From 19edfc45c07980863ca9b82fcb0a6572ba3cbb87 Mon Sep 17 00:00:00 2001 From: Howard Enos Date: Tue, 7 Jul 2026 21:03:49 -0700 Subject: [PATCH] wiki(IMC): SQL max-memory caps APPLIED 2026-07-07 (12GB/256/512) + probable-cause watch flag - Confirmed caps were never applied (all uncapped); applied + verified via GuruRMM - SQLEXPRESS/AIMSQL required IMC\guru impersonation (SYSTEM not sysadmin there) - WATCH flag through ~2026-07-11: if AIM/perf issues reported, suspect this first; rollback = uncap - Active Work item marked done Co-Authored-By: Claude Opus 4.8 (1M context) --- wiki/clients/instrumental-music-center.md | 24 +++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-) diff --git a/wiki/clients/instrumental-music-center.md b/wiki/clients/instrumental-music-center.md index 477a4219..4bb3c8c7 100644 --- a/wiki/clients/instrumental-music-center.md +++ b/wiki/clients/instrumental-music-center.md @@ -286,7 +286,24 @@ This was first flagged as "unclear" on 2026-04-13, promoted to confirmed issue 2 - `MSSQL$MICROSOFT##WID`: 512 MB - `MSSQL$AIMSQL`: 256 MB (or consolidate it) -**Status as of 2026-05-06:** Howard is awaiting go-ahead for implementation. Mike approved on 2026-05-07. **Confirm whether Howard has applied the caps — this is the immediate recurrence prevention.** [unverified post-2026-05-07] +**Status: APPLIED 2026-07-07 (Howard).** Verified live on IMC1 via GuruRMM — `SQLEXPRESS` = +**12288 MB**, `AIMSQL` = **256 MB**, `MSSQL$MICROSOFT##WID` = **512 MB** (all read back correct). +Before this, all three were at the SQL default `2147483647 MB` (uncapped) — i.e. the caps had +never been applied despite Mike's 2026-05-07 approval. Applied via `sp_configure` + `RECONFIGURE`, +no service restart. WID set as SYSTEM; SQLEXPRESS + AIMSQL required `IMC\guru` (SQL sysadmin) via +token impersonation because the RMM agent's `NT AUTHORITY\SYSTEM` is NOT sysadmin on those two +instances. **Rollback:** set each back to `2147483647` (reversible, no restart). + +**[WATCH — through ~2026-07-11] Probable-cause flag:** if anyone at IMC reports AIM slowness, +"connection broken", or any SQL/app performance issue in the next few days, **investigate this +memory-cap change FIRST** — it is the most recent production change on IMC1. Most likely suspect: +the `SQLEXPRESS` 12 GB cap if the working set legitimately needs more (it was ~6.9 GB at audit, +so 12 GB should be ample). Quick revert = raise/remove the cap (`max server memory` back to +`2147483647`), takes effect immediately. Confirm-or-clear this flag after a few clean days. + +**Security note:** applying to SQLEXPRESS/AIMSQL required `IMC\guru`'s password to transit one +GuruRMM command (base64 in `command_text`, cmd `378fffe7`, 2026-07-07) — recoverable in the RMM +DB. Rotate `IMC\guru` if zero residual exposure is wanted. ### [WARNING] SQL Instance Name Trap @@ -357,7 +374,9 @@ As of 2026-07-07 (fleet reconciliation): As of 2026-05-07 (last decision recorded): -1. **[IMMEDIATE] Apply `max server memory` caps on IMC1 SQL instances** — Mike approved 2026-05-07. Howard to implement: SQLEXPRESS 12 GB, WID 512 MB, AIMSQL 256 MB. Reversible (1-second config change, no service restart). Until applied, AIM connection-broken errors will continue recurring. [unverified — confirm applied] +1. **[DONE 2026-07-07] Apply `max server memory` caps on IMC1 SQL instances** — APPLIED + verified: + SQLEXPRESS 12 GB, AIMSQL 256 MB, WID 512 MB (were all uncapped/default). See the "AIM Connection + Broken — Memory Pressure" section for the WATCH/probable-cause flag through ~2026-07-11 and rollback. 2. **[HIGH] Open ticket for ServerIMC phantom DC investigation** — SRV/A records in DNS claim it's a DC; LDAP/Kerberos refuse connections. Degrades authentication for all domain users. No ticket opened as of 2026-05-06. @@ -393,6 +412,7 @@ As of 2026-05-07 (last decision recorded): | 2026-05-06 | Howard | Station 1 recurrence 12:14 PM. Full instance enumeration revealed SQLEXPRESS = production Standard (not AIMSQL). Wrong-instance restart task unregistered. Corrected diagnosis in session logs and PROJECT_STATE. Feedback memory created. | | 2026-05-07 | Mike | Decision: approved memory caps (SQLEXPRESS 12 GB, WID 512 MB, AIMSQL 256 MB), AIMSQL consolidation pending backup, Server 2016 migration timeline acknowledged, WSUS confirmed unused. | | 2026-07-07 | Howard | **Two-location split**: renamed GuruRMM site `IMCMain` -> **Main**, created **MOO** site (`SILVER-BRIDGE-5118`, key vaulted). Moved DESKTOP-GHG12G3 + IMC-LUIS to MOO; enrolled BigMom (was ScreenConnect-only) into MOO. Marked all machines in ScreenConnect (Company/Site + Front/Office location tags). Main = 14 agents, MOO = 3. | +| 2026-07-07 (eve) | Howard | **Applied SQL memory caps** on IMC1 (were never applied since Mike's 2026-05-07 approval): SQLEXPRESS 12 GB, AIMSQL 256 MB, WID 512 MB — verified. WATCH probable-cause flag through ~2026-07-11. SQLEXPRESS/AIMSQL done as IMC\\guru (SYSTEM not sysadmin there). | | 2026-07-07 (eve) | Howard | **Fleet reconciliation + EDR rollout.** Confirmed AV = Datto EDR (not BD); deployed EDR to BigMom + DESKTOP-NFU17AJ (Datto org 16->18), queued EDR to IMC-LUIS/IMC-M-EdServices1/REPAIRADMIN. Enrolled DESKTOP-NFU17AJ in RMM (17->18), queued RMM install for Manda/Sara/PNVA9G51/LESLIE. Started REPAIRADMIN BD->EDR swap (EDR queued; BD removal pending EDR verify). Found MSP360 backup live-but-unbilled on IMC1; AV billed 20 seats. Identified 12 Syncro assets to archive (>40d offline). | ---