Configure QLI for Version 1.5.0 or Newer

Alation Cloud Service Applies to Alation Cloud Service instances of Alation

Customer Managed Applies to customer-managed instances of Alation

Important

This section is applicable for Alation version 2024.1 or higher and SQL Server OCF connector version 1.5.0 or higher.

Query log ingestion (QLI) extracts and ingests the query history of a database and powers the lineage, popularity, top user, and join and filter information in the catalog. Explore examples of ingested queries on schema and table catalog pages.

The steps involved in configuring and running QLI are:

1. Select a QLI Method

2. Test the Access

3. Preview Results

4. Run QLI

Select a QLI Method

For SQL Server data sources added using the SQL Server OCF connector, Alation supports the following QLI methods:

• View or Table

• XEvents

• Custom Query-Based

Configure View-Based QLI

To configure a view-based or table-based QLI, perform these steps:

• Create a view or table

• Provide the QLI view or table name in Alation

Create a View or Table

For information on creating a view or table for SQL Server Audit, see SQL Server Audit in SQL Server Connector.

For information on creating a view or table for SQL Server Audit RDS, see see SQL Server RDS.

For information on creating a view or table for Azure SQL Managed Instance (MI), see Azure SQL Managed Instance.

Provide the QLI View Name

Important

The Alation user interface displays standard configuration settings for credentials and connection information stored in the Alation database. If your organization has configured Azure KeyVault or AWS Secrets Manager to hold such information, the user interface will change to include the following buttons adjacent to the respective fields:

By default, you see the user interface for Standard. In the case of Vault, instead of the actual credential information, you must select the source and provide the corresponding key. For details, see Configure Secrets for OCF Connector Settings.

1. On the Settings page of your SQL Server data source, go to the Query Log Ingestion.

2. Click QLI view or table.

3. Enter the QLI view or table name in the View or Table name field.

   Important

   • Ensure that the service account has the permissions to access the view or table.

   • Use the format database_name.schema_name.view_name.

4. Click Save.

Configure XEvents

Before configuring XEvents in Alation user interface, complete the configuration described in the Configuration section of Extended Events in SQL Server Connector.

To configure XEvents in the Alation user interface, perform these steps:

1. On the Settings page of your SQL Server data source, go to the Query Log Ingestion.

2. Click XEvents.

3. Provide the absolute path to the .xel file on the server.

   If left blank, Alation uses the default path: C:\Users\Public\Documents\

   Note

   If you use the SQL user service account, provide sysadmin role to access the XEvents files.

4. Provide the prefix of your .xel file.

   If left blank, Alation uses the default prefix: alation_query_log.

   Important

   • Ensure that you provide a unique prefix. If you use common prefixes, the connector will ingest all the files that match the prefix. This may affect the QLI performance.

   • If you enable the extended events session, the files are created in the <prefix>_0_<creation_timestamp>.xel format. If you alter the file format, Alation will skip those files during query log ingestion.

5. Click Save.

Configure Custom Query-Based QLI

If you cannot create a view or table for QLI, for example, due to access restrictions, you can use a custom QLI query to extract query history into Alation.

To configure custom query-based QLI, you must:

• Use the QLI query template to create a query structure

• Provide the custom query in Alation

Use the QLI Query Template

SQL Server Audit

Use the following query structure:

SELECT
  <userNameColumn> AS userName,
  <textColumn> as queryString,
  <defaultDatabases> AS defaultDatabases,
  <sessionIdColumn> AS sessionId,
  <sessionStartTimeColumn> AS sessionStartTime,
  <StartTimeColumn> AS startTime,
  <QueryCancelledColumn> AS cancelled,
  <milliSecondsColumn> AS seconds
FROM <object_name>
    WHERE startTime BETWEEN 'STARTTIME' and 'ENDTIME'
    ORDER BY sessionId, startTime;

Note

<object_name> can be a view, table or procedure.

SQL Server RDS

Use the following query structure:

SELECT
          -- the following columns and values are required
  cat.server_principal_name as userName,
  cat.session_id as sessionId,
  cat.event_time as startTime,
  TRIM(seq.TextData) as queryString,
  cat.duration_milliseconds / 1000 as seconds,
  cat.database_name as defaultDatabases,
  cat.event_time as sessionStartTime,
  'N' as cancelled
  FROM dbo.alation_audit_logs cat
  -- SQL Server audit stores queries in a NVARCHAR(4000) wide column.
  -- Longer queries are broken up and stored with a sequencer. This JOIN
  -- puts them back together again before importing into Alation so
  -- they don't get discarded.
  INNER JOIN (
          SELECT sequence_group_id,
          STRING_AGG(CONVERT(NVARCHAR(max),statement),'') WITHIN GROUP (ORDER BY sequence_number ASC) AS TextData
          FROM dbo.alation_audit_logs
          GROUP BY sequence_group_id
          ) seq
  ON cat.sequence_group_id = seq.sequence_group_id
  WHERE cat.event_time BETWEEN (STARTTIME) AND (ENDTIME);

Note

For Automated QLI, the stored procedure must be run once before performing the QLI.

Azure SQL MI

Use the following query structure:

SELECT
  server_principal_name AS userName,
  event_time AS startTime,
  [statement] AS queryString,
  session_id AS sessionID,
  event_time AS sessionStartTime,
  duration_milliseconds AS milliseconds,
  'N' AS cancelled,
  database_name AS defaultDatabases
FROM sys.fn_get_audit_file('<qli_URL>', default, default);

Provide the Custom Query

1. On the SQL data source, go to the Query Log Ingestion tab of the Settings page.

2. Under the Select a QLI method step, go to Alternatively, use a custom SQL query.

3. In the Custom QLI Query field, provide a custom query to retrieve the query history.

4. Click Save.

Test the Access

Before you perform the QLI, you must validate that the service account has access to the QLI view.

To test the access and find out the approximate size of the query history metadata, perform these steps:

1. On the Settings page of your SQL Server data source, go to the Query Log Ingestion tab.

2. Under the Test access section, click Test.

   A dialog box appears displaying the access validation result.

Preview Results

Before performing the QLI, perform these steps to preview the queries:

1. On the Settings page of your SQL Server data source, click go to the Query Log Ingestion tab.

2. Under the Preview Results section, enter the date range for which you want to generate the preview of the query history.

3. Click Preview.

4. Click View Results to view the generated preview.

   The Preview dialog appears displaying the total number of query statements per user under the User Queries tab and a detailed query statement under the Statements tab. Click Download to download the detailed query statement as a JSON file.

Note

You can use this option to run default QLI using just the date-range.

Run QLI

You can either run QLI manually on demand or configure it to run automatically on a schedule.

Run QLI Manually

To perform QLI manually on demand:

1. On the Settings page of your SQL Server data source, go to the Query Log Ingestion tab.

2. Under the Run QLI section, turn off the Enable QLI Schedule toggle.

3. Specify the desired date range using the Date Range calendar widgets. You will need to specify the start date and the end date separately.

4. Click Import.

   A query log ingestion job is initiated.

Schedule QLI

1. On the Settings page of your SQL Server data source, go to the Query Log Ingestion tab.

2. Under the Run QLI section, turn on the Enable QLI Schedule toggle.

3. Specify values for the job recurrence and time. The values are set in your local time.

   

Note

Here are some of the recommended schedules for better performance:

• Schedule QLI to run for every 12 hours at the 30th minute of the hour

• Schedule QLI to run for every 2 days at 11:30 PM

• Schedule QLI to run every week on the Sunday and Wednesday of the week

• Schedule QLI to run for every 3 months on the 15th day of the month

4. Click Import.

The next QLI runs on the set schedule.

View the Job Status

To view the QLI job status after you run the QLI manually or after Alation triggers the QLI as per the schedule, go to Query Log Ingestion > QLI Job Status.

The Query log ingestion job status table logs the following status:

• Succeeded - Indicates that the query ingestion was successful.

• Partial Success - Indicates that the query ingestion was successful with warnings. If Alation fails to ingest some of the objects during the QLI, it skips them and proceeds with the query ingestion, resulting in partial success. Similarly, if all the queries are ingested by a single user, QLI results in a partial success.

• Failed - Indicates that the query ingestion failed with errors.

Click the View Details link to view a detailed report of query ingestion. Click the View Details link to view a detailed report of metadata extraction. If there are errors, the Job errors table displays the error category, error message, and a hint (ways to resolve the issue). Follow the instructions under the Hints column to resolve the error.