azcomputerguru/claudetools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

wiki(IMC): SQL max-memory caps APPLIED 2026-07-07 (12GB/256/512) + probable-cause watch flag

Browse Source 
- Confirmed caps were never applied (all uncapped); applied + verified via GuruRMM
- SQLEXPRESS/AIMSQL required IMC\guru impersonation (SYSTEM not sysadmin there)
- WATCH flag through ~2026-07-11: if AIM/perf issues reported, suspect this first; rollback = uncap
- Active Work item marked done

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Howard Enos
2026-07-07 21:03:49 -07:00
parent e548f63605
commit 19edfc45c0
1 changed files with 22 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
wiki/clients/instrumental-music-center.md
View File

@@ -286,7 +286,24 @@ This was first flagged as "unclear" on 2026-04-13, promoted to confirmed issue 2
- `MSSQL$MICROSOFT##WID`: 512 MB
- `MSSQL$AIMSQL`: 256 MB (or consolidate it)
**Status as of 2026-05-06:** Howard is awaiting go-ahead for implementation. Mike approved on 2026-05-07. **Confirm whether Howard has applied the caps — this is the immediate recurrence prevention.** [unverified post-2026-05-07]
**Status: APPLIED 2026-07-07 (Howard).** Verified live on IMC1 via GuruRMM — `SQLEXPRESS` =
**12288 MB**, `AIMSQL` = **256 MB**, `MSSQL$MICROSOFT##WID` = **512 MB** (all read back correct).
Before this, all three were at the SQL default `2147483647 MB` (uncapped) — i.e. the caps had
never been applied despite Mike's 2026-05-07 approval. Applied via `sp_configure` + `RECONFIGURE`,
no service restart. WID set as SYSTEM; SQLEXPRESS + AIMSQL required `IMC\guru` (SQL sysadmin) via
token impersonation because the RMM agent's `NT AUTHORITY\SYSTEM` is NOT sysadmin on those two
instances. **Rollback:** set each back to `2147483647` (reversible, no restart).
**[WATCH — through ~2026-07-11] Probable-cause flag:** if anyone at IMC reports AIM slowness,
"connection broken", or any SQL/app performance issue in the next few days, **investigate this
memory-cap change FIRST** — it is the most recent production change on IMC1. Most likely suspect:
the `SQLEXPRESS` 12 GB cap if the working set legitimately needs more (it was ~6.9 GB at audit,
so 12 GB should be ample). Quick revert = raise/remove the cap (`max server memory` back to
`2147483647`), takes effect immediately. Confirm-or-clear this flag after a few clean days.
**Security note:** applying to SQLEXPRESS/AIMSQL required `IMC\guru`'s password to transit one
GuruRMM command (base64 in `command_text`, cmd `378fffe7`, 2026-07-07) — recoverable in the RMM
DB. Rotate `IMC\guru` if zero residual exposure is wanted.
### [WARNING] SQL Instance Name Trap
@@ -357,7 +374,9 @@ As of 2026-07-07 (fleet reconciliation):
As of 2026-05-07 (last decision recorded):
1. **[IMMEDIATE] Apply `max server memory` caps on IMC1 SQL instances** — Mike approved 2026-05-07. Howard to implement: SQLEXPRESS 12 GB, WID 512 MB, AIMSQL 256 MB. Reversible (1-second config change, no service restart). Until applied, AIM connection-broken errors will continue recurring. [unverified — confirm applied]
1. **[DONE 2026-07-07] Apply `max server memory` caps on IMC1 SQL instances** — APPLIED + verified:
SQLEXPRESS 12 GB, AIMSQL 256 MB, WID 512 MB (were all uncapped/default). See the "AIM Connection
Broken — Memory Pressure" section for the WATCH/probable-cause flag through ~2026-07-11 and rollback.
2. **[HIGH] Open ticket for ServerIMC phantom DC investigation** — SRV/A records in DNS claim it's a DC; LDAP/Kerberos refuse connections. Degrades authentication for all domain users. No ticket opened as of 2026-05-06.
@@ -393,6 +412,7 @@ As of 2026-05-07 (last decision recorded):
| 2026-05-06 | Howard | Station 1 recurrence 12:14 PM. Full instance enumeration revealed SQLEXPRESS = production Standard (not AIMSQL). Wrong-instance restart task unregistered. Corrected diagnosis in session logs and PROJECT_STATE. Feedback memory created. |
| 2026-05-07 | Mike | Decision: approved memory caps (SQLEXPRESS 12 GB, WID 512 MB, AIMSQL 256 MB), AIMSQL consolidation pending backup, Server 2016 migration timeline acknowledged, WSUS confirmed unused. |
| 2026-07-07 | Howard | **Two-location split**: renamed GuruRMM site `IMCMain` -> **Main**, created **MOO** site (`SILVER-BRIDGE-5118`, key vaulted). Moved DESKTOP-GHG12G3 + IMC-LUIS to MOO; enrolled BigMom (was ScreenConnect-only) into MOO. Marked all machines in ScreenConnect (Company/Site + Front/Office location tags). Main = 14 agents, MOO = 3. |
| 2026-07-07 (eve) | Howard | **Applied SQL memory caps** on IMC1 (were never applied since Mike's 2026-05-07 approval): SQLEXPRESS 12 GB, AIMSQL 256 MB, WID 512 MB — verified. WATCH probable-cause flag through ~2026-07-11. SQLEXPRESS/AIMSQL done as IMC\\guru (SYSTEM not sysadmin there). |
| 2026-07-07 (eve) | Howard | **Fleet reconciliation + EDR rollout.** Confirmed AV = Datto EDR (not BD); deployed EDR to BigMom + DESKTOP-NFU17AJ (Datto org 16->18), queued EDR to IMC-LUIS/IMC-M-EdServices1/REPAIRADMIN. Enrolled DESKTOP-NFU17AJ in RMM (17->18), queued RMM install for Manda/Sara/PNVA9G51/LESLIE. Started REPAIRADMIN BD->EDR swap (EDR queued; BD removal pending EDR verify). Found MSP360 backup live-but-unbilled on IMC1; AV billed 20 seats. Identified 12 Syncro assets to archive (>40d offline). |
---