Did you know that, by default, there is a server side trace running on your SQL Server 2005 instance? No, Microsoft is not Big Brother looking over your shoulder! At least I don't think they are in this instance anyway :)
Rather, this is a light-weight trace that is always running to collect some data about what's going on in SQL Server. For those of you that are familiar with the old BlackBox trace that you can turn on with a server side trace, this is NOT it.
To start a BlackBox trace use the following (thanks to http://vyaskn.tripod.com/server_side_tracing_in_sql_server.htm)
DECLARE @TraceID int
EXEC CreateTrace
@Blackbox = 1,
@OutputTraceID = @TraceID OUT
EXEC StartTrace
@TraceID
The Default Trace is something completely new that Microsoft has implemented to audit certain events in the system, which you can report on via Management Reports (More on these in a future post).
To prove that the trace is running, execute the following
select * from ::fn_trace_getinfo(default)
You will see something like the following
traceid property value
----------- ----------- ----------------------------------------------------
1 1 2
1 2 E:\sql2005\MSSQL.1\MSSQL\LOG\log_4.trc
1 3 20
1 4 NULL
1 5 1
(5 row(s) affected)
What does this information mean? Essentially, this output tells us a little bit about the trace that is currently running. Trace Property 1 value 2 indicates that the trace file will rollover when it reaches a certain size. That size is set in Trace Property 3, in this case, 20MB. Property 2 is the path for the output file. The output above shows that there are 4 trace files. You can actually open up these trace files located in the \\...\MSSQL\Log to see what's been going on with your server. Trace Property 4 is the stop time, which is set never to stop. Finally Trace Property 5 indicates that the trace is currently running. For more information on trace properties and server side traces see fn_trace_getinfo and sp_trace_create in BOL.
If you are concerned that this trace is too heavy, and you want to want to get every last ounce of performance out of your SQL Server, you can turn it off. Now, you are probably thinking you can use good ol' sp_trace_setstatus 1, 2 to stop and close the trace, right? Well, in the immortal words of Lee Corso, "Not so fast my friend!" If you try this, you will receive the error message
Msg 19070, Level 16, State 1, Procedure sp_trace_setstatus, Line 1
The default trace cannot be stopped or modified. Use SP_CONFIGURE to turn it off.
Just as the error message says, you can use this command to turn it off
sp_configure 'default trace enabled', 0
But should you turn it off? Before we make that determination, let's take a closer look at what is being captured. By opening the log file in the new Profiler (which I am a huge fan of), we can see in the event matrix exactly what is being captured. Below is a list of the events the default trace is capturing. It appears that all columns available for the trace events are being captured.
Database
-
Data file auto grow
- Data file auto shrink
- Database mirroring status change
- Log file auto grow
- Log file auto shrink
Errors and Warnings
-
Errorlog
- Hash warning
- Missing Column Statistics
- Missing Join Predicate
- Sort Warning
Full-Text
-
FT Crawl Aborted
- FT Crawl Started
- FT Crawl Stopped
Objects
-
Object Altered
- Object Created
- Object Deleted
Security Audit
-
Audit Add DB user event
- Audit Add login to server role event
- Audit Add Member to DB role event
- Audit Add Role event
- Audit Add login event
- Audit Backup/Restore event
- Audit Change Database owner
- Audit DBCC event
- Audit Database Scope GDR event (Grant, Deny, Revoke)
- Audit Login Change Property event
- Audit Login Failed
- Audit Login GDR event
- Audit Schema Object GDR event
- Audit Schema Object Take Ownership
- Audit Server Starts and Stops
Server
This trace seems to me to be fairly light-weight. I'm not sure, but I think some of the auditing alerts are triggered from this trace, as well, in addition to the extremely cool, Management Reports dependence on these traces. For me, the benefit this trace provides outweighs the relatively low overhead for it. I'll be leaving it on.
Tell me what you think about this new feature. Will you be leaving it on, or are you trying to squeeze the last little bit out of your SQL Server?
Jon Baker