ptg 695 Policy-Based Management Concepts 22 compliance. For example, if you select a policy that restricts table names to only those that begin with the prefix tbl, and you attempt to create a table called MyTable, you get the following error message, and your table is not be created: Policy ‘table name’ has been violated by ‘/Server/(local)/Database/iFTS/Table/dbo.mytable’. This transaction will be rolled back. Policy description: ‘’ Additional help: ‘’ : ‘’. Msg 3609, Level 16, State 1, Procedure sp_syspolicy_ dispatch_event, Line 50 The transaction ended in the trigger. The batch has been aborted. . On Change Log Only—If you select On Change Log Only, a policy condition that is evaluated as failed is logged in the SQL Server Error log. The change does not pre- vent out-of-compliance changes. Central Management Servers In large enterprises, organizations most likely have more than one SQL Server system they want to effectively manage from a Policy-Based Management perspective. Therefore, if DBAs want to implement policies to multiple servers, they have two options. The first option includes exporting the policy and then importing it into different SQL Server systems. After the policy is imported, it must be configured to be evaluated on demand, on schedule, or on change. The second option includes creating one or more Central Management Servers in SQL Server 2008. Basically, by registering one or more SQL Servers with a Central Management Server, a DBA can deploy multiserver policies and administration from a central system. For example, you could create two Central Management Servers, one called OLAP and another called OLTP, and then register servers into each Central Management Server, import the different policies into each Central Management Server, and then evaluate the polices on each different Central Management Server. So, on your OLTP Central Management Server, the servers OLTP1, OLTP2, OLTP3, which are registered in the OLTP Central Management Server, would have the OLTP policies evaluated on them. Creating a Central Management Server Follow these steps to register a Central Management Server: 1. In SQL Server Management Studio, open the View menu and click Registered Servers. 2. In Registered Servers, expand the Database Engine node, right-click Central Management Servers, and then select Register Central Management Server. Download from www.wowebook.com ptg 696 CHAPTER 22 Administering Policy-Based Management 3. In the New Server Registration dialog, specify the name of the desired Central Management Server. 4. If necessary, specify additional connection properties on the Connection Properties tab or click Save. Registering SQL Server Instances in a Central Management Server The next task registers SQL Server instances to be associated with a Central Management Server. The following steps outline this task: 1. Right-click on the Central Management Server with which you want to associate your SQL Server instance. 2. Select New Server Registration. 3. In the New Server Registration dialog, specify the name of the SQL Server Instance and the proper connection information and click Save 4. Repeat steps 1-3 for all SQL Server instances that you want to register with this Central Management Server. Figure 22.2 illustrates a Central Management Server with one Server Group and two SQL Server instances registered. Importing and Evaluating Polices to the Central Management Server After the Central Management Server is established, the Server Group is created, and the desired SQL Server instances are registered, it is time to import and evaluate policies. You can import policies for multiple instances by right-clicking the Central Management Server or Server Group and selecting Import Policies. After the policies are imported, the next step is to evaluate the policies by right-clicking the Central Management Server or Server FIGURE 22.2 Central Management Server with Registered SQL Server instances. Download from www.wowebook.com ptg 697 Implementing Policy-Based Management 22 Group and selecting Evaluate. The output indicates the status of policies associated with all the SQL Server instances associated with the Central Management Server or Server Group. NOTE Importing, exporting, and evaluating policies are covered throughout the rest of the chapter. Implementing Policy-Based Management Now that you understand the basic purpose and concepts behind Policy Based Management, let’s look at how to administer Policy-Based Management, then how to apply it to a server, and then a group of servers. There are essentially six steps to implementing and administering Policy-Based Management: . Creating a condition based on a facet . Creating a policy based on that condition . Creating a category . Creating a Central Management Server . Subscribing to a category . Exporting or importing a policy Let’s look at each of these steps in turn. The upcoming sections explain each step in its entirety. Creating a Condition Based on a Facet When you are creating conditions, the general principle includes three elements: selecting a property, an operator, and then a value. The following example walks through the steps to create a condition based on a facet which will enforce a naming standard on a table: 1. To create a condition, connect to a SQL Server 2008 instance on which you want to create a policy. 2. Launch SQL Server Management Studio (SSMS). In Object Explorer, expand the Management folder, expand the Policy Management folder, and then expand the Facets folder. 3. Within the Facets folder, browse to the desired facet on which you want to create the policy (in this case, the Table facet). Download from www.wowebook.com ptg 698 CHAPTER 22 Administering Policy-Based Management 4. To invoke the Create New Condition window, right-click the facet and select New Condition. 5. In the Create New Condition dialog, type a name for the condition (for example, Table Name Convention) and ensure that the facet selected is correct. 6. In the Expression section, perform the following tasks: a. Select the property on which you want to create your condition. For this example, use the @Name property. b. In the Operator drop-down box, select the NOT LIKE operator. c. In the value text box, enter ’tbl%’. 7. Repeat step 6 for any additional expressions. For this example, the following expres- sions were entered, as displayed in Figure 22.3. AndOr Field Operator Value @Name NOT LIKE ’tbl%’ AND Len(@Name) <= 50 AND @Name NOT LIKE ’%s’ FIGURE 22.3 Creating a condition based on a facet. 8. Click OK to finalize the creation of the condition. You may have to click on the Field text box again for the OK button to be enabled. Download from www.wowebook.com ptg 699 Implementing Policy-Based Management 22 NOTE You can create conditions that quer y Windows Management Instrumentation (WMI) (using the ExecuteWSQL function) or SQL Server (using the ExecuteSQL function). For example, you can create conditions to check on available disk space or number of processors on the server. WMI allows you to issue SQL-like queries against manage- ment objects, which can return information on the physical machine hosting SQL Server and configuration and performance information, which is not accessible from within SQL Server itself. Creating a Policy After creating the condition or conditions, you need to create the policy. The policy is a standard that can be enforced on one or more SQL Server instances, systems, server objects, databases, or database objects. Follow these steps to create a policy with SQL Server Management Studio: 1. In Object Explorer, expand the Management folder, expand the Policy Management folder, and then click on Policies. 2. Right-click on the Policies folder and select New Policy. 3. On the General tab of the Create New Policy dialog, enter a name for the new policy, such as Check Table Naming Conventions. 4. In the Check Condition drop-down box, select a condition, such as the one created in the previous example, or select New to generate a new condition from scratch. 5. The Against Targets section indicates which objects the policy should be evaluated against. For example, you could create a new condition that applies to a specific database, all databases, a specific table, all tables, or to databases created after a specific date. In the Action Targets section, indicate which targets this condition should apply to. 6. Specify the Evaluation Mode by selecting one of the options in the drop-down menu. The options include On Demand, On Schedule, On Change Log Only, and On Change Prevent. NOTE If On Schedule is selected for the Evaluation Mode, specify a schedule from the prede- fined list or enter a new schedule. Download from www.wowebook.com ptg 700 CHAPTER 22 Administering Policy-Based Management 7. The final drop-down box is Server Restriction. You can restrict which servers you do not want the policy to be evaluated against or enforced on by creating a server condi- tion. Create a server restriction or leave the default setting None. An example of the policy settings for checking table name conventions is displayed in Figure 22.4. 8. Before you close the Create New Policy dialog, ensure that the policy is enabled (the Enabled check box is selected) and then click on the Description page. The Description page allows you to categorize your policy, but it also allows you to display a custom text message when a policy is violated and a hyperlink where the DBA/developer can go for more information about the policy. 9. Click OK to finalize the creation of the new policy. An Alternative to Creating Policies As you can imagine, for complex policies you might need to create many conditions. In some cases it may be easier to create a table, database, or server configured to conform to the policy you want to create and then right-click on the specific object and select Facets. This brings up the View Facets page. Click on the Export Current State as Policy button. This exports a policy and a single condition to which the existing object will conform. Figure 22.5 illustrates the dialog that prompts you for a name for your policy and condi- tion as well as where you want to store the policy. You can store it in the file system and then import it to a Central Management Server or other servers where you want the policy FIGURE 22.4 The Create New Policy dialog. Download from www.wowebook.com ptg 701 Implementing Policy-Based Management 22 to be evaluated, or you can import it directly to a server. Note that this policy will contain conditions specific to the object you use as a template; for example, if you use the AdventureWorks2008 database, the policy will test for the condition where the database name is equal to AdventureWorks2008. For this feature to be useful, you likely need to edit the conditions to ensure that they are generic and evaluate exceptions correctly. Creating a Category After you create a policy, it should be categorized. Categorization allows you to group poli- cies into administrative or logical units and then allow database objects to subscribe to specific categories. It is worth mentioning that server objects can’t subscribe to policies. To create a category, click on the Description page in the Create New Policy dialog. Policies can be placed in the default category or a specific category, or you can create a new category. Specifying a category is illustrated in Figure 22.6. You can also create categories by right-clicking on Policy Management and selecting Manage Categories. If you choose to create a new category, click on the New button. This presents a dialog that allows you to name the category. By default, this policy is parked in the new category. You can also select which category you want policies to belong to by selecting a specific category in the drop-down box. After you categorize your policies, you can select which categories you want your database to subscribe to. Right-click on the Policy Management folder and select Manage Categories. The Manage Policy Categories dialog (illustrated in Figure 22.7) appears. Check the categories to which you want all databases on your server to subscribe and deselect the ones that you do not want your server database to be subscribed to by default. Other than the default category, DBAs can select which category (and policies belonging to that category) they want their databases to subscribe to. For example, if you have third- party software that does not follow your naming standards, you should ensure that the policies that enforce your naming standards are not in the default category. Then selec- tively have each of your user databases on your server subscribe to these databases. FIGURE 22.5 Exporting a policy based on an existing object. Download from www.wowebook.com ptg 702 CHAPTER 22 Administering Policy-Based Management FIGURE 22.6 The category selection dialog. FIGURE 22.7 The Manage Policy Categories dialog. Evaluating Policies After you create an organization’s policies and categories, you need to evaluate them to determine which of your servers and databases are out of compliance. There are three management points that can be leveraged to evaluate policies: Download from www.wowebook.com ptg 703 Implementing Policy-Based Management 22 . For the first alternative, right-click on a server, server object, database, or database object in SQL Server Management Studio 2008 and select Policies and then Evaluate. . For the second alternative, expand the Management folder, expand Policy Management, right-click on Policies, and select Evaluate. In the Evaluate Policies page displayed, check the policy or policies you want to evaluate and click the Evaluate button. It is also possible to select an individual policy. To do so, in the Policy folder, right-click on it and select Evaluate. . Finally, the preferred way to evaluate all your servers, or a group of your servers, is to connect to display the Registered Servers list in SSMS. Expand the Central Management Servers node and right-click on the name of a Central Management Server and select Evaluate Policies. The policies you select to evaluate are evaluated on all SQL Servers defined on that Central Management Server—for example, all member servers in all Server Groups. If you select a Server Group, all member servers in that Server Group are evaluated. To evaluate the policies, you need to right-click on the Central Management Server, Server Group, or even Member Server and select Evaluate Policies. When you right-click on the Central Management Server or Server Group and select Evaluate Polices, you are presented with a dialog that prompts you for a source, with a Choose Source prompt. For Select Source, enter the server name into which you have imported your policies or browse to a file share. Then highlight all the policies you want to import and click on the Close button to close the dialog. After the policies are imported, you can select the individual policies you want to run and click Evaluate. The policies are then evaluated on the member servers, and the results are displayed in the Evaluation Results pane, as illustrated in Figure 22.8. The Evaluation Results pane displays servers where a policy has failed. In the Target Details section, there is a View hyperlink, which allows you to browse to get more details on why the individual target server and policy target failed compliance to the policy you evaluated. Importing and Exporting Policies In some situations a DBA might want to export one or many policies with their condi- tions from one or many SQL Server systems and import them to another SQL Server instance or system. Fortunately, you can perform this task easily with an export and import wizard that generates or reads the policy definitions as XML files. Follow these steps to export a policy with SQL Server Management Studio: 1. In Object Explorer, expand the Management folder, expand the Policy Management node, and then expand the Policies folder. 2. Within the Policies folder, right-click a desired policy to export and then select Export Policy. 3. In the Export Policy dialog, specify a name and path for the policy and click Save. Download from www.wowebook.com . or more Central Management Servers in SQL Server 2008. Basically, by registering one or more SQL Servers with a Central Management Server, a DBA can deploy multiserver policies and administration. 1-3 for all SQL Server instances that you want to register with this Central Management Server. Figure 22.2 illustrates a Central Management Server with one Server Group and two SQL Server instances. which you want to associate your SQL Server instance. 2. Select New Server Registration. 3. In the New Server Registration dialog, specify the name of the SQL Server Instance and the proper connection