Skip to content

Latest commit

 

History

History
65 lines (44 loc) · 4.35 KB

database-accessibility-issues-high-volume-customer-workloads.md

File metadata and controls

65 lines (44 loc) · 4.35 KB
Raw
title description ms.date ms.custom appliesto ms.reviewer
Database accessibility issues with high-volume customer workloads
Fixes an issue where high-volume customer workloads using Extensible Key Management (EKM) for encryption and key generation experience database accessibility issues.
02/16/2023
KB5023236
SQL Server 2022 on Windows
SQL Server 2019 on Windows
mireks, vanto, rajat.jain, chrisbrower, arupp, v-cuichen

FIX: Database accessibility issues with high-volume customer workloads that use EKM for encryption and key generation

Symptoms

High-volume customer workloads that use Extensible Key Management (EKM) may experience intermittent database accessibility issues. These accessibility issues are caused by the frequent creation or rotation of the virtual log file (VLF) that requires access to Azure Key Vault (AKV). If AKV or supporting services such as Microsoft Entra ID aren't accessible during this creation or rotation, you can't perform the creation or rotation of the VLF. Additionally, it causes database accessibility issues.

VLFs can be created or rotated frequently when the transaction log files are small, or the automatic growth (autogrow) increment of the transaction log is small, instead of large enough to stay ahead of the needs of the workload transactions. For more information, see Manage the size of the transaction log file.

You can monitor the size and the creation frequency of VLFs by using sys.dm_db_log_info.

Resolution

This problem is fixed in the following cumulative updates for SQL Server:

This fix introduces a startup trace flag (TF) 15025. You can use TF 15025 to disable the AKV access that's required for a newly created VLF, which allows high-volume customer workloads to continue without interruption. Once this trace flag is enabled, SQL Server that uses EKM for encryption and key generation doesn't contact AKV during the creation or rotation of the VLF.

To check if the key in AKV is still in use or needs to be disabled, you must perform one of the following operations on the database:

  • Take a backup (any type of backup) of the database or transaction log.
  • Run DBCC CHECKDB against the encrypted database.
  • Set the encrypted database to the OFFLINE state and then to the ONLINE state.
  • Create a database snapshot of the encrypted database.

In any of the listed operations, SQL Server will contact AKV and check the key access during this operation if the key exists in AKV.

Even if you enable TF 15025, these operations will still reach AKV.

You can run the following Transact-SQL (T-SQL) statement to check the status of the key in a database:

SELECT * FROM sys.dm_database_encryption_keys

About cumulative updates for SQL Server

Each new cumulative update for SQL Server contains all the hotfixes and security fixes that were in the previous build. We recommend that you install the latest build for your version of SQL Server:

Status

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

References