从SSIS包进行的Windows事件日志访问在SQL代理作业中运行

问题描述:

我创建了一个SSIS软件包,该软件包将部署到客户端SQL安装(2005、2008或2008 R2)以执行数据提取,从而为我们的产品提供支持工具.部署过程需要创建Windows AD帐户(普通用户,没有提升的特权),因为该帐户用作服务帐户以通过凭据和代理帐户在SQL Agent作业中执行SSIS包.所有这些都可以正常工作,这意味着我可以限制执行此作业所需的特权.

I have created an SSIS package that will be deployed to client SQL installations (2005, 2008 or 2008 R2) to perform data extracts which provide a support tool for our product. The deployment process requires that a Windows AD account (normal user, no elevated privileges) is created as this is used as a service account to execute the SSIS package in a SQL Agent job by way of a credential and a proxy account. This all works perfectly and means I can restrict the privileges required to perform this job.

但是,我想将SSIS包中的错误日志记录包括到Windows事件日志中.当我在BIDS中运行该程序包(当然使用我自己的凭据)并强制该程序包失败时,它记录的很好.当我强制程序包在由SQL Agent作业运行时失败时(通过将duff连接字符串放入配置文件中),则未记录任何内容.正在使用服务帐户,该帐户是我的SQL Server主机上的经过身份验证的用户,但不会写入事件日志.如果我将服务帐户添加到本地管理员组,则可以将其写入日志,但是我认为Windows事件日志的想法是您不需要提升的特权即可写入日志?

However, I wanted to include error logging in the SSIS package to the Windows Event Log. When I run the package in BIDS (which of course uses my own credentials) and force the failure of the package, it logs just fine. When I force the package to fail (by putting a duff connection string into the config file) whilst being run by the SQL Agent job, nothing is logged. The service account is being used and it is an authenticated user on my SQL Server host machine but it will not write to the event log. If I add the service account to the local administrators group, it writes to the log just fine, but I thought the idea of the Windows event log was that you did not need elevated privileges to write to it?

我们的支持团队热衷于使用Windows事件日志,但如果不授予我不希望的服务帐户高特权,我将看不到这样做的方法.我想念什么吗? SSIS作业步骤页面中的日志记录"选项卡似乎并没有执行很多操作,但这也许正是我所缺少的?

Our support teams are keen to use the Windows Event Log but I can see no way of doing so without granting high privileges to a service account which I would rather not do. Am I missing something? The Logging tab in the SSIS job step page doesn't seem to do a lot but perhaps that's what I'm missing?

很抱歉,如果这更适合ServerFault,但由于在开发过程中遇到问题,我无法完全断定这条线的哪一边.如果是这样,我将其重新定位.

Apologies if this is more suited to ServerFault, but I couldn't quite decide which side of the line this fell as it is a problem encountered during development. If it is then I'll relocate it.

非常感谢

史蒂夫

如果操作系统为2003,请使用以下方法检查谁有权访问日志的SDDL语法:

If OS is 2003, check the SDDL syntax on who has access to write to the log with this: http://support.microsoft.com/kb/323076

如果是2008,则可以使用wevtutil代替手动输入SDDL: http://support.microsoft.com/kb/2028427

If 2008, you can use wevtutil instead of manually typing in SDDL: http://support.microsoft.com/kb/2028427

可以使用上述方法为服务帐户授予权限.

The service account can be given the permissions using the above.