ruleset.json

{
  "schemaVersion": "1.0",
  "name": "Microsoft ruleset",
  "version": "1.1.17",
  "rules": [
    {
      "id": "AutoCreateStats",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "name": {
          "not": [
            "master",
            "msdb",
            "tempdb"
          ]
        },
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Performance",
        "Statistics",
        "QueryOptimizer"
      ],
      "displayName": "'Auto-Create Statistics' option should be on",
      "description": "The Query Optimizer determines whether an index is useful for a specific query by evaluating the stored statistics. If the statistics become out of date and significant changes have occurred against the underlying data, this can result in less than optimal query performance. In most cases, it's best to let SQL Server maintain the statistics. If you turn 'Auto Create Stats' and 'Auto Update Stats' off, then it is up to you to keep the statistics up-to-date somehow. Failure to do so will lead to poor query performance. Most applications should have these options ON. When the Auto Create statistics setting is ON, the Query Optimizer creates statistics on one or more columns of a table or an indexed view, as necessary, to improve query plans and query performance.",
      "message": "Turn on 'Auto-Create Statistics' option to improve query performance",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/statistics/statistics#CreateStatistics",
      "level": "Medium",
      "condition": "@is_auto_create_stats_on",
      "probes": [
        "DatabaseConfiguration"
      ]
    },
    {
      "id": "AutoUpdateStats",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "name": {
          "not": [
            "master",
            "msdb",
            "tempdb"
          ]
        },
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Performance",
        "Statistics",
        "QueryOptimizer"
      ],
      "displayName": "Auto-Update Statistics should be on",
      "description": "The Query Optimizer determines whether an index is useful for a specific query by evaluating the stored statistics. If the statistics become out of date and significant changes have occurred against the underlying data, this can result in less than optimal query performance. In most cases, it's best to let SQL Server maintain the statistics. If you turn 'Auto Create Stats' and 'Auto Update Stats' off, then it is up to you to keep the statistics up-to-date somehow. Failure to do so will lead to poor query performance. Most applications should have these options ON. When the Auto Update Statistics setting is ON, the Query Optimizer updates statistics when they are used by a query and when they might be out-of-date. Statistics become out-of-date after insert, update, delete, or merge operations change the data distribution in the table or indexed view. The Query Optimizer determines when statistics might be out-of-date by counting the number of data modifications since the last statistics update and comparing the number of modifications to a threshold. The threshold is based on the number of rows in the table or indexed view. The Query Optimizer checks for out-of-date statistics before compiling a query and before executing a cached query plan. Before compiling a query, the Query Optimizer uses the columns, tables, and indexed views in the query predicate to determine which statistics might be out-of-date. Before executing a cached query plan, the Database Engine verifies that the query plan references up-to-date statistics. The AUTO_UPDATE_STATISTICS option applies to statistics created for indexes, single-columns in query predicates, and statistics that are created by using the CREATE STATISTICS statement. This option also applies to filtered statistics.",
      "message": "Turn on 'Auto-Update Statistics' option to improve query performance",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/statistics/statistics#UpdateStatistics",
      "level": "Medium",
      "condition": "@is_auto_update_stats_on",
      "probes": [
        "DatabaseConfiguration"
      ]
    },
    {
      "id": "QueryStoreOn",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "version": "[13.0,)",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "name": {
          "not": [
            "master",
            "tempdb",
            "model",
            "msdb"
          ]
        }
      },
      "tags": [
        "DefaultRuleset",
        "Performance",
        "QueryStore",
        "Statistics"
      ],
      "displayName": "Query Store should be active",
      "description": "The Query Store feature provides you with insight on query plan choice and performance. It simplifies performance troubleshooting by helping you quickly find performance differences caused by query plan changes. Query Store automatically captures a history of queries, plans, and runtime statistics, and retains these for your review. It separates data by time windows so you can see database usage patterns and understand when query plan changes happened on the server. While Query Store collects queries, execution plans and statistics, its size in the database grows until this limit is reached. When that happens, Query Store automatically changes the operation mode to read-only and stops collecting new data, which means that your performance analysis is no longer accurate.",
      "message": "Query Store operation mode should be 'Read Write' to keep performance analysis accurate",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/performance/monitoring-performance-by-using-the-query-store",
      "condition": {
        "equal": [
          "@query_store_state",
          2
        ]
      },
      "probes": [
        "DatabaseConfiguration"
      ]
    },
    {
      "id": "TF174",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "version": [
          "[11.0.3368,12.0)",
          "[12.0.2480,13.0)",
          "[13.0,)"
        ],
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer"
      },
      "tags": [
        "DefaultRuleset",
        "TraceFlag",
        "Memory",
        "Performance"
      ],
      "displayName": "TF 174 increases plan cache bucket count",
      "description": "Trace Flag 174 increases the SQL Server plan cache bucket count from 40,009 to 160,001 on 64-bit systems. When the SQL Server plan cache reaches its entry limit, plans that have low cost must be evicted in order to insert new plans. This can cause severe contention on the SOS_CACHESTORE spinlock and a high CPU usage occurs in SQL Server. On 64-bit systems, the number of buckets for the SQL Server plan cache is 40,009. Therefore, the maximum number of entries that can fit inside the SQL Server plan cache is 160,036. Enabling trace flag 174 on high performance systems increases the size of the cache and can avoid SOS_CACHESTORE spinlock contention.",
      "message": "Enable trace flag 174 to increase plan cache bucket count",
      "helpLink": "https://docs.microsoft.com/sql/t-sql/database-console-commands/dbcc-traceon-trace-flags-transact-sql",
      "level": "Information",
      "condition": {
        "in": [
          174,
          "@TraceFlag"
        ]
      },
      "probes": [
        "EnabledGlobalTraceFlags"
      ]
    },
    {
      "id": "TF634",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "TraceFlag",
        "Memory",
        "Performance",
        "ColumnStore"
      ],
      "displayName": "TF 634 disables background columnstore compression",
      "description": "Trace Flag 634 disables the background columnstore compression task. SQL Server periodically runs the Tuple Mover background task that compresses columnstore index rowgroups with uncompressed data, one such rowgroup at a time. Columnstore compression improves query performance but also consumes system resources. You can control the timing of columnstore compression manually, by disabling the background compression task with trace flag 634, and then explicitly invoking ALTER INDEX...REORGANIZE or ALTER INDEX...REBUILD at the time of your choice.",
      "message": "Trace flag 634 disables background columnstore compression task. Check if you need to set non-default trace flag with current system build and configuration",
      "helpLink": "https://docs.microsoft.com/sql/t-sql/database-console-commands/dbcc-traceon-trace-flags-transact-sql",
      "level": "Information",
      "condition": {
        "not": {
          "in": [
            634,
            "@TraceFlag"
          ]
        }
      },
      "probes": [
        "EnabledGlobalTraceFlags"
      ]
    },
    {
      "id": "TF652",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "TraceFlag",
        "Performance",
        "Memory",
        "Pages"
      ],
      "displayName": "TF 652 disables page pre-fetching scans",
      "description": "Trace Flag 652 disables page pre-fetching for scans. The read-ahead process reads the full extent of a referenced database page into the buffer pool, before those contiguous database pages are consumed by scans. Enabling the trace flag can lead to performance issues on queries that leverage pre-fetching.",
      "message": "Trace flag 652 disables page pre-fetching scans. Check if you need to set non-default trace flag with current system build and configuration",
      "helpLink": "http://support.microsoft.com/kb/920093",
      "level": "Information",
      "condition": {
        "not": {
          "in": [
            652,
            "@TraceFlag"
          ]
        }
      },
      "probes": [
        "EnabledGlobalTraceFlags"
      ]
    },
    {
      "id": "TF661",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "TraceFlag",
        "Performance"
      ],
      "displayName": "TF 661 disables background ghost cleanup task",
      "description": "Trace Flag 661 disables the ghost record removal process. A ghost record is the result of a delete operation. When you delete a record, the deleted record is kept as a ghost record. Later, the deleted record is purged by the ghost record removal process. When you disable this process, the deleted record is not purged. Therefore, the space that the deleted record consumes is not freed. This behavior affects space consumption and the performance of scan operations. If you turn off this trace Flag, the ghost record removal process works correctly.",
      "message": "Check if you need to set non-default trace flag with current system build and configuration",
      "helpLink": "https://support.microsoft.com/help/920093",
      "level": "Information",
      "condition": {
        "not": {
          "in": [
            661,
            "@TraceFlag"
          ]
        }
      },
      "probes": [
        "EnabledGlobalTraceFlags"
      ]
    },
    {
      "id": "TF834",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "TraceFlag",
        "Performance",
        "Memory",
        "ColumnStore"
      ],
      "displayName": "TF 834 enables large-page allocations",
      "description": "Trace Flag 834 causes the server to use large-page memory (LPM) model for the buffer pool allocations. Consider enabling TF 834 if you have a server that has a lot of memory, particularly for an analytical or data warehousing workload. Trace flag 834 is NOT recommended on SQL Server instances that use columnstore indexes.",
      "message": "Enable trace flag 834 to use large-page allocations to improve analytical and data warehousing workloads",
      "helpLink": "https://support.microsoft.com/kb/3210239",
      "level": "Information",
      "condition": {
        "or": [
          "@ColumnStoreIndexCount",
          {
            "in": [
              834,
              "@TraceFlag"
            ]
          }
        ]
      },
      "probes": [
        "EnabledGlobalTraceFlags",
        {
          "id": "ServerDatabasesProperties",
          "transform": {
            "type": "aggregate",
            "map": {
              "ColumnStoreIndexCount": "sum"
            }
          }
        }
      ]
    },
    {
      "id": "TF845",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer"
      },
      "tags": [
        "DefaultRuleset",
        "TraceFlag",
        "Memory",
        "Performance"
      ],
      "displayName": "TF 845 is not needed in SQL Server 2012 and higher",
      "description": "Trace Flag 845 supports locking pages in memory in SQL Server Standard edition, which is needed together with trace flag 834 to use the large-page memory (LPM) model for the buffer pool allocations. Starting with SQL Server 2012 this behavior is enabled by default for Standard edition, and trace flag 845 must not be used.",
      "message": "Disable trace flag 845 in SQL Server 2012 and higher versions",
      "helpLink": "https://docs.microsoft.com/sql/t-sql/database-console-commands/dbcc-traceon-trace-flags-transact-sql",
      "condition": {
        "not": {
          "in": [
            845,
            "@TraceFlag"
          ]
        }
      },
      "probes": [
        "EnabledGlobalTraceFlags"
      ]
    },
    {
      "id": "TF902",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "TraceFlag",
        "UpdateIssues"
      ],
      "displayName": "TF 902 Database Upgrade Bypass should be disabled",
      "description": "Trace Flag 902 bypasses execution of database upgrade script when installing a Cumulative Update or Service Pack. This trace flag is not supported to run it continuously in a production environment. If you encounter an error during script upgrade mode, it is recommended to contact Microsoft SQL Customer Service and Support (CSS) for further guidance.",
      "message": "Disable trace flag 902 which bypasses database upgrade",
      "helpLink": "https://support.microsoft.com/help/2163980",
      "level": "Medium",
      "condition": {
        "not": {
          "in": [
            902,
            "@TraceFlag"
          ]
        }
      },
      "probes": [
        "EnabledGlobalTraceFlags"
      ]
    },
    {
      "id": "TF1117",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "TraceFlag",
        "DBFileConfiguration",
        "Performance"
      ],
      "displayName": "TF 1117 enables filegroup-level autogrow",
      "description": "Trace Flag 1117 initiates the growth of every file in the filegroup, when a file in the filegroup meets the autogrow threshold, and together with trace flag 1118, can help reduce allocation contention in the SQL Server TempDB database. This trace flag affects all databases and is recommended only if every database is safe to be grow all files in a filegroup by the same amount.",
      "message": "Enable trace flag 1117 to enable filegroup auto-grow",
      "helpLink": "https://support.microsoft.com/help/2154845",
      "level": "Information",
      "condition": {
        "in": [
          1117,
          "@TraceFlag"
        ]
      },
      "probes": [
        "EnabledGlobalTraceFlags"
      ]
    },
    {
      "id": "TF1117",
      "itemType": "override",
      "targetFilter": {
        "version": "[13.0,)"
      },
      "displayName": "TF 1117 has no effect in SQL Server 2016 and higher",
      "description": "Trace Flag 1117 initiates the growth of every file in the filegroup, when a file in the filegroup meets the autogrow threshold, and together with trace flag 1118, can help reduce allocation contention in the SQL Server TempDB database. Starting with SQL Server 2016, this behavior is controlled by the AUTOGROW_SINGLE_FILE and AUTOGROW_ALL_FILES options of ALTER DATABASE syntax.",
      "message": "Disable trace flag 1117 in SQL Server 2016 and higher versions",
      "helpLink": "https://docs.microsoft.com/sql/t-sql/statements/alter-database-transact-sql-file-and-filegroup-options",
      "condition": {
        "not": {
          "in": [
            1117,
            "@TraceFlag"
          ]
        }
      }
    },
    {
      "id": "TF1118",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "TraceFlag",
        "Memory",
        "Performance",
        "Pages"
      ],
      "displayName": "TF 1118 disables single page allocations",
      "description": "Trace Flag 1118 forces page allocations on uniform extents instead of mixed extents, and together with trace flag 1117, can help reduce allocation contention in the SQL Server TempDB database. When a new object is created, by default, the first eight pages are allocated from different extents (mixed extents). Afterwards, when more pages are needed, those are allocated from that same extent (uniform extent). The SGAM page is used to track these mixed extents, so can quickly become a bottleneck when numerous mixed page allocations are occurring. This trace flag allocates all eight pages from the same extent when creating new objects, minimizing the need to scan the SGAM page and forces uniform extent allocations instead of mixed page allocations.",
      "message": "Enable trace flag 1118 to force page allocations on uniform extents",
      "helpLink": "https://support.microsoft.com/help/328551",
      "level": "Information",
      "condition": {
        "in": [
          1118,
          "@TraceFlag"
        ]
      },
      "probes": [
        "EnabledGlobalTraceFlags"
      ]
    },
    {
      "id": "TF1118",
      "itemType": "override",
      "targetFilter": {
        "version": "[13.0,)"
      },
      "displayName": "TF 1118 has no effect in SQL Server 2016 and higher",
      "description": "Trace Flag 1118 forces page allocations on uniform extents instead of mixed extents, and together with trace flag 1117, can help reduce allocation contention in the SQL Server TempDB database. When a new object is created, by default, the first eight pages are allocated from different extents (mixed extents). Afterwards, when more pages are needed, those are allocated from that same extent (uniform extent). The SGAM page is used to track these mixed extents, so can quickly become a bottleneck when numerous mixed page allocations are occurring. This trace flag allocates all eight pages from the same extent when creating new objects, minimizing the need to scan the SGAM page and forces uniform extent allocations instead of mixed page allocations. Starting with SQL Server 2016, this behavior is controlled by the SET MIXED_PAGE_ALLOCATION option of ALTER DATABASE syntax.",
      "message": "Disable trace flag 1118 in SQL Server 2016 and higher versions",
      "helpLink": "https://docs.microsoft.com/sql/t-sql/statements/alter-database-transact-sql-file-and-filegroup-options",
      "condition": {
        "not": {
          "in": [
            1118,
            "@TraceFlag"
          ]
        }
      }
    },
    {
      "id": "TF1204",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "TraceFlag",
        "Locks",
        "Performance"
      ],
      "displayName": "TF 1204 returns deadlock information",
      "description": "Trace Flag 1204 returns the resources and types of locks that are participating in a deadlock, including the affected command. The resulting information is recorded in the SQL Server Errorlog.",
      "message": "Disable trace flag 1204 that returns deadlock information",
      "helpLink": "https://support.microsoft.com/help/832524",
      "level": "Information",
      "condition": {
        "not": {
          "in": [
            1204,
            "@TraceFlag"
          ]
        }
      },
      "probes": [
        "EnabledGlobalTraceFlags"
      ]
    },
    {
      "id": "TF1211",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "TraceFlag",
        "Locks",
        "Performance"
      ],
      "displayName": "TF 1211 lock escalation should be disabled",
      "description": "Trace Flag 1211 disables lock escalation based on memory pressure, or based on number of locks. Because SQL Server will not escalate row or page locks to table locks, this can generate an excessive number of locks. If the lock memory grows large enough, attempts to allocate additional locks for any query may fail and cause performance issues. This trace flag should not be used in order to avoid inability to allocate lock resources because of insufficient memory. If lock escalation needs to be disabled, use trace flag 1224 instead.",
      "message": "Disable trace flag 1211 to enable lock escalation",
      "helpLink": "https://docs.microsoft.com/sql/t-sql/database-console-commands/dbcc-traceon-trace-flags-transact-sql",
      "level": "Medium",
      "condition": {
        "not": {
          "in": [
            1211,
            "@TraceFlag"
          ]
        }
      },
      "probes": [
        "EnabledGlobalTraceFlags"
      ]
    },
    {
      "id": "TF1222",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "TraceFlag",
        "Locks",
        "Performance"
      ],
      "displayName": "TF 1222 returns deadlock information",
      "description": "Trace Flag 1222 returns the resources and types of locks that are participating in a deadlock, including the affected command. The resulting information is recorded in the SQL Server Errorlog, in XML format that does not comply with any XSD schema.",
      "message": "Disable trace flag 1222 that returns deadlock information",
      "helpLink": "https://docs.microsoft.com/sql/t-sql/database-console-commands/dbcc-traceon-trace-flags-transact-sql",
      "level": "Information",
      "condition": {
        "not": {
          "in": [
            1222,
            "@TraceFlag"
          ]
        }
      },
      "probes": [
        "EnabledGlobalTraceFlags"
      ]
    },
    {
      "id": "TF1224",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "TraceFlag",
        "Locks",
        "Performance"
      ],
      "displayName": "TF 1224 should be disabled",
      "description": "Trace Flag 1224 disables lock escalation based on the number of locks, unless SQL Server is under memory pressure. Because SQL Server will not escalate row or page locks to table locks, this can generate an excessive number of locks.",
      "message": "Disable trace flag 1224 to allow lock escalation",
      "helpLink": "https://docs.microsoft.com/sql/t-sql/database-console-commands/dbcc-traceon-trace-flags-transact-sql",
      "level": "Medium",
      "condition": {
        "not": {
          "in": [
            1224,
            "@TraceFlag"
          ]
        }
      },
      "probes": [
        "EnabledGlobalTraceFlags"
      ]
    },
    {
      "id": "TF1229",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "TraceFlag",
        "Locks",
        "Performance",
        "CPU"
      ],
      "displayName": "TF 1229 lock partitioning should be enabled",
      "description": "Trace Flag 1229 disables lock partitioning regardless of the number of CPUs. By default, SQL Server enables lock partitioning when a server has 16 or more CPUs, to improve the scalability characteristics of larger systems. Disabling lock partitioning may cause can cause spinlock contention and poor performance, or unexpected behaviors when switching partitions.",
      "message": "Disable trace flag 1229 to enable lock partitioning",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/sql-server-transaction-locking-and-row-versioning-guide",
      "level": "Medium",
      "condition": {
        "not": {
          "in": [
            1229,
            "@TraceFlag"
          ]
        }
      },
      "probes": [
        "EnabledGlobalTraceFlags"
      ]
    },
    {
      "id": "TF1236",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer"
      },
      "tags": [
        "DefaultRuleset",
        "TraceFlag",
        "Locks",
        "Performance"
      ],
      "displayName": "TF 1236 database lock partitioning should be enabled",
      "description": "Trace Flag 1236 enables database-level lock partitioning. Lock Partitioning is utilized to improve the scalability characteristics on larger systems.",
      "message": "Enable trace Flag 1236 to enable database lock partitioning",
      "helpLink": "https://support.microsoft.com/help/2926217",
      "level": "Medium",
      "condition": {
        "in": [
          1236,
          "@TraceFlag"
        ]
      },
      "probes": [
        "EnabledGlobalTraceFlags"
      ]
    },
    {
      "id": "TF1236",
      "itemType": "override",
      "targetFilter": {
        "version": [
          "[11.0.6020,12.0)",
          "[12.0.4100,)"
        ]
      },
      "displayName": "TF 1236 is not needed in SQL Server 2012 SP3, SQL Server 2014 SP1 and higher",
      "description": "Trace Flag 1236 enables database-level lock partitioning. Starting with SQL Server 2012 SP3 and SQL Server 2014 SP1, this behavior is controlled by the engine and trace flag 1236 has no effect.",
      "message": "Disable trace flag 1236 in SQL Server 2012 SP3, SQL Server 2014 SP1 and higher versions",
      "level": "Low",
      "condition": {
        "not": {
          "in": [
            1236,
            "@TraceFlag"
          ]
        }
      }
    },
    {
      "id": "TF1462",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "TraceFlag",
        "Performance",
        "AvailabilityGroups"
      ],
      "displayName": "TF 1462 should be disabled to allow Log Stream Compression",
      "description": "Trace Flag 1462 disables log stream compression for asynchronous availability groups. This feature is enabled by default on asynchronous replicas to optimize network bandwidth.",
      "message": "Disable trace flag 1462 to allow log stream compression",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/availability-groups/windows/tune-compression-for-availability-group",
      "level": "Medium",
      "condition": {
        "not": {
          "in": [
            1462,
            "@TraceFlag"
          ]
        }
      },
      "probes": [
        "EnabledGlobalTraceFlags"
      ]
    },
    {
      "id": "TF2312",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": "Windows",
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "TraceFlag",
        "QueryOptimizer",
        "Performance"
      ],
      "displayName": "TF 2312 sets the default cardinality estimation model",
      "description": "Trace Flag 2312 sets the Query Optimizer cardinality estimation model to the default version of the database compability level of SQL Server 2014 and higher versions. If the database compatibility level is lower than 120, enabling trace flag 2312 uses the cardinality estimation model of SQL Server 2014 (120).",
      "message": "Trace Flag 2312 does not apply to this SQL Server version. Check if you need to set a non-default trace flag with the current system build and configuration",
      "helpLink": "https://support.microsoft.com/help/2801413",
      "level": "Low",
      "condition": {
        "not": {
          "in": [
            2312,
            "@TraceFlag"
          ]
        }
      },
      "probes": [
        "EnabledGlobalTraceFlags"
      ]
    },
    {
      "id": "TF2312",
      "itemType": "override",
      "targetFilter": {
        "version": "[12.0, )"
      },
      "message": "TF2312 sets the query optimizer cardinality estimation model to SQL Server 2014 or above versions, dependent of the compatibility level of the database",
      "level": "Information",
      "enabled": false
    },
    {
      "id": "TF2330",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer"
      },
      "tags": [
        "DefaultRuleset",
        "TraceFlag",
        "Performance",
        "Indexes"
      ],
      "displayName": "TF 2330 disables recording of index usage stats",
      "description": "Trace Flag 2330 disables recording of index usage stats, which could lead to a non-yielding condition in SQL 2005.",
      "message": "Check if you need to disable recording of index usage stats by setting non-default trace flag 2330",
      "helpLink": "https://blogs.msdn.microsoft.com/ialonso/2012/10/08/faq-around-sys-dm_db_index_usage_stats",
      "level": "Low",
      "condition": {
        "not": {
          "in": [
            2330,
            "@TraceFlag"
          ]
        }
      },
      "probes": [
        "EnabledGlobalTraceFlags"
      ]
    },
    {
      "id": "TF2340",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "TraceFlag",
        "QueryOptimizer",
        "Performance"
      ],
      "displayName": "TF 2340 disables Batch Sorts for optimized nested loops joins",
      "description": "Trace Flag 2340 causes SQL Server not to use a sort operation (batch sort) for optimized nested loops joins when generating a plan. Verify need to set a non-default trace flag with the current system build and configuration.",
      "message": "Trace Flag 2340 disables Batch Sorts for optimized nested loops joins",
      "helpLink": "https://docs.microsoft.com/sql/t-sql/database-console-commands/dbcc-traceon-trace-flags-transact-sql",
      "level": "Information",
      "condition": {
        "not": {
          "in": [
            2340,
            "@TraceFlag"
          ]
        }
      },
      "probes": [
        "EnabledGlobalTraceFlags"
      ]
    },
    {
      "id": "TF2371",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "version": "[11.0,)",
        "platform": "Windows",
        "engineEdition": "SqlServer"
      },
      "tags": [
        "DefaultRuleset",
        "TraceFlag",
        "Performance",
        "Statistics"
      ],
      "displayName": "TF 2371 enables a linear recompilation threshold for statistics",
      "description": "Trace Flag 2371 causes SQL Server to change the fixed update statistics threshold to a linear update statistics threshold. This is especially useful to keep statistics updated on large tables.",
      "message": "Enable trace Flag 2371 to allow linear recompilation threshold for statistics",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/statistics/statistics#auto_update_statistics-option",
      "level": "Information",
      "condition": {
        "in": [
          2371,
          "@TraceFlag"
        ]
      },
      "probes": [
        "EnabledGlobalTraceFlags"
      ]
    },
    {
      "id": "TF2371",
      "itemType": "override",
      "targetFilter": {
        "version": "[13.0,)"
      },
      "description": "Trace Flag 2371 causes SQL Server to change the fixed update statistics threshold to a linear update statistics threshold. This is especially useful to keep statistics updated on large tables. Starting with SQL Server 2016, for databases using compatibility level 130 and above, this behavior is controlled by the engine and trace flag 2371 has no effect.",
      "condition": {
        "or": [
          {
            "ge": [
              "@min_compatibility_level",
              130
            ]
          },
          {
            "in": [
              2371,
              "@TraceFlag"
            ]
          }
        ]
      },
      "probes": [
        "EnabledGlobalTraceFlags",
        "DatabasesAggregates"
      ]
    },
    {
      "id": "TF2389",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "TraceFlag",
        "Statistics",
        "Performance"
      ],
      "displayName": "TF 2389 enables automatic statistics for ascending keys",
      "description": "Trace Flag 2389 enables automatically generated quick statistics for ascending keys (histogram amendment). This trace flag is recommended to be set in cases where queries access newly inserted ascending key values (such as an IDENTITY column), but the new values are not yet updated in the statistics histogram for the affected columns. In this case the histogram used to estimate cardinality will be adjusted at query compile time. Verify need to set a non-default trace flag with the current system build and configuration.",
      "message": "Check if you need to set non-default trace flag 2389 with current system build and configuration",
      "helpLink": "https://support.microsoft.com/help/2801413",
      "level": "Information",
      "condition": {
        "not": {
          "in": [
            2389,
            "@TraceFlag"
          ]
        }
      },
      "probes": [
        "EnabledGlobalTraceFlags"
      ]
    },
    {
      "id": "TF2390",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "TraceFlag",
        "Statistics",
        "Performance",
        "Indexes"
      ],
      "displayName": "TF 2390 enables automatic statistics for Ascending or Unknown Keys",
      "description": "Trace Flag 2390 enables automatically generated quick statistics for ascending or unknown keys (histogram amendment). This trace flag is recommended to be set in cases where queries access newly inserted ascending key values (such as an IDENTITY column), but the new values are not yet updated in the statistics histogram for the affected columns. In this case the histogram used to estimate cardinality will be adjusted at query compile time. Verify need to set a non-default trace flag with the current system build and configuration.",
      "message": "Trace Flag 2390 enables automatic statistics for ascending or unknown keys. Check if you need to set non-default trace flag with current system build and configuration",
      "helpLink": "https://support.microsoft.com/help/2801413",
      "level": "Information",
      "condition": {
        "not": {
          "in": [
            2390,
            "@TraceFlag"
          ]
        }
      },
      "probes": [
        "EnabledGlobalTraceFlags"
      ]
    },
    {
      "id": "TF2528",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "TraceFlag",
        "DataIntegrity",
        "DBCC"
      ],
      "displayName": "TF 2528 disables parallel operations for integrity checking",
      "description": "Trace Flag 2528 disables parallel checking of objects by DBCC CHECKDB, DBCC CHECKFILEGROUP, and DBCC CHECKTABLE. By default, the degree of parallelism is automatically determined by the query processor. The maximum degree of parallelism is configured just like that of parallel queries. When parallel checks are disabled, the DBCC commands will take longer to complete. Starting with SQL Server 2014 SP2, a MAXDOP option is available to override the max degree of parallelism configuration option of sp_configure for the DBCC statements.",
      "message": "Trace Flag 2528 disables parallel operations for integrity checking, and can cause it to take longer to complete",
      "helpLink": "https://docs.microsoft.com/sql/t-sql/database-console-commands/dbcc-traceon-trace-flags-transact-sql",
      "level": "Low",
      "condition": {
        "not": {
          "in": [
            2528,
            "@TraceFlag"
          ]
        }
      },
      "probes": [
        "EnabledGlobalTraceFlags"
      ]
    },
    {
      "id": "TF2549",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "TraceFlag",
        "DBCC"
      ],
      "displayName": "TF 2549 optimizes PHYSICAL_ONLY option of DBCC CHECKDB",
      "description": "Trace Flag 2549 forces the DBCC CHECKDB command to assume each database file is on a unique disk drive but treating different physical files as one logical file. This trace flag can improve the performance when using the PHYSICAL_ONLY option, but it's not recommended unless it is known that each file is based on a unique physical disk.",
      "message": "Do not use this trace flag unless you know that each file is based on a unique physical disk",
      "helpLink": "https://support.microsoft.com/help/2634571",
      "level": "Low",
      "condition": {
        "not": {
          "in": [
            2549,
            "@TraceFlag"
          ]
        }
      },
      "probes": [
        "EnabledGlobalTraceFlags"
      ]
    },
    {
      "id": "TF2562",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "TraceFlag",
        "DBCC",
        "TempDB"
      ],
      "displayName": "TF 2562 forces 'DBCC CHECKDB' command to execute in single batch",
      "description": "Trace Flag 2562 forces the DBCC CHECKDB command to execute in a single batch regardless of the number of indexes in the database. This trace flag can improve the performance when using the PHYSICAL_ONLY option, but space requirements for TempDB may increase.",
      "message": "Disable trace flag 2562, which forces 'DBCC CHECKDB' command to execute in single batch",
      "helpLink": "https://support.microsoft.com/help/2634571",
      "level": "Low",
      "condition": {
        "not": {
          "in": [
            2562,
            "@TraceFlag"
          ]
        }
      },
      "probes": [
        "EnabledGlobalTraceFlags"
      ]
    },
    {
      "id": "TF2566",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "TraceFlag",
        "DBCC",
        "DataIntegrity"
      ],
      "displayName": "TF 2566 disables default data purity check",
      "description": "Trace Flag 2566 forces the DBCC CHECKDB command to execute without data purity check unless the DATA_PURITY option is specified. For databases upgraded from earlier versions of SQL Server, it is recommended to run the DBCC CHECKDB WITH DATA_PURITY command at least once, to enable column-value integrity checks to happen by default.",
      "message": "Disable trace flag 2566 to turn on default data purity check",
      "helpLink": "https://support.microsoft.com/help/945770",
      "level": "Medium",
      "condition": {
        "not": {
          "in": [
            2566,
            "@TraceFlag"
          ]
        }
      },
      "probes": [
        "EnabledGlobalTraceFlags"
      ]
    },
    {
      "id": "TF3023",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "TraceFlag",
        "Backup"
      ],
      "displayName": "TF 3023 enables Backup Checksum option by default",
      "description": "Trace Flag 3023 enables the CHECKSUM option of the BACKUP command by default. This trace flag forces the CHECKSUM option for BACKUP command even when not explicitely set. Starting with SQL Server 2014, this behavior is controlled by setting the Backup Checksum Default configuration option.",
      "message": "Disable trace flag 3023 to turn off 'CHECKSUM' option as default for 'BACKUP' command",
      "helpLink": "https://support.microsoft.com/help/2656988",
      "level": "Information",
      "condition": {
        "not": {
          "in": [
            3023,
            "@TraceFlag"
          ]
        }
      },
      "probes": [
        "EnabledGlobalTraceFlags"
      ]
    },
    {
      "id": "TF3042",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "TraceFlag",
        "Backup"
      ],
      "displayName": "TF 3042 bypasses default backup compression pre-allocation algorithm",
      "description": "Trace Flag 3042 bypasses the default backup compression pre-allocation algorithm to allow the backup file to grow only as needed to reach its final size. This trace flag can achieve space savings by allocating only the actual size required for the compressed backup, but might increase the overall backup operation time.",
      "message": "Disable trace flag 3042 as using this trace flag might cause a slight performance penalty",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/backup-restore/backup-compression-sql-server",
      "level": "Information",
      "condition": {
        "not": {
          "in": [
            3042,
            "@TraceFlag"
          ]
        }
      },
      "probes": [
        "EnabledGlobalTraceFlags"
      ]
    },
    {
      "id": "TF3226",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "TraceFlag",
        "Backup"
      ],
      "displayName": "TF 3226 disables ErrorLog entries for successful backup operations",
      "description": "Trace Flag 3226 prevents SQL Server from recording an entry to the Errorlog on every successful backup operation. Backup operations are registered in the Errorlog by default. Frequent backup operations can contribute to massive Errorlog files that become unwieldy.",
      "message": "Disable trace flag 3226 to prevent SQL Server from recording ErrorLog entries for each successful backup operation",
      "helpLink": "https://docs.microsoft.com/sql/t-sql/database-console-commands/dbcc-traceon-trace-flags-transact-sql",
      "level": "Information",
      "condition": {
        "not": {
          "in": [
            3226,
            "@TraceFlag"
          ]
        }
      },
      "probes": [
        "EnabledGlobalTraceFlags"
      ]
    },
    {
      "id": "TF4136",
      "itemType": "override",
      "targetFilter": {
        "version": "[11.0.2316,)"
      },
      "description": "Trace Flag 4136 disables parameter sniffing unless OPTION(RECOMPILE), WITH RECOMPILE or OPTIMIZE FOR value is used. Starting with SQL Server 2016, to accomplish this at the database level use the PARAMETER_SNIFFING option in ALTER DATABASE SCOPED CONFIGURATION. Verify need to set a non-default trace flag with the current system build and configuration.",
      "message": "Disable trace flag 4136 to prevent parameter sniffing. Verify need to set non-default trace flag with current system build and configuration",
      "level": "Information"
    },
    {
      "id": "TF4136",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "TraceFlag"
      ],
      "displayName": "TF 4136 disables parameter sniffing",
      "description": "Trace Flag 4136 disables parameter sniffing unless OPTION(RECOMPILE), WITH RECOMPILE or OPTIMIZE FOR value is used, but does not apply to this SQL Server version. Starting with SQL Server 2016, to accomplish this at the database level use the PARAMETER_SNIFFING option in ALTER DATABASE SCOPED CONFIGURATION. Verify need to set a non-default trace flag with the current system build and configuration.",
      "message": "Trace Flag 4136 does not apply to this SQL Server version. Verify need to set a non-default trace flag with the current system build and configuration",
      "helpLink": "https://support.microsoft.com/help/980653",
      "level": "Medium",
      "condition": {
        "not": {
          "in": [
            4136,
            "@TraceFlag"
          ]
        }
      },
      "probes": [
        "EnabledGlobalTraceFlags"
      ]
    },
    {
      "id": "TF4137",
      "itemType": "override",
      "targetFilter": {
        "version": "[11.0.2316,)"
      },
      "description": "Trace Flag 4137 causes SQL Server to generate a plan using minimum selectivity when estimating AND predicates for filters to account for partial correlation instead of independence, under the query optimizer cardinality estimation model of SQL Server 2012 and earlier versions (CE 70). Does not apply to CE version 120 or above. Use trace flag 9471 instead. Starting with SQL Server 2016 SP1, to accomplish this at the query level use the USE HINT 'ASSUME_MIN_SELECTIVITY_FOR_FILTER_ESTIMATES' query hint. Verify need to set a non-default trace flag with the current system build and configuration.",
      "message": "Disable trace flag 4137 to instruct SQL Server to generate plan using partial correlation of filters. Verify need to set non-default trace flag with the current system build and configuration",
      "level": "Information"
    },
    {
      "id": "TF4137",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "TraceFlag",
        "QueryOptimizer",
        "Performance"
      ],
      "displayName": "TF 4137 causes plans to use partial correlation for filters",
      "description": "Trace Flag 4137 causes SQL Server to generate a plan using minimum selectivity when estimating AND predicates for filters to account for partial correlation instead of independence, under the query optimizer cardinality estimation model of SQL Server 2012 and earlier versions (CE 70). However it does not apply to this SQL Server version. Does not apply to CE version 120 or above. Use trace flag 9471 instead. Starting with SQL Server 2016 SP1, to accomplish this at the query level use the USE HINT 'ASSUME_MIN_SELECTIVITY_FOR_FILTER_ESTIMATES' query hint. Verify need to set a non-default trace flag with the current system build and configuration.",
      "message": "Trace flag 4137 does not apply to this SQL Server version. Verify need to set a non-default trace flag with the current system build and configuration",
      "helpLink": "https://support.microsoft.com/help/2658214",
      "condition": {
        "not": {
          "in": [
            4137,
            "@TraceFlag"
          ]
        }
      },
      "probes": [
        "EnabledGlobalTraceFlags"
      ]
    },
    {
      "id": "TF4138",
      "itemType": "override",
      "targetFilter": {
        "version": "[11.0.2325,)"
      },
      "description": "Trace Flag 4138 causes SQL Server to generate a plan that does not use row goal adjustments with queries that contain TOP, OPTION (FAST N), IN, or EXISTS keywords. Starting with SQL Server 2016 SP1, to accomplish this at the query level use the USE HINT 'DISABLE_OPTIMIZER_ROWGOAL' query hint. Verify need to set a Non-default trace flag with current system build and configuration.",
      "message": "Trace Flag 4138 enables plan that without row goal adjustments. Verify need to set a non-default trace flag with the current system build and configuration",
      "level": "Information"
    },
    {
      "id": "TF4138",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "TraceFlag",
        "QueryOptimizer",
        "Performance"
      ],
      "displayName": "TF 4138 causes plans to not use Row Goal adjustments",
      "description": "Trace Flag 4138 causes SQL Server to generate a plan that does not use row goal adjustments with queries that contain TOP, OPTION (FAST N), IN, or EXISTS keywords. Starting with SQL Server 2016 SP1, to accomplish this at the query level use the USE HINT 'DISABLE_OPTIMIZER_ROWGOAL' query hint. However it does not apply to this SQL Server version. Verify need to set a Non-default trace flag with current system build and configuration.",
      "message": "Trace flag 4138 does not apply to this SQL Server version. Verify need to set a non-default trace flag with the current system build and configuration",
      "helpLink": "https://support.microsoft.com/help/2667211",
      "condition": {
        "not": {
          "in": [
            4138,
            "@TraceFlag"
          ]
        }
      },
      "probes": [
        "EnabledGlobalTraceFlags"
      ]
    },
    {
      "id": "TF4139",
      "itemType": "override",
      "targetFilter": {
        "version": [
          "[11.0.3431,11.0.5058)",
          "[11.0.5532,)"
        ]
      },
      "description": "Trace Flag 4139 enables automatically generated quick statistics (histogram amendment) regardless of key column status. This trace flag is recommended to be set in cases where queries access newly inserted key values that may change plan shape, but the new values are not yet updated in the statistics histogram for the affected columns. In this case, regardless of the leading statistics column status (ascending, descending, or stationary), the histogram used to estimate cardinality will be adjusted at query compile time. This trace flag does not apply to the cardinality estimation model of SQL Server 2012 and earlier versions (CE 70). Verify need to set a non-default trace flag with the current system build and configuration.",
      "message": "Trace Flag 4139 enables automatic statistics for any key ordering. Verify need to set a non-default trace flag with the current system build and configuration",
      "level": "Information"
    },
    {
      "id": "TF4139",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "TraceFlag",
        "Statistics"
      ],
      "displayName": "TF 4139 enables automatic statistics for any key ordering",
      "description": "Trace Flag 4139 enables automatically generated quick statistics (histogram amendment) regardless of key column status. However, this trace flag does not apply to this SQL Server version. Verify need to set a non-default trace flag with the current system build and configuration.",
      "message": "Trace flag 4139 does not apply to this SQL Server version. Verify need to set a non-default trace flag with the current system build and configuration",
      "helpLink": "https://support.microsoft.com/help/2952101",
      "condition": {
        "not": {
          "in": [
            4139,
            "@TraceFlag"
          ]
        }
      },
      "probes": [
        "EnabledGlobalTraceFlags"
      ]
    },
    {
      "id": "TF4199",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "version": "[11.0, 14.0)",
        "platform": "Windows",
        "engineEdition": "SqlServer"
      },
      "tags": [
        "DefaultRuleset",
        "TraceFlag",
        "QueryOptimizer"
      ],
      "displayName": "TF 4199 enables query optimizer fixes",
      "description": "Trace Flag 4199 enables Query Optimizer fixes released in SQL Server Cumulative Updates and Service Packs.",
      "message": "Trace Flag 4199 enables Query Optimizer fixes. Verify need to set a non-default trace flag with the current system build and configuration",
      "helpLink": "http://support.microsoft.com/help/974006",
      "level": "Information",
      "condition": {
        "not": {
          "in": [
            4199,
            "@TraceFlag"
          ]
        }
      },
      "probes": [
        "EnabledGlobalTraceFlags"
      ]
    },
    {
      "id": "TF6498",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[12.0.5000,)"
      },
      "tags": [
        "DefaultRuleset",
        "TraceFlag",
        "Performance",
        "Memory"
      ],
      "displayName": "TF 6498 enables additional concurrent large queries",
      "description": "Trace Flag 6498 enables more than one large query compilation to gain access to the big gateway when there is sufficient memory available. However, this trace flag does not apply to this SQL Server version. This trace flag can be used to keep memory usage for the compilation of incoming queries under control, avoiding compilation waits for concurrent large queries. Starting with SQL Server 2014 SP2 and SQL Server 2016, this behavior is controlled by the engine and trace flag 1236 has no effect.",
      "message": "Trace Flag 6498 does not apply to this SQL Server version. Verify need to set a non-default trace flag with the current system build and configuration",
      "helpLink": "https://support.microsoft.com/help/3024815",
      "level": "Low",
      "condition": {
        "not": {
          "in": [
            6498,
            "@TraceFlag"
          ]
        }
      },
      "probes": [
        "EnabledGlobalTraceFlags"
      ]
    },
    {
      "id": "TF6532",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "version": "[11.0.6020,11.0.6518)",
        "platform": "Windows",
        "engineEdition": "SqlServer"
      },
      "tags": [
        "DefaultRuleset",
        "TraceFlag",
        "Performance"
      ],
      "displayName": "TF 6532 enables performance improvements for spatial data",
      "description": "Trace Flag 6532 enables performance improvements of query operations with spatial data types. The performance gain will vary, depending on the configuration, the types of queries, and the objects.",
      "message": "Enable trace flag 6532 to enable performance improvements for spatial data",
      "helpLink": "https://support.microsoft.com/help/3107399",
      "level": "Information",
      "condition": {
        "in": [
          6532,
          "@TraceFlag"
        ]
      },
      "probes": [
        "EnabledGlobalTraceFlags"
      ]
    },
    {
      "id": "TF6532.6533",
      "itemType": "override",
      "targetFilter": {
        "version": "[13.0,)"
      },
      "message": "Disable trace flag 6532 in SQL Server 2016 and higher versions.",
      "condition": {
        "and": [
          {
            "not": {
              "in": [
                6532,
                "@TraceFlag"
              ]
            }
          },
          {
            "not": {
              "in": [
                6533,
                "@TraceFlag"
              ]
            }
          }
        ]
      }
    },
    {
      "id": "TF6532.6533",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": "Windows",
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "TraceFlag",
        "Performance"
      ],
      "description": "Trace flags 6532 and 6533 enable performance improvements of query operations with spatial data types. The performance gain will vary, depending on the configuration, types of queries, and objects.",
      "message": "Enable trace flags 6532 and 6533 to improve spatial data performance",
      "level": "Information",
      "displayName": "TF 6532 and 6533 improve spatial data performance",
      "helpLink": "https://support.microsoft.com/help/3107399",
      "condition": {
        "and": [
          {
            "in": [
              6532,
              "@TraceFlag"
            ]
          },
          {
            "in": [
              6533,
              "@TraceFlag"
            ]
          }
        ]
      },
      "probes": [
        "EnabledGlobalTraceFlags"
      ]
    },
    {
      "id": "TF6534",
      "itemType": "override",
      "targetFilter": {
        "version": [
          "[11.0.6020,12.0)",
          "[12.0.5000,13.0)"
        ]
      },
      "description": "Trace Flag 6534 enables performance improvements of query operations with spatial data types. The performance gain will vary, depending on the configuration, the types of queries, and the objects.",
      "message": "Enable trace flag 6534 to enable performance improvement of query operations with spatial data types",
      "level": "Information",
      "condition": {
        "in": [
          6534,
          "@TraceFlag"
        ]
      }
    },
    {
      "id": "TF6534",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": "Windows",
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "TraceFlag",
        "Performance"
      ],
      "displayName": "TF 6534 enables performance improvements for spatial data",
      "description": "Trace Flag 6534 enables performance improvement of query operations with spatial data types. However, this trace flag does not apply to this SQL Server version. Verify need to set a Non-default trace flag with current system build and configuration.",
      "message": "Verify need to set a non-default trace flag with the current system build and configuration",
      "helpLink": "https://support.microsoft.com/help/3107399",
      "condition": {
        "not": {
          "in": [
            6534,
            "@TraceFlag"
          ]
        }
      },
      "probes": [
        "EnabledGlobalTraceFlags"
      ]
    },
    {
      "id": "TF7412",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "version": "[13.0.4001,15.0)",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer"
      },
      "tags": [
        "DefaultRuleset",
        "TraceFlag",
        "Performance"
      ],
      "displayName": "TF 7412 enables the lightweight profiling infrastructure",
      "description": "Trace Flag 7412 enables the lightweight profiling infrastructure for live query performance troubleshooting. Consider enabling TF 7412 to have the ability to access runtime information on query execution plans for any session.",
      "message": "Enable trace flag 7412 to enable lightweight profiling infrastructure for live query performance troubleshooting",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/performance/query-profiling-infrastructure",
      "level": "Information",
      "condition": {
        "in": [
          7412,
          "@TraceFlag"
        ]
      },
      "probes": [
        "EnabledGlobalTraceFlags"
      ]
    },
    {
      "id": "TF9024",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": "Windows",
        "engineEdition": "SqlServer"
      },
      "tags": [
        "DefaultRuleset",
        "TraceFlag",
        "Performance",
        "NUMA",
        "Memory",
        "CPU"
      ],
      "displayName": "TF 9024 converts global log pool memory object",
      "description": "TF9024 converts a global log pool memory object into NUMA node partitioned memory object.",
      "message": "Verify need to set non-default trace flag with current system build and configuration",
      "helpLink": "https://support.microsoft.com/help/2809338/fix-high-log-write-waits-counter-value-on-a-sql-server-2012-or-sql-ser",
      "level": "Low",
      "condition": {
        "not": {
          "in": [
            9024,
            "@TraceFlag"
          ]
        }
      },
      "probes": [
        "EnabledGlobalTraceFlags"
      ]
    },
    {
      "id": "TF9024",
      "itemType": "override",
      "targetFilter": {
        "version": [
          "[11.0.3349, 11.0.6020)",
          "[12.0, 12.0.4100)"
        ]
      },
      "message": "Enable trace flag 9024 to convert global log pool memory objects into NUMA node partitioned memory objects",
      "level": "Information",
      "condition": [
        {
          "in": [
            9024,
            "@TraceFlag"
          ]
        },
        {
          "gt": [
            8,
            {
              "div": [
                "@online_logical_processors",
                "@numa_nodes"
              ]
            }
          ]
        }
      ],
      "probes": [
        "EnabledGlobalTraceFlags",
        "ServerInstanceConfiguration"
      ]
    },
    {
      "id": "TF9024",
      "itemType": "override",
      "targetFilter": {
        "version": [
          "[11.0.6020, 12.0)",
          "[12.0.4100,)"
        ]
      },
      "message": "TF9024 is not needed in SQL Server 2012 SP3, SQL Server 2014 SP1 and above."
    },
    {
      "id": "TF8048",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": "Windows",
        "engineEdition": "SqlServer"
      },
      "tags": [
        "DefaultRuleset",
        "TraceFlag",
        "Performance",
        "NUMA",
        "CPU",
        "Memory"
      ],
      "displayName": "TF 8048 converts NUMA partitioned memory objects into CPU partitioned",
      "description": "TF 8048 converts NUMA partitioned memory objects into CPU partitioned.",
      "message": "Verify need to set a Non-default TF 8048 with current system build and configuration",
      "helpLink": "https://support.microsoft.com/help/2809338/fix-high-log-write-waits-counter-value-on-a-sql-server-2012-or-sql-ser",
      "level": "Low",
      "condition": {
        "not": {
          "in": [
            8048,
            "@TraceFlag"
          ]
        }
      },
      "probes": [
        "EnabledGlobalTraceFlags"
      ]
    },
    {
      "id": "TF8048",
      "itemType": "override",
      "targetFilter": {
        "version": "[12.0.4100,)"
      },
      "message": "Disable trace flag 8048 in SQL Server 2014 SP2, SQL Server 2016 and above"
    },
    {
      "id": "TF8048",
      "itemType": "override",
      "targetFilter": {
        "version": "[11.0, 12.0.4100)"
      },
      "message": "Enable trace flag 8048 to convert NUMA partitioned memory objects into CPU partitioned",
      "level": "Information",
      "condition": [
        {
          "in": [
            8048,
            "@TraceFlag"
          ]
        },
        {
          "gt": [
            8,
            {
              "div": [
                "@online_logical_processors",
                "@numa_nodes"
              ]
            }
          ]
        }
      ],
      "probes": [
        "EnabledGlobalTraceFlags",
        "ServerInstanceConfiguration"
      ]
    },
    {
      "id": "DeprecatedFeatures",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "name": {
          "not": [
            "master",
            "tempdb",
            "model",
            "msdb"
          ]
        },
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Deprecated",
        "Security",
        "UpdateIssues",
        "Performance"
      ],
      "displayName": "Deprecated or discontinued features should not be used",
      "description": "This check detects deprecated or discontinued features used on target SQL Server instances. Deprecated features may be removed in a future release of SQL Server. Discontinued features have been removed from specific versions of SQL Server.",
      "message": "Use actual features for SQL Server version @{ProductVersion} instead of found deprecated features: @{DeprecatedFeature}",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/performance-monitor/sql-server-deprecated-features-object",
      "condition": {
        "equal": [
          "@DeprecatedFeature",
          ""
        ]
      },
      "probes": [
        "DeprecatedFeaturesStats",
        "SQLServerVersion"
      ]
    },
    {
      "id": "SystemHealthSession",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "XEvent",
        "SystemHealth"
      ],
      "displayName": "'system_health' XEvent session is not active",
      "description": "This session starts automatically when the SQL Server Database Engine starts, and runs without any noticeable performance effects. The session collects system data that you can use to help troubleshoot performance issues in the Database Engine. We recommend that you do not stop, alter, or delete the system health session.",
      "message": "Start system health session by using 'ALTER EVENT SESSION' statement or Extended Events node in Object Explorer",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/extended-events/use-the-system-health-session",
      "level": "Medium",
      "condition": "@XEvent.SystemHealthCount",
      "probes": [
        "XEvent.SystemHealth"
      ]
    },
    {
      "id": "SPServerDiagnosticsSession",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "XEvent",
        "SystemHealth"
      ],
      "displayName": "'sp_server_diagnostics' xEvent session is not active",
      "description": "This session starts automatically when the SQL Server Database Engine starts, and runs without any noticeable performance effects. The session collects system data that you can use to help troubleshoot performance issues in the Database Engine. We recommend that you do not stop, alter, or delete the system health session.",
      "message": "Start xEvent session by using 'ALTER EVENT SESSION' statement or Extended Events node in Object Explorer",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/system-stored-procedures/sp-server-diagnostics-transact-sql",
      "level": "Low",
      "condition": "@XEvent.SPServerDiagnostics",
      "probes": [
        "XEvent.SPServerDiagnostics"
      ]
    },
    {
      "id": "DefaultTrace",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Traces"
      ],
      "displayName": "Default trace was not found or is inactive",
      "description": "Default trace provides troubleshooting assistance to database administrators by ensuring that they have the log data necessary to diagnose problems the first time they occur.",
      "message": "Check if there is enough space on SQL Server to write default trace file, then run default trace by disabling and reenabling it",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/policy-based-management/default-trace-log-files-disabled",
      "level": "Low",
      "condition": "@DefaultTraceCount",
      "probes": [
        "CountDefaultTraces"
      ]
    },
    {
      "id": "HintsStatistics",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "QueryOptimizer",
        "Performance",
        "Statistics"
      ],
      "displayName": "Hints are used",
      "description": "Hints are options or strategies specified for enforcement by the SQL Server query processor on SELECT, INSERT, UPDATE, or DELETE statements. The hints override any execution plan the Query Optimizer might select for a query. Because the SQL Server Query Optimizer typically selects the best execution plan for a query, we recommend that <join_hint>, <query_hint>, and <table_hint> be used only as a last resort by experienced developers and database administrators.",
      "message": "Use <join_hint>, <query_hint> and <table_hint> in specific cases only since SQL Server Query Optimizer typically selects best execution plan for queries",
      "helpLink": "https://docs.microsoft.com/sql/t-sql/queries/hints-transact-sql",
      "level": "Information",
      "condition": {
        "@HintUsageCount": 0
      },
      "probes": [
        "Hints.InstanceStatistics"
      ]
    },
    {
      "id": "HintsUsageInModules",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "QueryOptimizer",
        "Performance",
        "Statistics"
      ],
      "displayName": "Hints usage in modules",
      "enabled": false,
      "description": "Hints are options or strategies specified for enforcement by the SQL Server query processor on SELECT, INSERT, UPDATE, or DELETE statements. The hints override any execution plan the Query Optimizer might select for a query. Because the SQL Server Query Optimizer typically selects the best execution plan for a query, we recommend that <join_hint>, <query_hint>, and <table_hint> be used only as a last resort by experienced developers and database administrators.",
      "message": "@{Hint} used in @{type_desc} @{Schema_Name}.@{Object_Name}",
      "helpLink": "https://docs.microsoft.com/sql/t-sql/queries/hints-transact-sql",
      "level": "Information",
      "probes": [
        "Hints.ModuleUsage"
      ]
    },
    {
      "id": "PlansUseRatio",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Performance",
        "QueryOptimizer"
      ],
      "displayName": "Amount of single-use plans in cache is high",
      "description": "The 'Optimize for ad hoc workloads' option helps relieve memory pressure by not allowing the plan cache to become filled with compiled plans that aren't reused.",
      "message": "Enable 'Optimize for ad hoc workloads' option on heavy OLTP ad-hoc workloads to conserve resources. Current amount of single-use plans in cache is high (@{SingleUsePlansUseRatio:P0})",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/optimize-for-ad-hoc-workloads-server-configuration-option",
      "level": "Medium",
      "threshold": 0.5,
      "condition": {
        "or": [
          {
            "lt": [
              "@SingleUsePlansUseRatio",
              "@threshold"
            ]
          },
          "@optimize_for_ad_hoc_workloads"
        ]
      },
      "probes": [
        "SysConfiguration",
        "CachedPlans.SingleUseRatio"
      ]
    },
    {
      "id": "HypotheticalIndexes",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "name": {
          "not": [
            "master",
            "model",
            "msdb",
            "tempdb"
          ]
        },
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Indexes",
        "Performance"
      ],
      "displayName": "Hypothetical indexes found",
      "description": "Database has indexes that are marked as hypothetical. Hypothetical indexes are created by the Database Tuning Assistant (DTA) during its tests. If a DTA session was interrupted, these indexes may not be deleted. It is recommended to drop these objects as soon as possible.",
      "message": "Drop hypothetical @{IndexName} index for @{Schema}.@{Object}",
      "helpLink": "https://blogs.technet.microsoft.com/anurag_sharma/2008/04/15/hypothetical-indexes",
      "level": "Medium",
      "probes": [
        "Hypothetical.Indexes"
      ]
    },
    {
      "id": "HypotheticalStatistics",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Statistics"
      ],
      "displayName": "Hypothetical statistics found",
      "description": "Database has statistics that are marked as hypothetical. Hypothetical statistics are created by the Database Tuning Assistant (DTA) during its tests. If a DTA session was interrupted, these statistics may not be deleted. It is recommended to drop these objects as soon as possible.",
      "message": "Drop hypothetical @{StatName} statistics for @{Schema}.@{Object}",
      "helpLink": "https://blogs.technet.microsoft.com/anurag_sharma/2008/04/15/hypothetical-indexes",
      "level": "Medium",
      "probes": [
        "Hypothetical.Statistics"
      ]
    },
    {
      "id": "LatestCU",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Security",
        "UpdateIssues"
      ],
      "displayName": "SQL Server version is not supported",
      "description": "The Microsoft Support Lifecycle (MSL) policy offers a minimum of 10 years of support (5 years Mainstream support and 5 years Extended support). It also provides support for 1 year after the new service pack was released, older service packs are unsupported.",
      "message": "Update SQL Server and install service packs and cumulative updates. Current product version @{ProductVersion} of SQL Server is out of support",
      "helpLink": "https://support.microsoft.com/help/321185/how-to-determine-the-version-edition-and-update-level-of-sql-server-an",
      "level": "Medium",
      "probes": [
        "SQLServerVersion"
      ]
    },
    {
      "id": "LatestCU",
      "itemType": "override",
      "targetFilter": {
        "version": [
          "[11.0.7001, 12.0)",
          "[12.0.6024, 13.0)",
          "[13.0.6300,)"
        ]
      },
      "displayName": "SQL Server instance is not up to date",
      "description": "On an installed instance of SQL Server, we recommend that you apply the latest security updates and critical updates including general distribution releases (GDRs), service packs (SPs), and cumulative updates (CUs).",
      "message": "Update SQL Server and install service packs and cumulative updates. Current product version @{ProductVersion} is not up to date"
    },
    {
      "id": "LatestCU",
      "itemType": "override",
      "targetFilter": {
        "version": [
          "[11.0.7507, 12.0)",
          "[12.0.6439, 13.0)",
          "[13.0.6419, 14.0)",
          "[14.0.3445, 15.0)",
          "[15.0.4236,)"
        ]
      },
      "displayName": "SQL Server instance is up to date",
      "message": "Product version @{ProductVersion} is latest available",
      "condition": true
    },
    {
      "id": "LatestCU",
      "itemType": "override",
      "targetFilter": {
        "version": "[11.0, 12.0)"
      },
      "description": "We recommend upgrading to the latest SQL Server version to keep your instances secure and compliant. If upgrade is not an option at this point, follow the help link to protect your SQL Server 2012 with Extended Security Updates (ESU).",
      "message": "Upgrade SQL Server 2012 to receive full product updates and Microsoft Support. End of support is July, 12 2022.",
      "helpLink": "https://docs.microsoft.com/sql/sql-server/end-of-support/sql-server-extended-security-updates"
    },
    {
      "id": "FKNoIndexes",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "engineEdition": "SqlServer, ManagedInstance",
        "platform": [
          "Windows",
          "Linux"
        ],
        "name": {
          "not": [
            "master",
            "model",
            "msdb",
            "tempdb"
          ]
        },
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Performance",
        "Indexes"
      ],
      "displayName": "Foreign key constraints should have corresponding indexes",
      "description": "Unlike primary key constraints, creating a foreign key constraint does not automatically create a corresponding index. However, manually creating an index on a foreign key is often useful.",
      "message": "Create a corresponding index on each foreign key in tables: @{TableName}",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/tables/primary-and-foreign-key-constraints",
      "level": "Medium",
      "probes": [
        {
          "id": "FKNoIndexes",
          "transform": {
            "type": "aggregate",
            "map": {
              "TableName": {
                "type": "join",
                "limit": 10
              }
            }
          }
        }
      ]
    },
    {
      "id": "MissedIndexes",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "name": {
          "not": [
            "master",
            "model",
            "msdb",
            "tempdb"
          ]
        },
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Performance",
        "Indexes"
      ],
      "displayName": "Potentially missing indexes",
      "description": "Potentially missing indexes were found based on query history. It may be important to revise them.",
      "message": "Create index on @{Table} with key columns @{KeyCols}@{IncludedCols: and included columns: #}",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/sql-server-index-design-guide",
      "level": "Information",
      "probes": [
        "MissedIndexes"
      ]
    },
    {
      "id": "FullBackup",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "name": {
          "not": [
            "model",
            "tempdb"
          ]
        },
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Backup"
      ],
      "displayName": "Full backup is missed or outdated",
      "description": "Database doesn't have any full backup or the latest full backup is over 7 days old.",
      "message": "Create full backup. Last full backup is over @{threshold} days old",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/backup-restore/create-a-full-database-backup-sql-server",
      "level": "Medium",
      "condition": {
        "not": {
          "equal": [
            "@LastFullBackup",
            null
          ]
        },
        "less": [
          "@LastFullBackup",
          {
            "mul": [
              "@threshold",
              24
            ]
          }
        ]
      },
      "threshold": 7,
      "probes": [
        "DatabaseBackups"
      ]
    },
    {
      "id": "OutdatedTranLogBackup",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "name": {
          "not": [
            "master",
            "model",
            "msdb",
            "tempdb"
          ]
        },
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Backup"
      ],
      "displayName": "Transaction Log backup is missed or outdated",
      "description": "Database does not have any transaction Log backup since the latest full or differential backup, or it's older than @{threshold}H.",
      "message": "Create transaction log backup. Database recovery model: @{recovery_model_desc}",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/backup-restore/back-up-a-transaction-log-sql-server",
      "level": "Medium",
      "threshold": 24,
      "condition": {
        "or": [
          {
            "eq": [
              "@recovery_model",
              3
            ]
          },
          {
            "and": [
              {
                "ne": [
                  "@LastTLBackup",
                  null
                ]
              },
              {
                "lt": [
                  "@LastTLBackup",
                  "@threshold"
                ]
              }
            ]
          }
        ]
      },
      "probes": [
        "DatabaseBackups"
      ]
    },
    {
      "id": "DbDiffCollation",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "DBConfiguration",
        "Collation"
      ],
      "displayName": "Database collation doesn't match master collation",
      "description": "We recommend that the collations of user-defined databases match the collation of master or model. Otherwise, collation conflicts can occur that might prevent code from executing. For example, when a stored procedure joins one table to a temporary table, SQL Server might end the batch and return a collation conflict error if the collations of the user-defined database and the model database are different. This occurs because temporary tables are created in tempdb, which bases its collation on that of model.",
      "message": "Keep database collation the same as master or model collation",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/set-collation-user-defined-databases-match-master-model-databases",
      "level": "Medium",
      "condition": {
        "equal": [
          "@collation_name",
          "@master_collation"
        ]
      },
      "probes": [
        "DatabaseConfiguration"
      ]
    },
    {
      "id": "AutoClose",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "name": {
          "not": [
            "master",
            "msdb",
            "tempdb"
          ]
        },
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Performance",
        "DBConfiguration"
      ],
      "displayName": "'AUTO_CLOSE' option should be OFF",
      "description": "When AUTO_CLOSE is set ON, this can cause performance degradation on frequently accessed databases because of the increased overhead of opening and closing the database after each connection. AUTO_CLOSE also flushes the procedure cache after each connection.",
      "message": "Set 'AUTO_CLOSE' option to OFF",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/policy-based-management/set-the-auto-close-database-option-to-off",
      "level": "Medium",
      "condition": {
        "not": "@is_auto_close_on"
      },
      "probes": [
        "DatabaseConfiguration"
      ]
    },
    {
      "id": "AutoShrink",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "name": {
          "not": [
            "master",
            "msdb",
            "tempdb"
          ]
        },
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "DBConfiguration",
        "Performance"
      ],
      "displayName": "'AUTO_SHRINK' option should be OFF",
      "description": "Shrinking databases is the fastest way to achieve fragmentation. SQL Server goes to the last page in the database, moves it to the first free available space, and then repeats the process again. This shuffles the deck, putting your pages out of order.",
      "message": "Set 'AUTO_SHRINK' option to OFF",
      "helpLink": "https://blogs.msdn.microsoft.com/buckwoody/2009/07/01/sql-server-best-practices-auto-shrink-should-be-off",
      "level": "Medium",
      "condition": {
        "not": "@is_auto_shrink_on"
      },
      "probes": [
        "DatabaseConfiguration"
      ]
    },
    {
      "id": "PageVerify",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "name": {
          "not": [
            "master",
            "msdb",
            "tempdb"
          ]
        },
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "DBConfiguration",
        "DataIntegrity"
      ],
      "displayName": "'PAGE_VERIFY' option should be 'CHECKSUM'",
      "description": "When CHECKSUM is enabled for the PAGE_VERIFY database option, the SQL Server Database Engine calculates a checksum over the contents of the whole page, and stores the value in the page header when a page is written to disk. When the page is read from disk, the checksum is recomputed and compared to the checksum value that is stored in the page header. This helps provide a high level of data-file integrity.",
      "message": "Set 'PAGE_VERIFY' option to 'CHECKSUM'",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/policy-based-management/set-the-page-verify-database-option-to-checksum",
      "level": "Medium",
      "condition": {
        "@page_verify_option": 2
      },
      "probes": [
        "DatabaseConfiguration"
      ]
    },
    {
      "id": "DbChaining",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "name": {
          "not": [
            "master",
            "msdb",
            "tempdb"
          ]
        },
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "DBConfiguration",
        "Security"
      ],
      "displayName": "Cross-Database access should be disabled",
      "description": "Ownership chaining across databases is turned off by default. Microsoft recommends that you disable cross-database ownership chaining because it exposes you to the additional security risks.",
      "message": "Turn off 'DB_CHAINING' option",
      "helpLink": "https://docs.microsoft.com/dotnet/framework/data/adonet/sql/enabling-cross-database-access-in-sql-server",
      "level": "Medium",
      "condition": {
        "not": "@is_db_chaining_on"
      },
      "probes": [
        "DatabaseConfiguration"
      ]
    },
    {
      "id": "AutoCreateStatsIncremental",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[12.0,)",
        "name": {
          "not": [
            "master",
            "msdb",
            "tempdb"
          ]
        }
      },
      "tags": [
        "DefaultRuleset",
        "DBConfiguration",
        "Statistics",
        "Performance"
      ],
      "displayName": "Incremental option of auto stats should be ON",
      "description": "Incremental statistics update at partition level is a feature introduced in SQL Server 2014. When the option INCREMENTAL is turn on at the database level, newly auto created column statistics will use incremental statistics on partitioned tables by default.",
      "message": "Turn on 'AUTO_CREATE_STATISTICS' and 'INCREMENTAL' options",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/statistics/statistics",
      "level": "Low",
      "condition": "@is_auto_create_stats_incremental_on",
      "probes": [
        "DatabaseConfiguration"
      ]
    },
    {
      "id": "TrustWorthy",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "name": {
          "not": [
            "master",
            "msdb",
            "tempdb"
          ]
        },
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "DBConfiguration",
        "Security"
      ],
      "displayName": "'TRUSTWORTHY' should be OFF",
      "description": "You can use the TRUSTWORTHY database setting to indicate whether the instance of Microsoft SQL Server trusts the database and the contents within the database. By default, this setting is set to OFF to mitigate certain threats that may be present when a database is attached to the server.",
      "message": "Set 'TRUSTWORTHY' option to OFF",
      "helpLink": "https://support.microsoft.com/help/2183687/guidelines-for-using-the-trustworthy-database-setting-in-sql-server",
      "level": "Low",
      "condition": {
        "not": "@is_trustworthy_on"
      },
      "probes": [
        "DatabaseConfiguration"
      ]
    },
    {
      "id": "ParameterizationNotSimple",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "name": {
          "not": [
            "master",
            "msdb",
            "tempdb"
          ]
        },
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "DBConfiguration",
        "Performance",
        "QueryOptimizer"
      ],
      "displayName": "'PARAMETERIZATION' should be 'SIMPLE'",
      "description": "When the PARAMETERIZATION database option is set to SIMPLE, the SQL Server query optimizer may choose to parameterize the queries. This means that any literal values that are contained in a query are substituted with parameters. This process is referred to as simple parameterization. When SIMPLE parameterization is in effect, you cannot control which queries are parameterized and which queries are not. However, you can specify that all queries in a database be parameterized by setting the PARAMETERIZATION database option to FORCED. Regardless of whether you have a Plan-Stability or not, SQL Server will always auto parameterize your SQL Statements, and reuse the cached execution plan over and over again. It doesn't matter how terrible the execution plan is. Therefore you have to know in exact detail the shape of your execution plans, and whether they can lead to some performance related problems.",
      "message": "Set 'PARAMETERIZATION' to 'SIMPLE' and use forced parameterization only on certain classes of queries instead of all queries",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/performance/specify-query-parameterization-behavior-by-using-plan-guides",
      "level": "Low",
      "condition": {
        "not": "@is_parameterization_forced"
      },
      "probes": [
        "DatabaseConfiguration"
      ]
    },
    {
      "id": "TempDBFilesNotSameSize",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "TempDB",
        "Performance",
        "DBFileConfiguration"
      ],
      "displayName": "TempDB data files are not the same size",
      "description": "We recommend that you create all TempDB data files at the same size.",
      "message": "Make all TempDB data files the same size",
      "helpLink": "https://support.microsoft.com/kb/2154845",
      "level": "Medium",
      "condition": {
        "@filesizeCount": 1
      },
      "probes": [
        "TempDBFiles"
      ]
    },
    {
      "id": "TempDBFilesMultiple4",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "TempDB",
        "Performance",
        "DBFileConfiguration"
      ],
      "displayName": "Number of TempDB data files should be in multiples of 4",
      "description": "Number of TempDB data files should correlate with the number of (logical) processors on the machine. As a general rule, if the number of logical processors is less than or equal to 8, use the same number of data files as logical processors. If the number of logical processors is greater than 8, use 8 data files and then if contention continues, increase the number of data files by multiples of 4 until the contention is reduced to acceptable levels or make changes to the workload/code.",
      "message": "Make the number of data files be in multiples of 4. For example, 8, 12, 16, and so on, depending on your workloads. Currently you have @{physical_name} TempDB data files ",
      "helpLink": "https://support.microsoft.com/kb/2154845",
      "level": "Low",
      "condition": [
        {
          "less": [
            "@online_logical_processors",
            8
          ]
        },
        {
          "equal": [
            {
              "mod": [
                "@physical_name",
                4
              ]
            },
            0
          ]
        }
      ],
      "probes": [
        {
          "id": "DatabaseMasterFiles",
          "params": {
            "dbId": 2,
            "type": 0
          },
          "transform": {
            "type": "aggregate",
            "map": {
              "physical_name": "count"
            }
          }
        },
        "ServerInstanceConfiguration"
      ]
    },
    {
      "id": "TempDBFiles1PerCPU",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "TempDB",
        "Performance",
        "DBFileConfiguration"
      ],
      "displayName": "Number of TempDB data files should depend on CPU count",
      "description": "Number of TempDB data files should correlate with the number of (logical) processors on the machine. As a general rule, if the number of logical processors is less than or equal to 8, use the same number of data files as logical processors. If the number of logical processors is greater than 8, use 8 data files and then if contention continues, increase the number of data files by multiples of 4 until the contention is reduced to acceptable levels or make changes to the workload/code.",
      "message": "1 data file per logical processor is required (processors count: @{online_logical_processors})",
      "helpLink": "https://support.microsoft.com/kb/2154845",
      "level": "Medium",
      "condition": [
        {
          "greater": [
            "@online_logical_processors",
            8
          ]
        },
        {
          "greaterequal": [
            "@physical_name",
            "@online_logical_processors"
          ]
        }
      ],
      "probes": [
        {
          "id": "DatabaseMasterFiles",
          "params": {
            "dbId": 2,
            "type": 0
          },
          "transform": {
            "type": "aggregate",
            "map": {
              "physical_name": "count"
            }
          }
        },
        "ServerInstanceConfiguration"
      ]
    },
    {
      "id": "TempDBFilesNotLess8",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "TempDB",
        "Performance",
        "DBFileConfiguration"
      ],
      "displayName": "Number of TempDB data files should be at least 8",
      "description": "Number of TempDB data files should correlate with the number of (logical) processors on the machine. As a general rule, if the number of logical processors is less than or equal to 8, use the same number of data files as logical processors. If the number of logical processors is greater than 8, use 8 data files and then if contention continues, increase the number of data files by multiples of 4 until the contention is reduced to acceptable levels or make changes to the workload/code.",
      "message": "Add extra data files to TempDB. There are @{physical_name} data files, should be at least 8",
      "helpLink": "https://support.microsoft.com/kb/2154845",
      "level": "Medium",
      "condition": [
        {
          "less": [
            "@online_logical_processors",
            9
          ]
        },
        {
          "greater": [
            "@physical_name",
            7
          ]
        }
      ],
      "probes": [
        {
          "id": "DatabaseMasterFiles",
          "params": {
            "dbId": 2,
            "type": 0
          },
          "transform": {
            "type": "aggregate",
            "map": {
              "physical_name": "count"
            }
          }
        },
        "ServerInstanceConfiguration"
      ]
    },
    {
      "id": "TempDBFilesAutoGrowth",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "TempDB",
        "Performance",
        "DBFileConfiguration"
      ],
      "displayName": "TempDB data files have different auto-growth settings",
      "description": "TempDB data files should be of equal size within each filegroup, as SQL Server uses a proportional-fill algorithm that favors allocations in files with more free space.",
      "message": "Make auto-growth settings the same for each TempDB data file",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/databases/tempdb-database",
      "level": "Medium",
      "condition": {
        "and": [
          {
            "@growth": 1
          },
          {
            "@is_percent_growth": 1
          }
        ]
      },
      "probes": [
        {
          "id": "DatabaseMasterFiles",
          "params": {
            "dbId": 2,
            "type": 0
          },
          "transform": {
            "type": "aggregate",
            "map": {
              "growth": "count",
              "is_percent_growth": "count"
            }
          }
        }
      ]
    },
    {
      "id": "FilesAutogrowth",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "version": "[13.0.4001,)",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance"
      },
      "tags": [
        "DefaultRuleset",
        "Performance",
        "DBFileConfiguration"
      ],
      "displayName": "Database files auto-growth over 1GB",
      "description": "A data or log file will be extended with auto-growth value to prevent the lack of free space in files. This process can perform significant impact on SQL Server performance if auto-growth value gets over 1 GB. By default, SQL Server will put zeros to a newly allocated space. And the more space it takes, the more time it takes to initialize it.",
      "message": "Set file growth to less than 1GB for files: @{FileName}",
      "helpLink": "https://support.microsoft.com/help/315512/considerations-for-the-autogrow-and-autoshrink-settings-in-sql-server",
      "level": "Medium",
      "condition": {
        "@FileName": ""
      },
      "probes": [
        "Autogrow1GB"
      ]
    },
    {
      "id": "DuplicateIndexes",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "name": {
          "not": [
            "master",
            "model",
            "msdb",
            "tempdb"
          ]
        },
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Performance",
        "Indexes"
      ],
      "displayName": "Duplicate indexes",
      "description": "A SQL Server index is an on-disk or in-memory structure associated with a table or view that speeds retrieval of rows from the table or view. An index contains keys built from one or more columns in the table or view. ",
      "message": "Remove duplicate indexes in table @{Table}: @{Indexes}",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/sql-server-index-design-guide",
      "level": "Low",
      "probes": [
        {
          "id": "IndexesDefinitions",
          "transform": {
            "type": "duplicateIndexes"
          }
        }
      ]
    },
    {
      "id": "RedundantIndexes",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "name": {
          "not": [
            "master",
            "model",
            "msdb",
            "tempdb"
          ]
        },
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Performance",
        "Indexes"
      ],
      "displayName": "Tables with redundant indexes",
      "description": "There are tables with possibly redundant indexes according to the set of key and included columns. We recommended to revise all these objects as soon as possible.",
      "message": "Remove redundant indexes in table @{Table}: @{Indexes}",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/sql-server-index-design-guide",
      "level": "Low",
      "probes": [
        {
          "id": "IndexesDefinitions",
          "transform": {
            "type": "redundantIndexes"
          }
        }
      ]
    },
    {
      "id": "UserObjectsInMaster",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "name": "master",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "masterDB",
        "Backup"
      ],
      "displayName": "User objects in master database",
      "description": "We highly recommend you not create user objects in the master database. If it's unavoidable for some reason, make sure to back up the database more frequently.",
      "message": "Remove user objects from 'master' database: @{Object_Name}",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/databases/master-database",
      "condition": {
        "@Object_Name": ""
      },
      "probes": [
        "UserObjectsCountInMasterDB"
      ]
    },
    {
      "id": "HighCPUUsage",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": "Windows",
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Performance",
        "CPU"
      ],
      "displayName": "High CPU usage on server",
      "description": "Keeping CPU usage rates within normal ranges is vital for servers hosting SQL Server instances. A continually high rate of CPU usage may indicate the need to upgrade the CPU or add multiple processors. Alternatively, a high CPU usage rate may indicate a poorly tuned or designed application. Optimizing the application can lower CPU utilization.",
      "message": "Investigate high CPU utilization on server hosting this instance. Last 2 hours: total CPU usage is ~@{AVGTotalCPUUsage}%, usage by SQL Server is ~@{AVGSQLCPUUsage}%",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/performance-monitor/monitor-cpu-usage",
      "level": "Medium",
      "threshold": 70,
      "condition": {
        "less": [
          "@AVGTotalCPUUsage",
          "@threshold"
        ]
      },
      "probes": [
        "CpuUsage"
      ]
    },
    {
      "id": "ReplErrors24H",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Replication"
      ],
      "displayName": "Replication errors within last 24 hours",
      "description": "This check searches for errors in distribution database agent's history table for the last 24 hours.",
      "message": "Review '@{publisher_db}' database replication errors for publications: @{publication}",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/replication/sql-server-replication",
      "level": "Medium",
      "probes": [
        {
          "id": "ReplicationErrors",
          "transform": {
            "type": "aggregate",
            "group": "publisher_db",
            "map": {
              "publication": "join"
            }
          }
        }
      ]
    },
    {
      "id": "AgentAlertsSeverity10",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Agent"
      ],
      "displayName": "Agent doesn't rise alerts for errors with severity 10",
      "description": "Events are generated by SQL Server and entered into the Microsoft Windows application log. SQL Server Agent reads the application log and compares events written there to alerts that you have defined. When SQL Server Agent finds a match, it fires an alert, which is an automated response to an event. In addition to monitoring SQL Server events, SQL Server Agent can also monitor performance conditions and Windows Management Instrumentation (WMI) events.",
      "message": "Create alerts for errors: @{error_ids}",
      "helpLink": "https://docs.microsoft.com/sql/ssms/agent/alerts",
      "level": "Low",
      "condition": [
        {
          "in": [
            "@severityN",
            "@severity"
          ]
        },
        {
          "intersect": [
            "@error_ids",
            "@message_id"
          ]
        }
      ],
      "error_ids": [
        825,
        833,
        855,
        856,
        3452,
        3619,
        17179,
        17883,
        17884,
        17887,
        17888,
        17890,
        28036
      ],
      "severityN": 10,
      "probes": [
        "SysAlerts"
      ]
    },
    {
      "id": "AgentAlertsSeverity16",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Agent"
      ],
      "displayName": "Agent doesn't rise alerts for errors with severity 16",
      "description": "Events are generated by SQL Server and entered into the Microsoft Windows application log. SQL Server Agent reads the application log and compares events written there to alerts that you have defined. When SQL Server Agent finds a match, it fires an alert, which is an automated response to an event. In addition to monitoring SQL Server events, SQL Server Agent can also monitor performance conditions and Windows Management Instrumentation (WMI) events.",
      "message": "Create alerts for errors: @{error_ids}",
      "helpLink": "https://docs.microsoft.com/sql/ssms/agent/alerts",
      "level": "Low",
      "condition": [
        {
          "in": [
            "@severityN",
            "@severity"
          ]
        },
        {
          "intersect": [
            "@error_ids",
            "@message_id"
          ]
        }
      ],
      "error_ids": [
        2508,
        2511,
        3271,
        5228,
        5229,
        5242,
        5243,
        5250,
        5901,
        17130,
        17300
      ],
      "severityN": 16,
      "probes": [
        "SysAlerts"
      ]
    },
    {
      "id": "AgentAlertsSeverity17",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Agent"
      ],
      "displayName": "Agent doesn't rise alerts for errors with severity 17",
      "description": "Events are generated by SQL Server and entered into the Microsoft Windows application log. SQL Server Agent reads the application log and compares events written there to alerts that you have defined. When SQL Server Agent finds a match, it fires an alert, which is an automated response to an event. In addition to monitoring SQL Server events, SQL Server Agent can also monitor performance conditions and Windows Management Instrumentation (WMI) events.",
      "message": "Create alerts for errors: @{error_ids}",
      "helpLink": "https://docs.microsoft.com/sql/ssms/agent/alerts",
      "level": "Low",
      "condition": [
        {
          "in": [
            "@severityN",
            "@severity"
          ]
        },
        {
          "intersect": [
            "@error_ids",
            "@message_id"
          ]
        }
      ],
      "error_ids": [
        802,
        845,
        1101,
        1105,
        1121,
        1214,
        8642,
        9002
      ],
      "severityN": 17,
      "probes": [
        "SysAlerts"
      ]
    },
    {
      "id": "AgentAlertsSeverity19",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Agent"
      ],
      "displayName": "Agent doesn't rise alerts for errors with severity 19",
      "description": "Events are generated by SQL Server and entered into the Microsoft Windows application log. SQL Server Agent reads the application log and compares events written there to alerts that you have defined. When SQL Server Agent finds a match, it fires an alert, which is an automated response to an event. In addition to monitoring SQL Server events, SQL Server Agent can also monitor performance conditions and Windows Management Instrumentation (WMI) events.",
      "message": "Create alerts for errors: @{error_ids}",
      "helpLink": "https://docs.microsoft.com/sql/ssms/agent/alerts",
      "level": "Low",
      "condition": [
        {
          "in": [
            "@severityN",
            "@severity"
          ]
        },
        {
          "intersect": [
            "@error_ids",
            "@message_id"
          ]
        }
      ],
      "error_ids": [
        701
      ],
      "severityN": 19,
      "probes": [
        "SysAlerts"
      ]
    },
    {
      "id": "AgentAlertsSeverity20",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Agent"
      ],
      "displayName": "Agent doesn't rise alerts for errors with severity 20",
      "description": "Events are generated by SQL Server and entered into the Microsoft Windows application log. SQL Server Agent reads the application log and compares events written there to alerts that you have defined. When SQL Server Agent finds a match, it fires an alert, which is an automated response to an event. In addition to monitoring SQL Server events, SQL Server Agent can also monitor performance conditions and Windows Management Instrumentation (WMI) events.",
      "message": "Create alerts for errors: @{error_ids}",
      "helpLink": "https://docs.microsoft.com/sql/ssms/agent/alerts",
      "level": "Low",
      "condition": [
        {
          "in": [
            "@severityN",
            "@severity"
          ]
        },
        {
          "intersect": [
            "@error_ids",
            "@message_id"
          ]
        }
      ],
      "error_ids": [
        3624
      ],
      "severityN": 20,
      "probes": [
        "SysAlerts"
      ]
    },
    {
      "id": "AgentAlertsSeverity21",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Agent"
      ],
      "displayName": "Agent doesn't rise alerts for errors with severity 21",
      "description": "Events are generated by SQL Server and entered into the Microsoft Windows application log. SQL Server Agent reads the application log and compares events written there to alerts that you have defined. When SQL Server Agent finds a match, it fires an alert, which is an automated response to an event. In addition to monitoring SQL Server events, SQL Server Agent can also monitor performance conditions and Windows Management Instrumentation (WMI) events.",
      "message": "Create alerts for errors: @{error_ids}",
      "helpLink": "https://docs.microsoft.com/sql/ssms/agent/alerts",
      "level": "Low",
      "condition": [
        {
          "in": [
            "@severityN",
            "@severity"
          ]
        },
        {
          "intersect": [
            "@error_ids",
            "@message_id"
          ]
        }
      ],
      "error_ids": [
        605
      ],
      "severityN": 21,
      "probes": [
        "SysAlerts"
      ]
    },
    {
      "id": "AgentAlertsSeverity22",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Agent"
      ],
      "displayName": "Agent doesn't rise alerts for errors with severity 22",
      "description": "Events are generated by SQL Server and entered into the Microsoft Windows application log. SQL Server Agent reads the application log and compares events written there to alerts that you have defined. When SQL Server Agent finds a match, it fires an alert, which is an automated response to an event. In addition to monitoring SQL Server events, SQL Server Agent can also monitor performance conditions and Windows Management Instrumentation (WMI) events.",
      "message": "Create alerts for errors: @{error_ids}",
      "helpLink": "https://docs.microsoft.com/sql/ssms/agent/alerts",
      "level": "Low",
      "condition": [
        {
          "in": [
            "@severityN",
            "@severity"
          ]
        },
        {
          "intersect": [
            "@error_ids",
            "@message_id"
          ]
        }
      ],
      "error_ids": [
        5180,
        8966
      ],
      "severityN": 22,
      "probes": [
        "SysAlerts"
      ]
    },
    {
      "id": "AgentAlertsSeverity23",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Agent"
      ],
      "displayName": "Agent doesn't rise alerts for errors with severity 23",
      "description": "Events are generated by SQL Server and entered into the Microsoft Windows application log. SQL Server Agent reads the application log and compares events written there to alerts that you have defined. When SQL Server Agent finds a match, it fires an alert, which is an automated response to an event. In addition to monitoring SQL Server events, SQL Server Agent can also monitor performance conditions and Windows Management Instrumentation (WMI) events.",
      "message": "Create alerts for errors: @{error_ids}",
      "helpLink": "https://docs.microsoft.com/sql/ssms/agent/alerts",
      "level": "Low",
      "condition": [
        {
          "in": [
            "@severityN",
            "@severity"
          ]
        },
        {
          "intersect": [
            "@error_ids",
            "@message_id"
          ]
        }
      ],
      "error_ids": [
        5572,
        9100
      ],
      "severityN": 23,
      "probes": [
        "SysAlerts"
      ]
    },
    {
      "id": "AgentAlertsSeverity24",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Agent"
      ],
      "displayName": "Agent doesn't rise alerts for errors with severity 24",
      "description": "Events are generated by SQL Server and entered into the Microsoft Windows application log. SQL Server Agent reads the application log and compares events written there to alerts that you have defined. When SQL Server Agent finds a match, it fires an alert, which is an automated response to an event. In addition to monitoring SQL Server events, SQL Server Agent can also monitor performance conditions and Windows Management Instrumentation (WMI) events.",
      "message": "Create alerts for errors: @{error_ids}",
      "helpLink": "https://docs.microsoft.com/sql/ssms/agent/alerts",
      "level": "Low",
      "condition": [
        {
          "in": [
            "@severityN",
            "@severity"
          ]
        },
        {
          "intersect": [
            "@error_ids",
            "@message_id"
          ]
        }
      ],
      "error_ids": [
        823,
        824,
        832
      ],
      "severityN": 24,
      "probes": [
        "SysAlerts"
      ]
    },
    {
      "id": "WeakPassword",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Security",
        "WeakPassword"
      ],
      "displayName": "SQL logins have weak passwords",
      "description": "Some SQL logins have weak passwords. Make sure that you use a strong password for each of your SQL logins to decrease vulnerabilities.",
      "message": "Set strong passwords for logins: @{PasswordData}",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/security/strong-passwords",
      "level": "Medium",
      "condition": "@is_integrated_security_only",
      "probes": [
        "ServerProperties",
        {
          "id": "WeakPassword",
          "params": {
            "is_disabled": 0
          }
        }
      ]
    },
    {
      "id": "VLFCount",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Backup",
        "Performance"
      ],
      "displayName": "VLF count",
      "description": "The SQL Server Database Engine divides each physical log file internally into a number of virtual log files (VLFs). Virtual log files have no fixed size, and there is no fixed number of virtual log files for a physical log file. The Database Engine chooses the size of the virtual log files dynamically while it is creating or extending log files. The Database Engine tries to maintain a small number of virtual files. The size of the virtual files after a log file has been extended is the sum of the size of the existing log and the size of the new file increment. The size or number of virtual log files cannot be configured or set by administrators. If the log files grow to a large size in many small increments, they will have many virtual log files. This can slow down database startup and also log backup and restore operations. Conversely, if the log files are set to a large size with few or just one increment, they will have few very large virtual log files. We recommend that you assign log files a size value close to the final size required, using the required increments to achieve optimal VLF distribution, and also have a relatively large growth_increment value.",
      "message": "Update transaction log settings to reduce number of VLFs. Current number is: @{RecoveryUnitId}",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/sql-server-transaction-log-architecture-and-management-guide",
      "level": "Medium",
      "condition": {
        "less": [
          "@RecoveryUnitId",
          "@threshold"
        ]
      },
      "threshold": 50,
      "probes": [
        {
          "id": "VLF",
          "transform": {
            "type": "aggregate",
            "map": {
              "RecoveryUnitId": {
                "type": "count",
                "distinct": false
              }
            }
          }
        }
      ]
    },
    {
      "id": "TF8015",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "version": "[11.0,11.0.3349)",
        "platform": "Windows",
        "engineEdition": "SqlServer"
      },
      "tags": [
        "DefaultRuleset",
        "TraceFlag",
        "CPU",
        "NUMA"
      ],
      "displayName": "TF 8015 disables auto-detection and NUMA setup",
      "description": "SQL Server allows you to group CPUs into nodes referred to as soft-NUMA. You usually configure soft-NUMA when you have many CPUs and do not have hardware NUMA, but you can also use soft-NUMA to subdivide hardware NUMA nodes into smaller groups.",
      "message": "Disable trace flag 8015 for this SQL Server instance. This trace flag does not apply to this SQL Server version",
      "helpLink": "https://techcommunity.microsoft.com/t5/SQL-Server-Support/How-It-Works-Soft-NUMA-I-O-Completion-Thread-Lazy-Writer-Workers/ba-p/316044",
      "level": "Medium",
      "condition": {
        "not": {
          "in": [
            8015,
            "@TraceFlag"
          ]
        }
      },
      "probes": [
        "EnabledGlobalTraceFlags"
      ]
    },
    {
      "id": "TF8032",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer"
      },
      "tags": [
        "DefaultRuleset",
        "TraceFlag",
        "Performance"
      ],
      "displayName": "TF 8032 reverts cache limit parameters to SQL Server 2005 RTM",
      "description": "Trace Flag 8032 reverts the cache limit parameters to the SQL Server 2005 RTM setting but can cause poor performance if large caches make less memory available for other memory consumers like BP.",
      "message": "Disable trace flag 8032",
      "level": "Medium",
      "condition": {
        "not": {
          "in": [
            8032,
            "@TraceFlag"
          ]
        }
      },
      "probes": [
        "EnabledGlobalTraceFlags"
      ]
    },
    {
      "id": "TF8744",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "version": "[11.0,12.0)",
        "platform": "Windows",
        "engineEdition": "SqlServer"
      },
      "tags": [
        "DefaultRuleset",
        "TraceFlag",
        "Performance"
      ],
      "displayName": "TF 8744 disables pre-fetching for Nested Loop operator",
      "description": "Trace flag 8744 disables pre-fetching for the Nested Loops operator. Incorrect use of this trace flag may cause additional physical reads when SQL Server executes plans that contain the Nested Loops operator.",
      "message": "Disable trace flag 8744",
      "helpLink": "https://support.microsoft.com/help/920093/tuning-options-for-sql-server-when-running-in-high-performance-workloa",
      "level": "Medium",
      "condition": {
        "not": {
          "in": [
            8744,
            "@TraceFlag"
          ]
        }
      },
      "probes": [
        "EnabledGlobalTraceFlags"
      ]
    },
    {
      "id": "TF9347",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "version": "[11.0,13.0)",
        "platform": "Windows",
        "engineEdition": "SqlServer"
      },
      "tags": [
        "DefaultRuleset",
        "TraceFlag",
        "Performance"
      ],
      "displayName": "TF 9347 disables batch mode for sort operator",
      "description": "Trace flag 9347 disables batch mode for sort operator. SQL Server 2016 (13.x) introduced a new batch mode sort operator that boosts performance for many analytical queries.",
      "message": "Disable trace flag 9347 for this SQL Server instance. This trace flag does not apply to this SQL Server version",
      "level": "Medium",
      "condition": {
        "not": {
          "in": [
            9347,
            "@TraceFlag"
          ]
        }
      },
      "probes": [
        "EnabledGlobalTraceFlags"
      ]
    },
    {
      "id": "TF9349",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "version": "[11.0,13.0)",
        "platform": "Windows",
        "engineEdition": "SqlServer"
      },
      "tags": [
        "DefaultRuleset",
        "TraceFlag",
        "Performance"
      ],
      "displayName": "TF 9349 disables batch mode for top N sort operator",
      "description": "Trace flag 9349 disables batch mode for top N sort operator. SQL Server 2016 (13.x) introduced a new batch mode top sort operator that boosts performance for many analytical queries.",
      "message": "Disable trace flag 9349 for this SQL Server instance. This trace flag does not apply to this SQL Server version",
      "level": "Medium",
      "condition": {
        "not": {
          "in": [
            9349,
            "@TraceFlag"
          ]
        }
      },
      "probes": [
        "EnabledGlobalTraceFlags"
      ]
    },
    {
      "id": "TF9389",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "version": "[11.0,13.0)",
        "platform": "Windows",
        "engineEdition": "SqlServer, ManagedInstance"
      },
      "tags": [
        "DefaultRuleset",
        "TraceFlag",
        "Performance",
        "TempDB"
      ],
      "displayName": "TF 9389 enables dynamic memory grant for batch mode operators",
      "description": "Trace flag 9389 enables additional dynamic memory grant for batch mode operators. If a query does not get all the memory it needs, it spills data to TempDB, incurring additional I/O and potentially impacting query performance. If the dynamic memory grant trace flag is enabled, a batch mode operator may ask for additional memory and avoid spilling to TempDB if additional memory is available.",
      "message": "Disable trace flag 9389 for this SQL Server instance. The trace flag does not apply to this SQL Server version",
      "level": "Medium",
      "condition": {
        "not": {
          "in": [
            9389,
            "@TraceFlag"
          ]
        }
      },
      "probes": [
        "EnabledGlobalTraceFlags"
      ]
    },
    {
      "id": "TF9476",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "version": "[11.0,13.0)",
        "platform": "Windows",
        "engineEdition": "SqlServer"
      },
      "tags": [
        "DefaultRuleset",
        "TraceFlag",
        "Performance",
        "QueryOptimizer"
      ],
      "displayName": "TF 9476 causes SQL Server to generate plan using Simple Containment assumption",
      "description": "Trace flag 9476 causes SQL Server to generate a plan using the Simple Containment assumption instead of the default Base Containment assumption, under the query optimizer cardinality estimation model of SQL Server 2014 (12.x) through SQL Server 2017 versions.",
      "message": "Disable trace flag 9476 for this SQL Server instance. The trace flag does not apply to this SQL Server version",
      "level": "Medium",
      "condition": {
        "not": {
          "in": [
            9476,
            "@TraceFlag"
          ]
        }
      },
      "probes": [
        "EnabledGlobalTraceFlags"
      ]
    },
    {
      "id": "TF9481",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "version": "[11.0,12.0)",
        "platform": "Windows",
        "engineEdition": "SqlServer"
      },
      "tags": [
        "DefaultRuleset",
        "TraceFlag",
        "QueryOptimizer",
        "Performance"
      ],
      "displayName": "TF 9481 enables Legacy CE model",
      "description": "Trace flag 9481 enables you to set the query optimizer cardinality estimation model to the SQL Server 2012 (11.x) and earlier versions, irrespective of the compatibility level of the database.",
      "message": "Disable trace flag 9481 for this SQL Server instance. The trace flag does not apply to this SQL Server version",
      "level": "Medium",
      "condition": {
        "not": {
          "in": [
            9481,
            "@TraceFlag"
          ]
        }
      },
      "probes": [
        "EnabledGlobalTraceFlags"
      ]
    },
    {
      "id": "TF10204",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "version": "[11.0,13.0)",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer"
      },
      "tags": [
        "DefaultRuleset",
        "TraceFlag",
        "Performance",
        "ColumnStore"
      ],
      "displayName": "TF 10204 disables merge/recompress",
      "description": "Trace flag 10204 disables merge/recompress during columnstore index reorganization. In SQL Server 2016 (13.x), when a columnstore index is reorganized, there is new functionality to automatically merge any small compressed rowgroups into larger compressed rowgroups, as well as recompressing any rowgroups that have a large number of deleted rows.",
      "message": "Disable trace flag 10204. The trace flag does not apply to this SQL Server version",
      "level": "Medium",
      "condition": {
        "not": {
          "in": [
            10204,
            "@TraceFlag"
          ]
        }
      },
      "probes": [
        "EnabledGlobalTraceFlags"
      ]
    },
    {
      "id": "SPNaming",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "level": "Low",
      "tags": [
        "DefaultRuleset",
        "Naming"
      ],
      "displayName": "Stored procedure naming",
      "description": "In SQL Server, the sp_ prefix designates system stored procedures. If you use that prefix for your stored procedures, the name of your procedure might conflict with the name of a system stored procedure that will be created in the future. If such a conflict occurs, your application might break if your application refers to the procedure without qualifying the reference by schema. In this situation, the name will bind to the system procedure instead of to your procedure.",
      "message": "Rename the following stored procedures to eliminate 'sp_' prefix: @{ObjectName}",
      "helpLink": "https://docs.microsoft.com/previous-versions/visualstudio/visual-studio-2010/dd172115(v=vs.100)",
      "level": "Low",
      "condition": {
        "not": "@ObjectName"
      },
      "probes": [
        "BadNamingSP"
      ]
    },
    {
      "id": "ObjectNamingSpecialChar",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "level": "Low",
      "tags": [
        "DefaultRuleset",
        "Naming"
      ],
      "displayName": "Special characters in object names",
      "description": "If you name a database object by using any character in the following table, you make it more difficult not only to reference that object but also to read code that contains the name of that object.",
      "message": "Rename the following objects to eliminate special characters: @{ObjectName}",
      "helpLink": "https://docs.microsoft.com/previous-versions/visualstudio/visual-studio-2010/dd172134(v=vs.100)",
      "condition": {
        "not": "@ObjectName"
      },
      "probes": [
        "BadNamingSpecialChars"
      ]
    },
    {
      "id": "ColumnNamingSpecialChar",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "level": "Low",
      "tags": [
        "DefaultRuleset",
        "Naming"
      ],
      "displayName": "Special characters in column names",
      "description": "Using whitespaces, left and right square brackets, single and double quotation marks in database object names makes it more difficult not only to reference that object, but also to read code that contains the name of that object.",
      "message": "Remove whitespaces, left and right square brackets, single and double quotation marks from column names: @{ObjectName}",
      "helpLink": "https://docs.microsoft.com/previous-versions/visualstudio/visual-studio-2010/dd172134(v=vs.100)",
      "condition": {
        "not": "@ObjectName"
      },
      "probes": [
        "BadNamingSpecialCharsColumns"
      ]
    },
    {
      "id": "FnNaming",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "level": "Medium",
      "tags": [
        "DefaultRuleset",
        "Naming"
      ],
      "displayName": "User function naming",
      "description": "In SQL Server, the fn_ prefix designates system functions. If you use that prefix for your functions, the name of your function might conflict with the name of a system function that will be created in the future. If such a conflict occurs, your application might break if your application refers to the function without qualifying the reference by schema. In this situation, the name will bind to the system function instead of to your function.",
      "message": "Rename the following functions to eliminate 'fn_ prefix': @{ObjectName}",
      "helpLink": "https://docs.microsoft.com/sql/t-sql/statements/create-function-transact-sql",
      "condition": {
        "not": "@ObjectName"
      },
      "probes": [
        "BadNamingUserFunctions"
      ]
    },
    {
      "id": "ObjectNamingResKeywords",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "level": "Low",
      "tags": [
        "DefaultRuleset",
        "Naming"
      ],
      "displayName": "Object names contain reserved keywords",
      "description": "Microsoft SQL Server uses reserved keywords for defining, manipulating, and accessing databases. Reserved keywords are part of the grammar of the Transact-SQL language that is used by SQL Server to parse and understand Transact-SQL statements and batches. Although it is syntactically possible to use SQL Server reserved keywords as identifiers and object names in Transact-SQL scripts, you can do this only by using delimited identifiers.",
      "message": "Rename the following objects to eliminate reserved keywords: @{ObjectName}",
      "helpLink": "https://docs.microsoft.com/sql/t-sql/language-elements/reserved-keywords-transact-sql",
      "condition": {
        "not": "@ObjectName"
      },
      "probes": [
        "BadNamingKeywords"
      ]
    },
    {
      "id": "DeprFeaturesInModules",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "name": {
          "not": [
            "master",
            "tempdb",
            "model",
            "msdb"
          ]
        },
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Security",
        "Deprecated",
        "LongRunningChecks",
        "UpdateIssues"
      ],
      "displayName": "Deprecated or discontinued features in modules",
      "description": "Deprecated features are scheduled to be removed in a future release of SQL Server. Discontinued features have been removed from specific versions of SQL Server.",
      "message": "Do not use deprecated or discontinued feature '@{Feature}'. It probably is used in @{ObjectName}",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/performance-monitor/sql-server-deprecated-features-object",
      "level": "Low",
      "probes": [
        "DeprecatedFeaturesSQLModules"
      ]
    },
    {
      "id": "DeprFeaturesInJobs",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Security",
        "Deprecated",
        "Agent",
        "Jobs",
        "LongRunningChecks",
        "UpdateIssues"
      ],
      "displayName": "Deprecated or discontinued features in modules",
      "description": "Deprecated features are scheduled to be removed in a future release of SQL Server. Discontinued features have been removed from specific versions of SQL Server.",
      "message": "Remove deprecated or discontinued features in @{ObjectName}: @{Keyword}",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/performance-monitor/sql-server-deprecated-features-object",
      "level": "Low",
      "probes": [
        "DeprecatedFeaturesJobs"
      ]
    },
    {
      "id": "DeprFeaturesInJobs",
      "itemType": "override",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)",
        "machineType": "AzureVm"
      },
      "enabled": false
    },
    {
      "id": "NUMANodeSingleCPU",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": "Windows",
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "NUMA",
        "CPU",
        "Memory",
        "Performance"
      ],
      "displayName": "Single CPU assigned to NUMA node",
      "description": "Microsoft SQL Server is non-uniform memory access (NUMA) aware. NUMA architecture provides a scalable solution to performance problem. Computers with hardware NUMA have more than one system bus, each serving a small set of processors. Each group of processors has its own memory and possibly its own I/O channels, but each CPU can access memory associated with other groups in a coherent way. Each group is called a NUMA node. The number of CPUs within a NUMA node depends on the hardware vendor. Your hardware manufacturer can tell you if your computer supports hardware NUMA.",
      "message": "Assign additional CPUs to NUMA nodes with only one CPU",
      "helpLink": "https://docs.microsoft.com/previous-versions/sql/sql-server-2008-r2/ms178144(v=sql.105)",
      "level": "Medium",
      "condition": {
        "not": "@nodes_single_cpu"
      },
      "probes": [
        "ServerInstanceConfiguration"
      ]
    },
    {
      "id": "NUMANodeNoCPU",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": "Windows",
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "NUMA",
        "Performance",
        "CPU",
        "Memory"
      ],
      "displayName": "NUMA nodes without CPUs",
      "description": "Microsoft SQL Server is non-uniform memory access (NUMA) aware. NUMA architecture provides a scalable solution to performance problem. Computers with hardware NUMA have more than one system bus, each serving a small set of processors. Each group of processors has its own memory and possibly its own I/O channels, but each CPU can access memory associated with other groups in a coherent way. Each group is called a NUMA node. The number of CPUs within a NUMA node depends on the hardware vendor. Your hardware manufacturer can tell you if your computer supports hardware NUMA.",
      "message": "Assign CPUs to each NUMA node",
      "helpLink": "https://docs.microsoft.com/previous-versions/sql/sql-server-2008-r2/ms178144(v=sql.105)",
      "level": "Medium",
      "condition": {
        "not": "@NodeCnt"
      },
      "probes": [
        "AffinityNUMANodeNoAssignedCPUs"
      ]
    },
    {
      "id": "IndexKeyGuid",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "name": {
          "not": [
            "master",
            "tempdb",
            "model",
            "msdb"
          ]
        },
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Indexes",
        "Performance"
      ],
      "displayName": "Guid in clustered index key column",
      "description": "A big reason for a clustered index is when you often want to retrieve rows for a range of values for a given column. Because the data is physically arranged in that order, the rows can be extracted very efficiently. Something like a GUID, while excellent for a primary key, could be positively detrimental to performance, as there will be additional cost for inserts and no perceptible benefit on selects.",
      "message": "Remove GUIDs in clustered indexes keys: @{IndexName}",
      "helpLink": "https://azure.microsoft.com/blog/uniqueidentifier-and-clustered-indexes/",
      "level": "Low",
      "probes": [
        "IndexesGuidKeyColumns"
      ]
    },
    {
      "id": "IndexesLargeKeys",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": "Windows",
        "name": {
          "not": [
            "master",
            "model",
            "msdb",
            "tempdb"
          ]
        },
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,13.0)"
      },
      "tags": [
        "DefaultRuleset",
        "Indexes",
        "Performance"
      ],
      "displayName": "Indexes keys with more than @{threshold} bytes",
      "description": "When you design an index that contains many key columns, or large-size columns, calculate the size of the index key to make sure that you do not exceed the maximum index key size. SQL Server retains the @{threshold}-byte limit for the maximum total size of all index key columns. This excludes nonkey columns that are included in the definition of nonclustered indexes.",
      "message": "Remove keys larger than @{threshold} bytes in @{FullName} index",
      "helpLink": "http://msdn.microsoft.com/library/ms191241.aspx",
      "level": "Low",
      "threshold": 900,
      "condition": {
        "le": [
          "@KeySize",
          "@threshold"
        ]
      },
      "probes": [
        "IndexesDefinitions"
      ]
    },
    {
      "id": "IndexesLargeKeysNonClust",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "name": {
          "not": [
            "master",
            "model",
            "msdb",
            "tempdb"
          ]
        },
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[13.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Indexes",
        "Performance"
      ],
      "displayName": "NonClustered indexes keys with more than @{threshold} bytes",
      "description": "When you design an index that contains many key columns, or large-size columns, calculate the size of the index key to make sure that you do not exceed the maximum index key size. SQL Server retains the @{threshold}-byte limit for the maximum total size of all non-clustered index key columns. This excludes nonkey columns that are included in the definition of nonclustered indexes.",
      "message": "Remove keys larger than @{threshold} bytes in @{FullName} index",
      "helpLink": "http://msdn.microsoft.com/library/ms191241.aspx",
      "level": "Low",
      "threshold": 1700,
      "condition": [
        {
          "le": [
            "@KeySize",
            "@threshold"
          ]
        },
        {
          "not": {
            "in": [
              "@Type",
              [
                2,
                6
              ]
            ]
          }
        }
      ],
      "probes": [
        "IndexesDefinitions"
      ]
    },
    {
      "id": "IndexesLargeKeysClust",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "name": {
          "not": [
            "master",
            "model",
            "msdb",
            "tempdb"
          ]
        },
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[13.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Indexes",
        "Performance"
      ],
      "displayName": "Clustered indexes keys with more than @{threshold} bytes",
      "description": "When you design an index that contains many key columns, or large-size columns, calculate the size of the index key to make sure that you do not exceed the maximum index key size. SQL Server retains the @{threshold}-byte limit for the maximum total size of all clustered index key columns. This excludes nonkey columns that are included in the definition of nonclustered indexes.",
      "message": "Remove keys larger than @{threshold} bytes in @{FullName} index",
      "helpLink": "http://msdn.microsoft.com/library/ms191241.aspx",
      "level": "Low",
      "threshold": 900,
      "condition": [
        {
          "le": [
            "@KeySize",
            "@threshold"
          ]
        },
        {
          "not": {
            "in": [
              "@Type",
              [
                1,
                5
              ]
            ]
          }
        }
      ],
      "probes": [
        "IndexesDefinitions"
      ]
    },
    {
      "id": "DisabledIndexes",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "name": {
          "not": [
            "master",
            "model",
            "msdb",
            "tempdb"
          ]
        },
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Indexes",
        "Performance"
      ],
      "displayName": "Disabled indexes exist",
      "description": "If you need to load a lot of data quickly, you can disable nonclustered indexes in order to improve performance. After the data load finishes, enable the nonclustered indexes again by rebuilding them. This technique works best in large data warehouse environments where entire dimension tables might be reloaded from scratch every night. Disabling nonclustered indexes is safer than dropping and recreating them because scripting indexes is hard. Unfortunately, sometimes our load processes crash before enabling the indexes again, or sometimes we manually load data and we forget to rebuild them.",
      "message": "Remove or enable disabled index: @{FullName}",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/indexes/disable-indexes-and-constraints",
      "level": "Medium",
      "condition": {
        "@IsDisabled": false
      },
      "probes": [
        "IndexesDefinitions"
      ]
    },
    {
      "id": "IndexesFillFactor",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "name": {
          "not": [
            "master",
            "model",
            "msdb",
            "tempdb"
          ]
        },
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Indexes",
        "Performance"
      ],
      "displayName": "Index fill factor is below @{threshold}%",
      "description": "The fill-factor option is provided for fine-tuning index data storage and performance. When an index is created or rebuilt, the fill-factor value determines the percentage of space on each leaf-level page to be filled with data, reserving the remainder on each page as free space for future growth. For example, specifying a fill-factor value of @{threshold} means that @{leafPageEmptyPercent} percent of each leaf-level page will be left empty, providing space for index expansion as data is added to the underlying table. The empty space is reserved between the index rows rather than at the end of the index.",
      "message": "Review index @{FullName} as its fill factor @{FillFactor} is lower than @{threshold} percent",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/indexes/specify-fill-factor-for-an-index",
      "level": "Low",
      "threshold": 80,
      "condition": [
        {
          "less": [
            "@FillFactor",
            1
          ]
        },
        {
          "ge": [
            "@FillFactor",
            "@threshold"
          ]
        }
      ],
      "probes": [
        "IndexesDefinitions"
      ],
      "locals": {
        "leafPageEmptyPercent": {
          "sub": [
            100,
            "@threshold"
          ]
        }
      }
    },
    {
      "id": "NonUniqueClusterIndex",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "name": {
          "not": [
            "master",
            "model",
            "msdb",
            "tempdb"
          ]
        },
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Indexes",
        "Performance"
      ],
      "displayName": "Non-unique clustered indexes",
      "description": "Index uniqueness is highly desirable attribute of a clustering key, and goes hand-in-hand with index narrowness. SQL Server does not require a clustered index to be unique, but yet it must have some means of uniquely identifying every row. That’s why, for non-unique clustered indexes, SQL Server adds to every duplicate instance of a clustering key value a 4-byte integer value called a uniqueifier. This uniqueifier is added everywhere the clustering key is stored. That means the uniqueifier is stored in both clustered and non-clustered indexes. As you can imagine, if there are many rows using the same clustering key value, this can become quite expensive.",
      "message": "Review non-unique @{FullName} clustered index",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/indexes/clustered-and-nonclustered-indexes-described",
      "level": "Medium",
      "condition": [
        {
          "gt": [
            "@Type",
            1
          ]
        },
        {
          "@IsUnique": true
        }
      ],
      "probes": [
        "IndexesDefinitions"
      ]
    },
    {
      "id": "SuspectPages",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleSet",
        "Pages",
        "DataIntegrity"
      ],
      "displayName": "Suspect pages found",
      "description": "The suspect_pages table is used for maintaining information about suspect pages, and is relevant in helping to decide whether a restore is necessary.",
      "message": "Run 'DBCC CHECKDB' to verify affected database. Suspect pages were found: @{EventType}",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/backup-restore/manage-the-suspect-pages-table-sql-server",
      "level": "High",
      "probes": [
        "SuspectPagesValidation"
      ]
    },
    {
      "id": "SparseFiles",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleSet",
        "Snapshots",
        "Backup",
        "DataIntegrity"
      ],
      "displayName": "Sparse files",
      "description": "If the file is sparse or compressed, the NTFS file system may deallocate disk space in the file. This sets the range of bytes to zeroes (0) without extending the file size.",
      "message": "Remove sparse files: @{SparseFiles}",
      "helpLink": "https://blogs.msdn.microsoft.com/jorgepc/2010/11/25/what-are-sparse-files-and-why-should-i-care-as-sql-server-dba/",
      "level": "Low",
      "probes": [
        "SparseFilesValidation"
      ]
    },
    {
      "id": "TableNoIndex",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "name": {
          "not": [
            "master",
            "tempdb",
            "model",
            "msdb"
          ]
        },
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Indexes",
        "Performance"
      ],
      "displayName": "Tables without indexes",
      "description": "Each table in the database has one or more pages. To keep track of those pages, SQL Server uses a special set of pages, called IAM (for Index Allocation Map) pages. In spite of the word “Index” in the name, IAMs are used for non-indexed tables as well. These are called heaps. All the data is there, but the only way to find anything is to read it starting at the beginning. For a very large table, this will be terribly inefficient.",
      "message": "Review @{TableName} table and create reasonable indexes",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/indexes/heaps-tables-without-clustered-indexes",
      "level": "Low",
      "condition": [
        {
          "gt": [
            "@IndexCount",
            1
          ]
        },
        {
          "gt": [
            "@MaxIndexId",
            0
          ]
        }
      ],
      "probes": [
        "TableIndexes"
      ]
    },
    {
      "id": "TableNoClusteredIndex",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "name": {
          "not": [
            "master",
            "tempdb",
            "model",
            "msdb"
          ]
        },
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Indexes",
        "Performance"
      ],
      "displayName": "Tables without clustered indexes",
      "description": "Tables without clustered indexes are called heaps. They’re scattered on disk anywhere that SQL Server can find a spot, and they’re not stored in any order whatsoever. This can make for really fast inserts – SQL Server can just throw the data down – but slow selects, updates, and deletes.",
      "message": "Review @{TableName} table and create clustered index",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/indexes/heaps-tables-without-clustered-indexes",
      "level": "Low",
      "condition": [
        {
          "le": [
            "@IndexCount",
            1
          ]
        },
        {
          "gt": [
            "@MinIndexId",
            0
          ]
        }
      ],
      "probes": [
        "TableIndexes"
      ]
    },
    {
      "id": "TablePSAlign",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "name": {
          "not": [
            "master",
            "tempdb",
            "model",
            "msdb"
          ]
        },
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Indexes",
        "Performance"
      ],
      "displayName": "Table index not aligned with PS",
      "description": "Table partitioning is a complex way to break out your large tables into smaller, more manageable chunks, but it comes with a lot of management heartache. One of the challenges is making sure that your indexes are partitioned and aligned the same way as your clustered index.",
      "message": "Re-create @{IndexName} index in @{TableName} table to have it aligned with current schema",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/partitions/partitioned-tables-and-indexes",
      "level": "Low",
      "probes": [
        "TableIndexesPartitioned"
      ]
    },
    {
      "id": "SystemHealth",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "XEvent",
        "SystemHealth",
        "Performance"
      ],
      "displayName": "System Health important messages",
      "description": "The system_health session is an Extended Events session that is included by default with SQL Server. This session starts automatically when the SQL Server Database Engine starts, and runs without any noticeable performance effects. The session collects system data that you can use to help troubleshoot performance issues in the Database Engine",
      "message": "Error @{Error_Number} occured @{Error_Count} times. Last time was @{Last_Logged_Days_Ago} days ago",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/extended-events/use-the-system-health-session",
      "level": "High",
      "probes": [
        "SystemHealth"
      ]
    },
    {
      "id": "RarelyUsedIndex",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "name": {
          "not": [
            "master",
            "model",
            "msdb",
            "tempdb"
          ]
        },
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Indexes",
        "Performance"
      ],
      "displayName": "Rarely used index",
      "description": "Rarely used indexes can slow down database's performance. Time of write operations is increased because of index maintenance, but index is not used quite often. It makes sense to compare impact of writing operations versus rare reading speedup.",
      "message": "Revise rarely used index @{IndexName}",
      "helpLink": "https://docs.microsoft.com/sql/t-sql/statements/drop-index-transact-sql",
      "level": "Low",
      "condition": [
        {
          "@Hits": 0
        },
        {
          "ge": [
            "@ReadsRatio",
            "@ReadsThreshold"
          ]
        },
        {
          "@IsPrimaryKey": true
        }
      ],
      "ReadsThreshold": 5,
      "probes": [
        "IndexesDefinitions"
      ]
    },
    {
      "id": "UnusedIndex",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "name": {
          "not": [
            "master",
            "model",
            "msdb",
            "tempdb"
          ]
        },
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Index",
        "Performance"
      ],
      "displayName": "Unused index",
      "description": "Unused indexes can slow down database's performance. Time of write operations is increased because of index maintenance, but index is not used anywhere.",
      "message": "Revise unused @{IndexName} index on @{TableName} table",
      "helpLink": "https://docs.microsoft.com/sql/t-sql/statements/drop-index-transact-sql",
      "level": "Medium",
      "condition": [
        {
          "and": [
            {
              "ne": [
                "@Type",
                2
              ]
            },
            {
              "ne": [
                "@Type",
                6
              ]
            }
          ]
        },
        {
          "@IsPrimaryKey": true
        },
        {
          "gt": [
            "@Hits",
            0
          ]
        }
      ],
      "probes": [
        "IndexesDefinitions"
      ]
    },
    {
      "id": "SkewedCompatibilityLevel",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "CompatibilityLevel",
        "Security",
        "Performance",
        "UpdateIssues"
      ],
      "displayName": "Database with skewed compatibility level",
      "description": "Some databases may have a compatibility level lower than the allowed level by the Database Engine.",
      "message": "Update database compatibility level. Current level is @{CompatibilityLevel}",
      "helpLink": "https://docs.microsoft.com/sql/t-sql/statements/alter-database-transact-sql-compatibility-level",
      "level": "Low",
      "condition": {
        "ge": [
          {
            "div": [
              "@CompatibilityLevel",
              10
            ]
          },
          "@ServerMajorVersion"
        ]
      },
      "probes": [
        "CompatibilityLevel",
        "SQLServerVersion"
      ]
    },
    {
      "id": [
        "DefaultRuleset"
      ],
      "itemType": "override",
      "targetFilter": {
        "type": "Database",
        "name": [
          "virtualmanagerdb",
          "scspfdb",
          "semanticsdb",
          "servicemanager",
          "service manager",
          "dwstagingandconfig",
          "dwrepository",
          "dwdatamart",
          "dwasdatabase",
          "omdwdatamart",
          "cmdwdatamart",
          "ssodb",
          "bamanalysis",
          "bamarchive",
          "bamalertsapplication",
          "bamalertsnsmain",
          "bamprimaryimport",
          "bamstarschema",
          "biztalkmgmtdb",
          "biztalkmsgboxdb",
          "biztalkdtadb",
          "biztalkruleenginedb",
          "bamprimaryimport",
          "biztalkedidb",
          "biztalkhwsdb",
          "tpm",
          "biztalkanalysisdb",
          "bamprimaryimportsuccessfully",
          "aspstate",
          "aspnet",
          "mscrm_config",
          "cpsdyn",
          "lcslog",
          "lcscdr",
          "lis",
          "lyss",
          "mgc",
          "qoemetrics",
          "rgsconfig",
          "rgsdyn",
          "rtc",
          "rtcab",
          "rtcab1",
          "rtcdyn",
          "rtcshared",
          "rtcxds",
          "xds",
          "activitylog",
          "branchdb",
          "clienttracelog",
          "eventlog",
          "listingssettings",
          "servicegroupdb",
          "tservercontroller",
          "vodbackend",
          "operationsmanager",
          "operationsmanagerdw",
          "operationsmanagerac",
          "orchestrator",
          "sso",
          "wss_search",
          "wss_search_config",
          "sharedservices_db",
          "sharedservices_search_db",
          "wss_content",
          "profiledb",
          "social db",
          "sync db",
          "susdb",
          "projectserver_archive",
          "projectserver_draft",
          "projectserver_published",
          "projectserver_reporting",
          "reportserver",
          "reportservertempdb",
          "rsdb",
          "rstempdb",
          "fastsearchadmindatabase",
          "ppsmonitoring",
          "ppsplanningservice",
          "ppsplanningsystem",
          "dynamics",
          "microsoftdynamicsax",
          "microsoftdynamicsaxbaseline",
          "fimservice",
          "fimsynchronizationservice",
          "sbgatewaydatabase",
          "sbmanagementdb",
          "wfinstancemanagementdb",
          "wfmanagementdb",
          "wfresourcemanagementdb"
        ]
      },
      "enabled": false
    },
    {
      "id": "PendingDiskIORequests",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "IO",
        "Performance"
      ],
      "displayName": "Pending disk I/O requests",
      "description": "A database management system (DBMS), such as SQL Server, relies on the timeliness of file input and output (I/O) operations. The proper configuration and maintenance of the I/O subsystem is critical to a successful SQL Server deployment.",
      "message": "Solve I/O related issues to get rid of pending requests",
      "helpLink": "https://support.microsoft.com/en-sg/help/897284/diagnostics-in-sql-server-help-detect-stalled-and-stuck-i-o-operations",
      "level": "Medium",
      "probes": [
        {
          "id": "PendingIORequests",
          "params": {
            "io_type": "disk"
          }
        }
      ]
    },
    {
      "id": "MaxDOP",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer",
        "platform": [
          "Windows",
          "Linux"
        ],
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "MaxDOP",
        "Performance",
        "Configuration",
        "NUMA",
        "CPU"
      ],
      "displayName": "MaxDOP should be less or equal to number of CPUs",
      "description": "The Microsoft SQL Server max degree of parallelism (MAXDOP) configuration option controls the number of processors that are used for the execution of a query in a parallel plan. This option determines the number of threads that are used for the query plan operators that perform the work in parallel. Depending on whether SQL Server is set up on a symmetric multiprocessing (SMP) computer, a non-uniform memory access (NUMA) computer, or hyperthreading-enabled processors, the max degree of parallelism option should be configured appropriately.",
      "message": "Update MaxDOP configuration option value: @{max_dop}. It shouldn't exceed @{online_logical_processors} - number of processors used by SQL Server",
      "helpLink": "https://support.microsoft.com/kb/2806535",
      "level": "Medium",
      "condition": {
        "le": [
          "@max_dop",
          "@online_logical_processors"
        ]
      },
      "probes": [
        "ServerInstanceConfiguration",
        "SysConfiguration"
      ]
    },
    {
      "id": "MaxDOPFewNUMA",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer",
        "platform": "Windows",
        "version": "[11.0, 13.0)"
      },
      "tags": [
        "DefaultRuleset",
        "MaxDOP",
        "Performance",
        "Configuration",
        "NUMA",
        "CPU"
      ],
      "displayName": "MAXDOP set in accordance with CPU count",
      "description": "The Microsoft SQL Server max degree of parallelism (MAXDOP) configuration option controls the number of processors that are used for the execution of a query in a parallel plan. This option determines the number of threads that are used for the query plan operators that perform the work in parallel. Depending on whether SQL Server is set up on a symmetric multiprocessing (SMP) computer, a non-uniform memory access (NUMA) computer, or hyperthreading-enabled processors, the max degree of parallelism option should be configured appropriately.",
      "message": "Update MAXDOP configuration option value: @{max_dop}. It should not exceed the number of logical processors per NUMA node",
      "helpLink": "https://support.microsoft.com/kb/2806535",
      "level": "Low",
      "condition": {
        "or": [
          {
            "le": [
              "@numa_nodes",
              1
            ]
          },
          {
            "or": [
              {
                "gt": [
                  {
                    "ceiling": {
                      "div": [
                        "@total_logical_processors",
                        "@numa_nodes"
                      ]
                    }
                  },
                  8
                ]
              },
              {
                "and": [
                  {
                    "gt": [
                      "@max_dop",
                      0
                    ]
                  },
                  {
                    "le": [
                      "@max_dop",
                      {
                        "ceiling": {
                          "div": [
                            "@total_logical_processors",
                            "@numa_nodes"
                          ]
                        }
                      }
                    ]
                  }
                ]
              }
            ]
          }
        ]
      },
      "probes": [
        "ServerInstanceConfiguration",
        "SysConfiguration"
      ]
    },
    {
      "id": "DbIntegrity",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "name": {
          "not": "tempdb"
        },
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "DBCC",
        "Performance",
        "DataIntegrity"
      ],
      "displayName": "Database Integrity Checks",
      "description": "The DBCC CHECKDB command checks the integrity of the objects in a database and should be run on a regular basis. This statement is used to perform different operations in your database and can be broken down into four categories: Maintenance, Miscellaneous, Informational, and Validation.",
      "message": "Run 'DBCC CHECKDB' command checks",
      "helpLink": "https://msdn.microsoft.com/library/ms176064.aspx",
      "level": "Medium",
      "threshold": 7,
      "condition": [
        {
          "@IsReadOnly": true
        },
        {
          "ne": [
            "@DbState",
            0
          ]
        },
        {
          "le": [
            "@LastKnownDBCCDaysAgo",
            "@threshold"
          ]
        }
      ],
      "probes": [
        "DBMetaInfo",
        "DatabaseConfiguration"
      ]
    },
    {
      "id": "DirectCatalogUpdates",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "name": {
          "not": "tempdb"
        },
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "DBCC",
        "Deprecated"
      ],
      "displayName": "Direct Catalog Updates",
      "description": "The 'allow updates' option is still present in the sp_configure stored procedure, although its functionality is unavailable in SQL Server. The setting has no effect. Starting with SQL Server 2005, direct updates to the system tables are not supported.",
      "message": "Avoid using direct catalog update feature",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/allow-updates-server-configuration-option",
      "level": "Low",
      "condition": [
        {
          "@IsReadOnly": true
        },
        {
          "ne": [
            "@DbState",
            0
          ]
        },
        {
          "@UpdSysCatalog": 0
        }
      ],
      "probes": [
        "DBMetaInfo",
        "DatabaseConfiguration"
      ]
    },
    {
      "id": "DataPurityCheck",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "name": {
          "not": [
            "master",
            "model",
            "msdb",
            "tempdb"
          ]
        },
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "DBCC",
        "DataIntegrity"
      ],
      "displayName": "Data Purity Check",
      "description": "The DBCC CHECKDB command checks the integrity of the objects in a database and should be run on a regular basis. One thing that this command does not check in databases created in versions prior to SQL Server 2005 is the integrity of the data in the columns until it has been run once with the DATA_PURITY option. Adding the DATA_PURITY option causes the CHECKDB command to look for column values that are invalid or out of range. Any database that was created in SQL Server 2005 or later will include the DATA_PURITY check by default; but if the database is being upgraded from an earlier version, you must run the command with the DATA_PURITY option at least once using the following command and then fix any data issues.",
      "message": "Enable data purity validation with  'DBCC CHECKDB ([DatabaseName]) WITH DATA_PURITY' command",
      "helpLink": "http://support.microsoft.com/kb/923247",
      "level": "Low",
      "condition": [
        {
          "@IsReadOnly": true
        },
        {
          "ne": [
            "@DbState",
            0
          ]
        },
        {
          "gt": [
            "@CreateVersion",
            611
          ]
        },
        {
          "ne": [
            "@DBCCFlags",
            0
          ]
        }
      ],
      "probes": [
        "DBMetaInfo",
        "DatabaseConfiguration"
      ]
    },
    {
      "id": "StatSamplingRate",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Performance",
        "Statistics"
      ],
      "displayName": "Statistics sampling rate",
      "description": "For most queries, the Query Optimizer already generates the necessary statistics for a high quality query plan; in some cases, you need to create additional statistics or modify the query design for best results.",
      "message": "Some statistics have sampling rates less than @{threshold:P}. Update with a larger sample or full scan if key is not uniformly distributed. Affected tables: @{FullName}",
      "helpLink": "https://docs.microsoft.com/sql/t-sql/statements/update-statistics-transact-sql",
      "level": "Low",
      "threshold": 0.25,
      "probes": [
        {
          "id": "StatSamplingRate",
          "params": {
            "threshold": "@threshold"
          },
          "transform": {
            "type": "aggregate",
            "map": {
              "FullName": "join"
            }
          }
        }
      ]
    },
    {
      "id": "IndexFragmentation",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "name": {
          "not": [
            "master",
            "model",
            "msdb",
            "tempdb"
          ]
        },
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Index",
        "Performance"
      ],
      "displayName": "Index Fragmentation",
      "description": "The SQL Server Database Engine automatically modifies indexes whenever insert, update, or delete operations are made to the underlying data. Over time these modifications can cause the information in the index to become scattered in the database (fragmented). Fragmentation exists when indexes have pages in which the logical ordering, based on the key value, does not match the physical ordering inside the data file. Heavily fragmented indexes can degrade query performance and cause your application to respond slowly, especially scan operations.",
      "message": "Remove fragmentation of @{IndexFullName} index. Current fragmentation level is @{fragmentation:#0.##}%",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/indexes/reorganize-and-rebuild-indexes",
      "level": "Medium",
      "condition": [
        {
          "le": [
            "@fragmentation",
            "@threshold"
          ]
        },
        {
          "le": [
            "@page_count",
            "@pageCountThreshold"
          ]
        }
      ],
      "threshold": 5,
      "pageCountThreshold": 8,
      "probes": [
        "IndexStatistics"
      ]
    },
    {
      "id": "IndexFragmentation",
      "itemType": "override",
      "targetFilter": {
        "version": "[12.0,)"
      },
      "condition": {
        "and": [
          {
            "or": [
              {
                "le": [
                  "@fragmentation",
                  "@threshold"
                ]
              },
              {
                "le": [
                  "@page_count",
                  "@pageCountThreshold"
                ]
              }
            ]
          },
          {
            "or": [
              {
                "not": {
                  "in": [
                    "@IndexType",
                    [
                      5,
                      6
                    ]
                  ]
                }
              },
              {
                "le": [
                  "@fragmentation_CI",
                  "@threshold"
                ]
              },
              {
                "ne": [
                  "@state",
                  3
                ]
              }
            ]
          }
        ]
      }
    },
    {
      "id": "XTPHashAvgChainBuckets",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "name": {
          "not": [
            "master",
            "model",
            "msdb",
            "tempdb"
          ]
        },
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[12.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Index",
        "Performance",
        "XTP"
      ],
      "displayName": "High avg chain length and empty buckets",
      "description": "Memory-optimized HASH indexes behave different from NONCLUSTERED indexes. They are optimized for point-lookup operations, and do not support ordered scans or inequality seek operations. You should specify a value for the BUCKET_COUNT parameter when you create a memory-optimized table.",
      "message": "Index @{IndexFullName} has @{avg_chain_length} average chain length and @{EmptyBucketPct}% empty buckets count. Verify if there are many rows with duplicate index key values or there is a skew in key values",
      "helpLink": "https://techcommunity.microsoft.com/t5/sql-server/in-memory-oltp-indexes-part-2-performance-troubleshooting-guide/ba-p/385725",
      "level": "Medium",
      "condition": [
        {
          "le": [
            "@EmptyBucketPct",
            "@EmptyBucketsPctThreshold"
          ]
        },
        {
          "le": [
            "@avg_chain_length",
            "@AvgChainLengthThreshold"
          ]
        }
      ],
      "EmptyBucketsPctThreshold": 50,
      "AvgChainLengthThreshold": 5,
      "probes": [
        "XTPIndexHashStatistics"
      ]
    },
    {
      "id": "XTPTooManyBuckets",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "name": {
          "not": [
            "master",
            "model",
            "msdb",
            "tempdb"
          ]
        },
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[12.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Index",
        "Performance",
        "XTP"
      ],
      "displayName": "Too many buckets",
      "description": "Memory-optimized HASH indexes behave different from NONCLUSTERED indexes. They are optimized for point-lookup operations, and do not support ordered scans or inequality seek operations. You must specify a value for the BUCKET_COUNT parameter when you create the memory-optimized table.",
      "message": "Make number of buckets of @{IndexFullName} index equal to distinct rows. It has @{total_bucket_count} buckets and there are @{DistinctCnt} in table, which wastes memory and marginally slows down full table scans",
      "helpLink": "https://techcommunity.microsoft.com/t5/sql-server/in-memory-oltp-indexes-part-2-performance-troubleshooting-guide/ba-p/385725",
      "level": "Low",
      "condition": [
        {
          "le": [
            "@total_bucket_count",
            "@DistinctCnt"
          ]
        }
      ],
      "probes": [
        "XTPIndexHashStatistics"
      ]
    },
    {
      "id": "XTPTooFewBuckets",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "name": {
          "not": [
            "master",
            "model",
            "msdb",
            "tempdb"
          ]
        },
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[12.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Index",
        "Performance",
        "XTP"
      ],
      "displayName": "Too few buckets",
      "description": "Memory-optimized HASH indexes behave different from NONCLUSTERED indexes. They are optimized for point-lookup operations, and do not support ordered scans or inequality seek operations. You must specify a value for the BUCKET_COUNT parameter when you create the memory-optimized table.",
      "message": "Make number of buckets of @{IndexFullName} index equal to distinct rows. It has @{total_bucket_count} buckets and there are @{DistinctCnt} in table, which leads to chaining records",
      "helpLink": "https://techcommunity.microsoft.com/t5/sql-server/in-memory-oltp-indexes-part-2-performance-troubleshooting-guide/ba-p/385725",
      "level": "Medium",
      "condition": [
        {
          "ge": [
            "@total_bucket_count",
            "@DistinctCnt"
          ]
        }
      ],
      "probes": [
        "XTPIndexHashStatistics"
      ]
    },
    {
      "id": "XTPRangeIXHealth",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "name": {
          "not": [
            "master",
            "model",
            "msdb",
            "tempdb"
          ]
        },
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[12.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Index",
        "Performance",
        "XTP"
      ],
      "displayName": "NonClustered index retry amount",
      "description": "When a database with a memory-optimized table is restarted, the index is built by inserting one row at a time into memory. The count of page splits, merges, and consolidation can help you understand the work done to build the index when a database is brought online. Large numbers of retries are indicative of concurrency issues.",
      "message": "Review @{IndexFullName} index as its retry count is over @{RetryCountPct}% of total, which indicates possible concurrency issues",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/system-dynamic-management-views/sys-dm-db-xtp-nonclustered-index-stats-transact-sql",
      "level": "Low",
      "condition": {
        "and": [
          {
            "le": [
              "@page_update_count_pct",
              "@RetryCountPct"
            ]
          },
          {
            "le": [
              "@page_consolidation_count_pct",
              "@RetryCountPct"
            ]
          },
          {
            "le": [
              "@page_split_count_pct",
              "@RetryCountPct"
            ]
          },
          {
            "le": [
              "@key_split_count_pct",
              "@RetryCountPct"
            ]
          },
          {
            "le": [
              "@page_merge_count_pct",
              "@RetryCountPct"
            ]
          },
          {
            "le": [
              "@key_merge_count_pct",
              "@RetryCountPct"
            ]
          }
        ]
      },
      "RetryCountPct": 5,
      "probes": [
        "XTPNonClusteredIndexHashStatistics"
      ]
    },
    {
      "id": "TF6533Misuse",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "version": "[11.0.6020, 11.0.6518)",
        "platform": "Windows",
        "name": {
          "not": [
            "master",
            "model",
            "msdb",
            "tempdb"
          ]
        },
        "engineEdition": "SqlServer"
      },
      "tags": [
        "DefaultRuleset",
        "TraceFlag",
        "Performance",
        "TF6533"
      ],
      "displayName": "'STRelate' and 'STAsBinary' functions unexpected results due to TF 6533",
      "description": "The STRelate and STAsBinary functions may return unexpected results when trace flag 6533 is enabled. Do not use this trace flag if your workload involves either of these functions.",
      "message": "Disable trace flag 6533 to avoid unexpected results of 'STRelate' and 'STAsBinary' functions",
      "helpLink": "https://support.microsoft.com/help/3107399",
      "level": "Low",
      "condition": [
        {
          "not": {
            "in": [
              6533,
              "@TraceFlag"
            ]
          }
        },
        {
          "@InUse": 0
        }
      ],
      "probes": [
        "EnabledGlobalTraceFlags",
        "TF6533SpatialFunctionsUsage"
      ]
    },
    {
      "id": "UntrustedConstraints",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "name": {
          "not": [
            "master",
            "model",
            "msdb",
            "tempdb"
          ]
        },
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Performance",
        "DataIntegrity"
      ],
      "displayName": "Untrusted constraints",
      "description": "If you need to load a lot of data quickly, you can disable keys and constraints in order to improve performance. After the data load finishes, enable them again, and SQL Server will check them behind the scenes. This technique works best in large data warehouse environments where entire dimension tables might be reloaded from scratch every night. Disabling constraints is usually safer and easier than dropping and recreating them.",
      "message": "Execute 'ALTER TABLE <table name> WITH CHECK CHECK CONSTRAINT <constraint name>' statement to avoid possible performance issues: @{constraint_name} constraints are not trusted for referential integrity",
      "helpLink": "https://docs.microsoft.com/sql/t-sql/statements/alter-table-transact-sql",
      "level": "Low",
      "probes": [
        "FKNotTrusted"
      ]
    },
    {
      "id": "PercentAutogrows",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "name": {
          "not": [
            "master",
            "model",
            "msdb",
            "tempdb"
          ]
        },
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Performance",
        "DBFileConfiguration",
        "DBConfiguration"
      ],
      "displayName": "Database files have growth ratio in percentage",
      "description": "Some database files have a growth ratio set in percentage. Over time, this could lead to uncontrolled disk space allocation and extended time to perform these growths",
      "message": "Do not use \"File Growth In Percent\" for Autogrowth setting. Affected files: @{fileName} have growth ratio set in percentage",
      "helpLink": "https://docs.microsoft.com/sql/t-sql/statements/alter-database-transact-sql-file-and-filegroup-options",
      "level": "Low",
      "probes": [
        {
          "id": "DatabaseMasterFiles",
          "params": {
            "type": null,
            "is_percent_growth": 1
          },
          "transform": {
            "type": "aggregate",
            "map": {
              "fileName": "join"
            }
          }
        }
      ]
    },
    {
      "id": "StatsUpdate",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Performance",
        "Statistics",
        "QueryOptimizer"
      ],
      "displayName": "Statistics need to be updated",
      "description": "The Query Optimizer determines whether an index is useful for a specific query by evaluating the stored statistics. If the statistics become out of date and significant changes have occurred against the underlying data, this can result in less than optimal query performance. In most cases, it's best to let SQL Server maintain the statistics. If you turn 'Auto Create Stats' and 'Auto Update Stats' off, then it is up to you to keep the statistics up-to-date somehow. Failure to do so will lead to poor query performance. Most applications should have these options ON. When the Auto Update Statistics setting is ON, the Query Optimizer updates statistics when they are used by a query and when they might be out-of-date. Statistics become out-of-date after insert, update, delete, or merge operations change the data distribution in the table or indexed view. The Query Optimizer determines when statistics might be out-of-date by counting the number of data modifications since the last statistics update and comparing the number of modifications to a threshold. The threshold is based on the number of rows in the table or indexed view. The Query Optimizer checks for out-of-date statistics before compiling a query and before executing a cached query plan. Before compiling a query, the Query Optimizer uses the columns, tables, and indexed views in the query predicate to determine which statistics might be out-of-date. Before executing a cached query plan, the Database Engine verifies that the query plan references up-to-date statistics. The AUTO_UPDATE_STATISTICS option applies to statistics created for indexes, single-columns in query predicates, and statistics that are created by using the CREATE STATISTICS statement. This option also applies to filtered statistics.",
      "message": "Update stats in @{TableName} table to improve query performance",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/statistics/statistics#UpdateStatistics",
      "condition": [
        "@is_auto_update_stats_on",
        {
          "and": [
            {
              "or": [
                {
                  "gt": [
                    "@rows",
                    "@threshold"
                  ]
                },
                {
                  "lt": [
                    "@modification_counter",
                    "@threshold"
                  ]
                }
              ]
            },
            {
              "or": [
                {
                  "le": [
                    "@rows",
                    "@threshold"
                  ]
                },
                {
                  "lt": [
                    "@modification_counter",
                    {
                      "add": [
                        "@threshold",
                        {
                          "mul": [
                            "@rows",
                            0.2
                          ]
                        }
                      ]
                    }
                  ]
                }
              ]
            }
          ]
        }
      ],
      "threshold": 500,
      "probes": [
        "DatabaseConfiguration",
        "ObjectStatistics"
      ]
    },
    {
      "id": "AdHocQueriesOff",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration",
        "Security"
      ],
      "displayName": "Option 'ad hoc distributed queries' should be disabled",
      "description": "Ad Hoc Distributed Queries use the OPENROWSET and OPENDATASOURCE functions to connect to remote data sources that use OLE DB. OPENROWSET and OPENDATASOURCE should be used only to reference OLE DB data sources that are accessed infrequently. For any data sources that will be accessed more than several times, define a linked server. Enabling the use of ad hoc names means that any authenticated login to SQL Server can access the provider. SQL Server administrators should enable this feature for providers that are safe to be accessed by any local login.",
      "message": "Disable 'ad hoc distributed queries' option",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/ad-hoc-distributed-queries-server-configuration-option",
      "level": "Low",
      "condition": {
        "not": "@ad_hoc_distributed_queries"
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "AffinityMasksOverlap",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration",
        "Performance"
      ],
      "displayName": "Affinity Mask and Affinity I/O Mask overlapping",
      "description": "Enabling a CPU with both the affinity mask and the affinity I/O mask can slow performance by forcing the processor to be overused. When specified either the affinity mask or the affinity I/O mask options they must both be specified, but only enables each CPU no more than once. The same CPU should not be enabled in both the affinity mask option and the affinity I/O mask option. The bits that correspond to each CPU should be in one of the following states.",
      "message": "Correct Affinity Mask and Affinity IO Mask overlap",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/policy-based-management/correct-affinity-mask-and-affinity-input-and-output-mask-overlap",
      "level": "Low",
      "condition": {
        "and": [
          {
            "eq": [
              {
                "bitand": [
                  "@affinity_mask",
                  "@affinity_io_mask"
                ]
              },
              0
            ]
          },
          {
            "or": [
              {
                "ne": [
                  "@architecture",
                  64
                ]
              },
              {
                "eq": [
                  {
                    "bitand": [
                      "@affinity64_mask",
                      "@affinity64_io_mask"
                    ]
                  },
                  0
                ]
              }
            ]
          }
        ]
      },
      "probes": [
        "SysConfiguration",
        "ServerProperties"
      ]
    },
    {
      "id": "AgentSvcAccNotRecommended",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": "Windows",
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "displayName": "'SQL Server Agent' service uses non-recommended account",
      "description": "Running the 'SQL Server Agent' service under 'NT AUTHORITY\\SYSTEM' or 'NT AUTHORITY\\NETWORKSERVICE' accounts is not recommended for security reasons.",
      "message": "Use another account to run 'SQL Server Agent' service. Current account '@{attr::service::SQLAgent.account}' is not recommended",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/configure-windows-service-accounts-and-permissions",
      "level": "Low",
      "unrecommendedAccounts": [
        "NT AUTHORITY\\SYSTEM",
        "LOCALSYSTEM",
        "NT AUTHORITY\\NETWORKSERVICE"
      ],
      "condition": {
        "or": [
          {
            "or": [
              {
                "not": "@attr::service::SQLAgent"
              },
              "@is_clustered_server"
            ]
          },
          {
            "not": {
              "iin": [
                "@attr::service::SQLAgent.account",
                "@unrecommendedAccounts"
              ]
            }
          }
        ]
      },
      "probes": [
        "ServerProperties"
      ]
    },
    {
      "id": "AgentSvcAccNotRecommended",
      "itemType": "override",
      "targetFilter": {
        "engineEdition": "Express"
      },
      "enabled": false
    },
    {
      "id": "AgentSvcAccNotSupported",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": "Windows",
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "displayName": "'SQL Server Agent' service uses not supported account",
      "description": "Running the 'SQL Server Agent' service under 'NT AUTHORITY\\LOCALSERVICE', 'NT AUTHORITY\\SYSTEM' or 'NT AUTHORITY\\NETWORKSERVICE' accounts is not supported.",
      "message": "Use another account to run 'SQL Server Agent' service. Current account '@{attr::service::SQLAgent.account}' is not supported",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/configure-windows-service-accounts-and-permissions",
      "level": "Low",
      "localServiceAccount": "NT AUTHORITY\\LOCALSERVICE",
      "unsupportedAccounts": [
        "NT AUTHORITY\\SYSTEM",
        "LOCALSYSTEM",
        "NT AUTHORITY\\NETWORKSERVICE"
      ],
      "condition": {
        "or": [
          {
            "not": "@attr::service::SQLAgent"
          },
          {
            "and": [
              {
                "ine": [
                  "@attr::service::SQLAgent.account",
                  "@localServiceAccount"
                ]
              },
              {
                "or": [
                  {
                    "not": "@is_clustered_server"
                  },
                  {
                    "not": {
                      "iin": [
                        "@attr::service::SQLAgent.account",
                        "@unsupportedAccounts"
                      ]
                    }
                  }
                ]
              }
            ]
          }
        ]
      },
      "probes": [
        "ServerProperties"
      ]
    },
    {
      "id": "AgentSvcAccNotSupported",
      "itemType": "override",
      "targetFilter": {
        "engineEdition": "Express"
      },
      "enabled": false
    },
    {
      "id": "AgentSvcAccSame",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": "Windows",
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "displayName": "'SQL Server Agent' and 'SQL Server Database Engine' use same account",
      "description": "Running the 'SQL Server Agent' service under the same account as the 'SQL Server Database Engine' service is not recommended.",
      "message": "Use different accounts for 'SQL Server Agent' service and 'SQL Server Database Engine' service. Now both services use '@{attr::service::SQLAgent.account}' account",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/configure-windows-service-accounts-and-permissions",
      "level": "Low",
      "condition": {
        "or": [
          {
            "not": "@attr::service::SQLAgent"
          },
          {
            "ine": [
              "@attr::service::MSSQL.account",
              "@attr::service::SQLAgent.account"
            ]
          }
        ]
      }
    },
    {
      "id": "AgentSvcAccSame",
      "itemType": "override",
      "targetFilter": {
        "engineEdition": "Express"
      },
      "enabled": false
    },
    {
      "id": "AgentSvcStoped",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": "Windows",
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "displayName": "'SQL Server Agent' service is stopped",
      "description": "The 'SQL Server Agent' service executes jobs, monitors SQL Servers, fires alerts and enables automation for some administrative tasks.",
      "message": "Run 'SQL Server Agent' service",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/manage-the-database-engine-services",
      "level": "Low",
      "condition": {
        "or": [
          {
            "not": "@attr::service::SQLAgent"
          },
          {
            "imatch": [
              "@Output.State",
              "^Running\\.*$"
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ServiceInfo",
          "params": {
            "ServiceName": "@attr::service::SQLAgent.name"
          }
        }
      ]
    },
    {
      "id": "AgentSvcStoped",
      "itemType": "override",
      "targetFilter": {
        "engineEdition": "Express"
      },
      "enabled": false
    },
    {
      "id": "AutoSoftNUMAOn",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[13.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration",
        "NUMA"
      ],
      "displayName": "Auto Soft NUMA should be enabled",
      "description": "Modern processors have multiple cores per socket. Each socket is represented, usually, as a single NUMA node. The SQL Server database engine partitions various internal structures and partitions service threads per NUMA node. With processors containing 10 or more cores per socket, using software NUMA to split hardware NUMA nodes generally increases scalability and performance. Prior to SQL Server 2014 (12.x) SP2, software-based NUMA (soft-NUMA) has required to edit the registry to add a node configuration affinity mask, and was configured at the host level, rather than per instance. Soft-NUMA has configured automatically at the database-instance level when the SQL Server Database Engine service starts.",
      "message": "Turn 'automatic soft-NUMA disabled' option on to avoid inefficient allocation of cores between NUMA nodes",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/soft-numa-sql-server",
      "level": "Low",
      "condition": {
        "not": "@automatic_soft_NUMA_disabled"
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "AzSqlVmSize",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": "Windows",
        "engineEdition": "SqlServer",
        "version": "[11.0,)",
        "machineType": "AzureVm"
      },
      "tags": [
        "DefaultRuleset",
        "SqlOnVm",
        "Azure",
        "Performance"
      ],
      "displayName": "VM size is not memory-optimized",
      "description": "Memory optimized VM sizes offer a high memory-to-CPU ratio that is great for relational database servers. The DSv2 11-15, Edsv4 series, the M-, and the Mv2- series offer the optimal memory-to-vCore ratio required for OLTP workloads. Both M series VMs offer the highest memory-to-vCore ratio required for mission critical workloads and is also ideal for data warehouse workloads.",
      "message": "Use memory optimized virtual machine sizes for the best performance of SQL Server workloads",
      "helpLink": "https://docs.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices",
      "level": "Information",
      "condition": {
        "imatch": [
          "@vmSize",
          "(^Standard_DS?1[1-5](-\\d+)?_v2$)|(^Standard_E\\d+[asi]*(-\\d+[sad]+)?_v[3-4]$)|(^Standard_M\\d+[ltms]*(-\\d+[ms]+)?(_v21?)?$)|(^Standard_GS\\d+-\\d+$)"
        ]
      },
      "probes": [
        "AzVmProps"
      ]
    },
    {
      "id": "BlockingChains",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Statistics"
      ],
      "displayName": "Blocking chains",
      "description": "Blocking chains of sessions can cause poor performance when the duration of locks is too long on the resource.",
      "message": "Review locking strategy. @{blocked_spid} process(es) have been blocked@{block_time_min: for more than #0 min;;''}",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/system-dynamic-management-views/sys-dm-os-waiting-tasks-transact-sql",
      "level": "Low",
      "threshold": 5,
      "condition": {
        "not": "@blocked_spid"
      },
      "probes": [
        {
          "id": "ProcessBlockingChains",
          "params": {
            "waitThreshold": "@threshold"
          },
          "transform": {
            "type": "aggregate",
            "map": {
              "blocked_spid": "count",
              "block_time_min": "min"
            }
          }
        }
      ]
    },
    {
      "id": "BlockProcThreshNotRecommend",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "displayName": "Blocked process threshold is set to recommended value",
      "description": "This rule checks that the blocked process threshold option is set to 0 (disabled) or set to a value higher than or equal to 5 (seconds). Setting the blocked process threshold option to a value from 1 to 4 can cause the deadlock monitor to run constantly. Values 1 to 4 should only be used for troubleshooting, and never long term or in a production environment without the assistance of Microsoft Customer Service and Support.",
      "message": "Increase or disable blocked process threshold option. Current value is @{block_threshold}",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/policy-based-management/increase-or-disable-blocked-process-threshold",
      "level": "Low",
      "threshold": 5,
      "condition": {
        "or": [
          {
            "le": [
              "@block_threshold",
              0
            ]
          },
          {
            "ge": [
              "@block_threshold",
              "@threshold"
            ]
          }
        ]
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "BrowserSvcAccSame",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": "Windows",
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "displayName": "'SQL Server Browser' and 'SQL Server Database Engine' use same account",
      "description": "Running the 'SQL Server Browser' service under the same account as the 'SQL Server Database Engine' service is not recommended.",
      "message": "Use different accounts for 'SQL Server Browser' and 'SQL Server Database Engine'. Now both services use '@{attr::service::SQLBrowser.account}' account",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/configure-windows-service-accounts-and-permissions",
      "level": "Low",
      "condition": {
        "or": [
          {
            "not": "@attr::service::SQLBrowser"
          },
          {
            "ine": [
              "@attr::service::MSSQL.account",
              "@attr::service::SQLBrowser.account"
            ]
          }
        ]
      }
    },
    {
      "id": "BrowserSvcStoped",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": "Windows",
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "displayName": "'SQL Server Browser' service is stopped",
      "description": "The 'SQL Server Browser' service is a name resolution service that provides SQL Server connection information to client computers.",
      "message": "Run 'SQL Server Browser' service",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/manage-the-database-engine-services",
      "level": "Low",
      "condition": {
        "or": [
          {
            "not": "@attr::service::SQLBrowser"
          },
          {
            "imatch": [
              "@Output.State",
              "^Running\\.*$"
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ServiceInfo",
          "params": {
            "ServiceName": "@attr::service::SQLBrowser.name"
          }
        }
      ]
    },
    {
      "id": "CrossDBOwnershipOff",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration",
        "Security"
      ],
      "displayName": "Option 'cross db ownership chaining' should be disabled",
      "description": "Cross-database ownership chaining occurs when a procedure in one database depends on objects in another database. A cross-database ownership chain works in the same way as ownership chaining within a single database, except that an unbroken ownership chain requires that all the object owners are mapped to the same login account. If the source object in the source database and the target objects in the target databases are owned by the same login account, SQL Server does not check permissions on the target objects. Ownership chaining across databases is turned off by default. Microsoft recommends that you disable cross-database ownership chaining because it exposes you to some security risks.",
      "message": "Disable 'cross db ownership chaining' option",
      "helpLink": "https://docs.microsoft.com/dotnet/framework/data/adonet/sql/enabling-cross-database-access-in-sql-server",
      "level": "Low",
      "condition": {
        "not": "@cross_db_ownership_chaining"
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "DefaultTraceOff",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "displayName": "Default trace is enabled",
      "description": "Use the 'default trace enabled' option to enable or disable the default trace log files. The default trace functionality provides a rich, persistent log of activity and changes primarily related to the configuration options. ",
      "message": "Enable 'default trace enabled' option to get troubleshooting assistance",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/default-trace-enabled-server-configuration-option",
      "level": "Low",
      "condition": "@default_trace_enabled",
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "DiskFragmentationAnalysis",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": "Windows",
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "displayName": "Disk fragmentation analysis",
      "description": "If you do not defragment your hard disk, the operating system may have to go to several physical locations on the disk to retrieve the database file, making file access slower. To get information about the fragmentation level, this check requires the destination SQL Server to be running under the sysadmin account.",
      "message": "Defragment volume '@{Output.Name}' with physical fragmentation",
      "helpLink": "https://support.microsoft.com/help/3195161/defragmenting-sql-server-database-disk-drives",
      "level": "Low",
      "condition": {
        "or": [
          {
            "ne": [
              "@Output.da.ReturnValue",
              0
            ]
          },
          {
            "not": "@Output.da.DefragRecommended"
          }
        ]
      },
      "probes": [
        "DiskFragmentationAnalysis"
      ]
    },
    {
      "id": "DiskPartitionAlignment",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": "Windows",
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Performance",
        "Storage"
      ],
      "displayName": "Disk Partition alignment",
      "description": "Noncompliance with storage configuration best practices for the Microsoft SQL Server database software is a common root cause of support cases. The reason is often shown to be misalignment between Windows, storage, disk controllers, and cache segment lines. 64 KB is a common, valid starting partition offset because it correlates well with fundamental physical boundaries in disks, controllers, and cache. Other valid starting partition offsets exist.",
      "message": "Increase disk partition alignment on @{Output.Name} to make it 64 KB at least. Current volume offset is @{Output.StartingOffset}",
      "helpLink": "https://docs.microsoft.com/previous-versions/sql/sql-server-2008/dd758814(v=sql.100)",
      "level": "Low",
      "Threshold": 65536,
      "probes": [
        {
          "id": "MisalignedDiskPartition",
          "params": {
            "threshold": "@Threshold"
          }
        }
      ]
    },
    {
      "id": "DtsSvcAccSame",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": "Windows",
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "displayName": "'Integration Services' and 'SQL Server Database Engine' use same account",
      "description": "Running the 'Integration Services' service under the same account as the 'SQL Server Database Engine' service is not recommended.",
      "message": "Use different accounts for 'Integration Services' service and 'SQL Server Database Engine' service. Now both services use '@{attr::service::MsDtsServer.account}' account",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/configure-windows-service-accounts-and-permissions",
      "level": "Low",
      "condition": {
        "or": [
          {
            "not": "@attr::service::MsDtsServer"
          },
          {
            "ine": [
              "@attr::service::MSSQL.account",
              "@attr::service::MsDtsServer.account"
            ]
          }
        ]
      }
    },
    {
      "id": "DtsSvcStoped",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": "Windows",
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "displayName": "'Integration Services' service is stopped",
      "description": "The 'Integration Services' service provides management support for Integration Services package storage and execution.",
      "message": "Run 'Integration Services' service",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/manage-the-database-engine-services",
      "level": "Low",
      "condition": {
        "or": [
          {
            "not": "@attr::service::MsDtsServer"
          },
          {
            "imatch": [
              "@Output.State",
              "^Running\\.*$"
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ServiceInfo",
          "params": {
            "ServiceName": "@attr::service::MsDtsServer.name"
          }
        }
      ]
    },
    {
      "id": "ErrorLogSize",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration",
        "Performance"
      ],
      "displayName": "Error log file size is too big",
      "description": "Cycling error log files makes it easier to read the error log.",
      "message": "Cycle error log files or revise error log settings. Current error log file size is more than @{threshold} MB.",
      "helpLink": "https://docs.microsoft.com/sql/tools/configuration-manager/viewing-the-sql-server-error-log",
      "level": "Low",
      "threshold": 50,
      "condition": {
        "or": [
          {
            "ne": [
              "@id",
              0
            ]
          },
          {
            "lt": [
              "@size",
              {
                "mul": [
                  "@threshold",
                  1024,
                  1024
                ]
              }
            ]
          }
        ]
      },
      "probes": [
        "ErrorLogInfo"
      ]
    },
    {
      "id": "FullTextServiceLoadOSResources",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "displayName": "Full-text search option 'load_os_resources' set to default",
      "description": "The full-text search option 'load_os_resources' indicates whether operating system word breakers, stemmers, and filters are registered and used with this instance of SQL Server. By default, this property is disabled to prevent inadvertent behavior changes by updates made to the operating system. Enabling use of operating system resources provides access to resources for languages and document types registered with Microsoft Indexing Service that do not have an instance-specific resource installed. If you enable the loading of operating system resources, ensure that the operating system resources are trusted signed binaries; otherwise, they cannot be loaded when verify_signature (see below) is set to 1.",
      "message": "Set full-text search option 'load_os_resources' to @{defaultLoadOSResources}",
      "level": "Low",
      "defaultLoadOSResources": 0,
      "condition": {
        "or": [
          {
            "eq": [
              "@IsFulltextInstalled",
              0
            ]
          },
          {
            "eq": [
              "@LoadOSResources",
              "@defaultLoadOSResources"
            ]
          }
        ]
      },
      "probes": [
        "FullTextServiceInfo"
      ]
    },
    {
      "id": "FullTextServiceVerifySignature",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration",
        "Security"
      ],
      "displayName": "Full-text search option 'verify_signature' set to default",
      "description": "The full-text search option 'verify_signature' indicates whether only signed binaries are loaded by the Full-Text Engine. By default, only trusted, signed binaries are loaded.",
      "message": "Set full-text search option 'verify_signature' to @{defaultVerifySignature}",
      "level": "Low",
      "defaultVerifySignature": 1,
      "condition": {
        "or": [
          {
            "eq": [
              "@IsFulltextInstalled",
              0
            ]
          },
          {
            "eq": [
              "@VerifySignature",
              "@defaultVerifySignature"
            ]
          }
        ]
      },
      "probes": [
        "FullTextServiceInfo"
      ]
    },
    {
      "id": "FullTextSvcAccNotRecommended",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": "Windows",
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "displayName": "'Full-text search' service uses non-recommended account",
      "description": "Running the 'Full-text search' service under the 'NT AUTHORITY\\SYSTEM' account is not recommended for security reasons.",
      "message": "Use another account to run 'Full-text search' service. Current account '@{attr::service::MSSQLFDLauncher.account}' is not recommended",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/configure-windows-service-accounts-and-permissions",
      "level": "Low",
      "unrecommendedAccounts": [
        "NT AUTHORITY\\SYSTEM",
        "LOCALSYSTEM"
      ],
      "condition": {
        "or": [
          {
            "not": "@attr::service::MSSQLFDLauncher"
          },
          {
            "not": {
              "iin": [
                "@attr::service::MSSQLFDLauncher.account",
                "@unrecommendedAccounts"
              ]
            }
          }
        ]
      }
    },
    {
      "id": "FullTextSvcAccSame",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": "Windows",
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "displayName": "'Full-text search' and 'SQL Server Database Engine' use same account",
      "description": "Running the 'Full-text search' service under the same account as the 'SQL Server Database Engine' service is not recommended.",
      "message": "Use different accounts for the 'Full-text search' service and the 'SQL Server Database Engine' service. Now both services use '@{attr::service::MSSQLFDLauncher.account}' account",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/configure-windows-service-accounts-and-permissions",
      "level": "Low",
      "condition": {
        "or": [
          {
            "not": "@attr::service::MSSQLFDLauncher"
          },
          {
            "ine": [
              "@attr::service::MSSQL.account",
              "@attr::service::MSSQLFDLauncher.account"
            ]
          }
        ]
      }
    },
    {
      "id": "FullTextSvcStoped",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": "Windows",
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "displayName": "'Full-text search' service is stopped",
      "description": "The 'Full-text search' service quickly creates full-text indexes on content and properties of structured and semistructured data to provide document filtering and word-breaking for SQL Server.",
      "message": "Run 'Full-text search' service",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/manage-the-database-engine-services",
      "level": "Low",
      "condition": {
        "or": [
          {
            "not": "@attr::service::MSSQLFDLauncher"
          },
          {
            "imatch": [
              "@Output.State",
              "^Running\\.*$"
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ServiceInfo",
          "params": {
            "ServiceName": "@attr::service::MSSQLFDLauncher.name"
          }
        }
      ]
    },
    {
      "id": "HPLogicalProcessor",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": "Windows",
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Performance"
      ],
      "displayName": "HP Logical Processor issue",
      "description": "HP ProLiant Gen9 servers configured with Intel Xeon E5 2600 v3 processors can be configured to support processor configurations that exceed 64 logical processors. Windows Operating Systems divide the logical processors into groups (Kgroups). On HP ProLiant Gen9 servers, the System Firmware, by default, reports the maximum number of possible logical processors to reflect the highest core count processor available. The result is that Windows Operating Systems will group the available logical processors into more than one Kgroup in a two-socket populated configuration. Applications that rely on older kernel APIs for affnitizing threads inside a process to a specific logical processor will only be able to address one Kgroup. The result is that the process will run on fewer logical processors than are presented to the OS for use. Workloads that utilize multiple processes (in lieu of a single process with multiple threads), or are leveraging the APIs that allow beyond single Kgroup addressing, will have full access to all the logical processors presented to the OS for use.",
      "message": "Update server BIOS to the latest version. It may be affected by the HP Logical Processor issue ",
      "helpLink": "https://support.hpe.com/hpesc/public/docDisplay?docId=emr_na-c04650594",
      "level": "Low",
      "condition": {
        "gt": [
          "@virtual_machine_type",
          0
        ]
      },
      "probes": [
        "SysDmOsSysInfo",
        {
          "id": "ServerBIOSInfo",
          "transform": {
            "type": "parse",
            "map": {
              "BIOSVendor": "/^(HP|Hewlett-Packard)$/ix"
            }
          }
        },
        {
          "id": "ServerCPUInfo",
          "transform": [
            {
              "type": "parse",
              "map": {
                "ProcessorNameString": "/.*XEON.*E5.*/ix"
              }
            },
            {
              "type": "aggregate",
              "map": {
                "ProcessorNameString": "count"
              }
            }
          ]
        }
      ]
    },
    {
      "id": "IndexCreateMemory",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration",
        "IndexCreateMemory"
      ],
      "displayName": "'index create memory' should be greater than 'min memory per query'",
      "description": "The 'index create memory' option controls the maximum amount of memory initially allocated for sort operations when creating indexes. The default value for this option is 0 (self-configuring). If more memory is later needed for index creation and the memory is available, the server will use it; thereby, exceeding the setting of this option. If additional memory is not available, the index creation will continue using the memory already allocated. However, if you experience difficulties creating indexes, consider increasing the value of this option from its run value.",
      "message": "Set 'index create memory' to 0 or make it greater than 'min memory per query'. Current 'index create memory' is @{index_create_memory} KB. Current 'min memory per query' is @{min_memory_per_query} KB",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/configure-the-index-create-memory-server-configuration-option",
      "level": "Low",
      "condition": {
        "or": [
          {
            "not": "@index_create_memory"
          },
          {
            "ge": [
              "@index_create_memory",
              "@min_memory_per_query"
            ]
          }
        ]
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "LightweightPoolingOn",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration",
        "Performance"
      ],
      "displayName": "Lightweight pooling option disabled",
      "description": "The 'lightweight pooling' option is used to configure SQL Server to use simplified flows (or 'fibers'). Fiber mode is intended for certain situations in which the context switching of the UMS workers are the critical bottleneck in performance. Because this is rare, fiber mode rarely enhances performance or scalability on the typical system. Improved context switching in Microsoft Windows Server 2003 has also reduced the need for fiber mode. We do not recommend that you use fiber mode scheduling for routine operation. This is because it can decrease performance by inhibiting the regular benefits of context switching, and because some components of SQL Server that use Thread Local Storage (TLS) or thread-owned objects, such as mutexes (a type of Win32 kernel object), cannot function correctly in fiber mode.",
      "message": "Disable 'lightweight pooling' option as fiber mode scheduling can decrease performance",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/lightweight-pooling-server-configuration-option",
      "level": "Low",
      "condition": {
        "not": "@lightweight_pooling"
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "LocksOptionNotDefault",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration",
        "Performance"
      ],
      "displayName": "Option 'locks' should be set to default",
      "description": "The 'locks' option sets the maximum number of available locks, thereby limiting the amount of memory the SQL Server Database Engine uses for them. The default setting is 0, which allows the Database Engine to allocate and deallocate lock structures dynamically, based on changing system requirements.",
      "message": "Set 'locks' option to @{recommended_max_lock_number}. Current value is @{locks}",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/configure-the-locks-server-configuration-option",
      "level": "Low",
      "recommended_max_lock_number": 0,
      "condition": {
        "eq": [
          "@locks",
          "@recommended_max_lock_number"
        ]
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "MaxDOP1NUMA",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer",
        "platform": [
          "Windows",
          "Linux"
        ],
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "MaxDOP",
        "Performance",
        "Configuration",
        "NUMA",
        "CPU"
      ],
      "displayName": "MAXDOP set in accordance with CPU count",
      "description": "The Microsoft SQL Server max degree of parallelism (MAXDOP) configuration option controls the number of processors that are used for the execution of a query in a parallel plan. This option determines the number of threads that are used for the query plan operators that perform the work in parallel. Depending on whether SQL Server is set up on a symmetric multiprocessing (SMP) computer, a non-uniform memory access (NUMA) computer, or hyperthreading-enabled processors, the max degree of parallelism option should be configured appropriately.",
      "message": "Update MAXDOP option according to guideline (see help link). Current MAXDOP value is @{max_dop}, CPU count is @{online_logical_processors}",
      "helpLink": "https://support.microsoft.com/kb/2806535",
      "level": "Low",
      "condition": {
        "or": [
          {
            "ne": [
              "@numa_nodes",
              1
            ]
          },
          {
            "and": [
              {
                "or": [
                  {
                    "le": [
                      "@online_logical_processors",
                      8
                    ]
                  },
                  {
                    "eq": [
                      "@max_dop",
                      8
                    ]
                  }
                ]
              },
              {
                "or": [
                  {
                    "gt": [
                      "@online_logical_processors",
                      8
                    ]
                  },
                  {
                    "le": [
                      "@max_dop",
                      "@online_logical_processors"
                    ]
                  }
                ]
              }
            ]
          }
        ]
      },
      "probes": [
        "ServerInstanceConfiguration",
        "SysConfiguration"
      ]
    },
    {
      "id": "MaxDopFewNumaLess16",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer",
        "platform": [
          "Windows",
          "Linux"
        ],
        "version": "[13.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "MaxDOP",
        "Performance",
        "Configuration",
        "NUMA",
        "CPU"
      ],
      "displayName": "MAXDOP set in accordance with CPU count",
      "description": "The Microsoft SQL Server max degree of parallelism (MAXDOP) configuration option controls the number of processors that are used for the execution of a query in a parallel plan. This option determines the number of threads that are used for the query plan operators that perform the work in parallel. Depending on whether SQL Server is set up on a symmetric multiprocessing (SMP) computer, a non-uniform memory access (NUMA) computer, or hyperthreading-enabled processors, the max degree of parallelism option should be configured appropriately.",
      "message": "Update MAXDOP configuration option value: @{max_dop}. It should not exceed the number of logical processors per NUMA node",
      "helpLink": "https://support.microsoft.com/kb/2806535",
      "level": "Low",
      "condition": {
        "or": [
          {
            "le": [
              "@numa_nodes",
              1
            ]
          },
          {
            "or": [
              {
                "gt": [
                  {
                    "ceiling": {
                      "div": [
                        "@total_logical_processors",
                        "@numa_nodes"
                      ]
                    }
                  },
                  16
                ]
              },
              {
                "and": [
                  {
                    "gt": [
                      "@max_dop",
                      0
                    ]
                  },
                  {
                    "le": [
                      "@max_dop",
                      {
                        "ceiling": {
                          "div": [
                            "@total_logical_processors",
                            "@numa_nodes"
                          ]
                        }
                      }
                    ]
                  }
                ]
              }
            ]
          }
        ]
      },
      "probes": [
        "ServerInstanceConfiguration",
        "SysConfiguration"
      ]
    },
    {
      "id": "MaxDopFewNumaOver16",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer",
        "platform": [
          "Windows",
          "Linux"
        ],
        "version": "[13.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "MaxDOP",
        "Performance",
        "Configuration",
        "NUMA",
        "CPU"
      ],
      "displayName": "MAXDOP set in accordance to CPU count",
      "description": "The Microsoft SQL Server max degree of parallelism (MAXDOP) configuration option controls the number of processors that are used for the execution of a query in a parallel plan. This option determines the number of threads that are used for the query plan operators that perform the work in parallel. Depending on whether SQL Server is set up on a symmetric multiprocessing (SMP) computer, a non-uniform memory access (NUMA) computer, or hyperthreading-enabled processors, the max degree of parallelism option should be configured appropriately.",
      "message": "Update MAXDOP configuration option value: @{max_dop}. It should be half the number of logical processors per NUMA node with maximum value of 16",
      "helpLink": "https://support.microsoft.com/kb/2806535",
      "level": "Low",
      "condition": {
        "or": [
          {
            "le": [
              "@numa_nodes",
              1
            ]
          },
          {
            "or": [
              {
                "le": [
                  {
                    "ceiling": {
                      "div": [
                        "@total_logical_processors",
                        "@numa_nodes"
                      ]
                    }
                  },
                  16
                ]
              },
              {
                "and": [
                  {
                    "eq": [
                      "@max_dop",
                      {
                        "ceiling": {
                          "div": [
                            {
                              "div": [
                                "@total_logical_processors",
                                "@numa_nodes"
                              ]
                            },
                            2
                          ]
                        }
                      }
                    ]
                  },
                  {
                    "le": [
                      "@max_dop",
                      16
                    ]
                  }
                ]
              }
            ]
          }
        ]
      },
      "probes": [
        "ServerInstanceConfiguration",
        "SysConfiguration"
      ]
    },
    {
      "id": "MaxDopFewNumaOver8",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer",
        "platform": "Windows",
        "version": "[11.0, 13.0)"
      },
      "tags": [
        "DefaultRuleset",
        "MaxDOP",
        "Performance",
        "Configuration",
        "NUMA",
        "CPU"
      ],
      "displayName": "MAXDOP set in accordance with CPU count",
      "description": "The Microsoft SQL Server max degree of parallelism (MAXDOP) configuration option controls the number of processors that are used for the execution of a query in a parallel plan. This option determines the number of threads that are used for the query plan operators that perform the work in parallel. Depending on whether SQL Server is set up on a symmetric multiprocessing (SMP) computer, a non-uniform memory access (NUMA) computer, or hyperthreading-enabled processors, the max degree of parallelism option should be configured appropriately.",
      "message": "Update MAXDOP configuration option value: @{max_dop}. It should be equal to 8",
      "helpLink": "https://support.microsoft.com/kb/2806535",
      "level": "Medium",
      "condition": {
        "or": [
          {
            "le": [
              "@numa_nodes",
              1
            ]
          },
          {
            "or": [
              {
                "le": [
                  {
                    "ceiling": {
                      "div": [
                        "@total_logical_processors",
                        "@numa_nodes"
                      ]
                    }
                  },
                  8
                ]
              },
              {
                "eq": [
                  "@max_dop",
                  8
                ]
              }
            ]
          }
        ]
      },
      "probes": [
        "ServerInstanceConfiguration",
        "SysConfiguration"
      ]
    },
    {
      "id": "MaxMemory",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Memory",
        "Performance",
        "MaxMemory"
      ],
      "displayName": "Max allowed memory ",
      "description": "Setting the 'max server memory (MB)' value too high can cause a single instance of SQL Server to compete for memory with other SQL Server instances hosted on the same machine. However, setting this value too low could cause significant memory pressure and performance problems.",
      "message": "Set 'max server memory (MB)' value to @{recommended:N0} MB or less to avoid detrimental memory pressure. Current 'max server memory (MB)' value is @{max_server_memory:N0}, which is greater than recommended",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/server-memory-server-configuration-options",
      "level": "Low",
      "limit": 2147483647,
      "condition": {
        "or": [
          {
            "gt": [
              "@max_server_memory",
              {
                "div": [
                  "@total_physical_memory_kb",
                  1024
                ]
              }
            ]
          },
          {
            "le": [
              "@max_server_memory",
              "@recommended"
            ]
          }
        ]
      },
      "probes": [
        "OsSysMemory",
        "SysConfiguration",
        "SysDmOsSysInfo",
        "SysDmOsHostInfo"
      ],
      "locals": {
        "recommended": {
          "floor": {
            "min": [
              "@limit",
              {
                "sub": [
                  {
                    "sub": [
                      {
                        "div": [
                          "@total_physical_memory_kb",
                          1024
                        ]
                      },
                      {
                        "interval": [
                          {
                            "div": [
                              "@total_physical_memory_kb",
                              1024
                            ]
                          },
                          512,
                          2048,
                          819,
                          4096,
                          1228,
                          8192,
                          2048,
                          12288,
                          2560,
                          24576,
                          3072,
                          32768,
                          4096
                        ]
                      }
                    ]
                  },
                  {
                    "mul": [
                      "@max_workers_count",
                      {
                        "interval": [
                          "@host_architecture",
                          0.5,
                          32,
                          2,
                          64,
                          4
                        ]
                      }
                    ]
                  }
                ]
              }
            ]
          }
        }
      }
    },
    {
      "id": "MaxMemory",
      "itemType": "override",
      "targetFilter": {
        "engineEdition": "Express"
      },
      "limit": 1410
    },
    {
      "id": "MaxMemory",
      "itemType": "override",
      "targetFilter": {
        "engineEdition": "Standard"
      },
      "limit": 131072
    },
    {
      "id": "MaxMemorySystem",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Memory",
        "Performance",
        "MaxMemory"
      ],
      "displayName": "Max server memory exceeds system memory",
      "description": "Setting the 'max server memory (MB)' value higher than system memory can cause SQL Server to compete for memory with the operating system and processes running on the same machine.",
      "message": "Set 'max server memory (MB)' to @{recommended:N0} MB or less to avoid detrimental memory pressure. System memory of @{sysmem:N0} MB is not sufficient for current 'max server memory (MB)' setting of @{max_server_memory:N0} MB",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/server-memory-server-configuration-options",
      "level": "Low",
      "limit": 2147483647,
      "condition": {
        "lt": [
          "@max_server_memory",
          "@sysmem"
        ]
      },
      "probes": [
        "OsSysMemory",
        "SysConfiguration",
        "SysDmOsSysInfo",
        "SysDmOsHostInfo"
      ],
      "locals": {
        "sysmem": {
          "div": [
            "@total_physical_memory_kb",
            1024
          ]
        },
        "recommended": {
          "floor": {
            "min": [
              "@limit",
              {
                "sub": [
                  {
                    "sub": [
                      {
                        "div": [
                          "@total_physical_memory_kb",
                          1024
                        ]
                      },
                      {
                        "interval": [
                          {
                            "div": [
                              "@total_physical_memory_kb",
                              1024
                            ]
                          },
                          512,
                          2048,
                          819,
                          4096,
                          1228,
                          8192,
                          2048,
                          12288,
                          2560,
                          24576,
                          3072,
                          32768,
                          4096
                        ]
                      }
                    ]
                  },
                  {
                    "mul": [
                      "@max_workers_count",
                      {
                        "interval": [
                          "@host_architecture",
                          0.5,
                          32,
                          2,
                          64,
                          4
                        ]
                      }
                    ]
                  }
                ]
              }
            ]
          }
        }
      }
    },
    {
      "id": "MaxMemorySystem",
      "itemType": "override",
      "targetFilter": {
        "engineEdition": "Express"
      },
      "limit": 1410
    },
    {
      "id": "MaxMemorySystem",
      "itemType": "override",
      "targetFilter": {
        "engineEdition": "Standard"
      },
      "limit": 131072
    },
    {
      "id": "MinMemoryPerQuery",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration",
        "Memory",
        "Performance"
      ],
      "displayName": "Option 'min memory per query' set to default",
      "description": "The min memory per query option specifies the minimum amount of memory (in kilobytes) that will be allocated for the execution of a query. This is also known as the minimum memory grant. The default value is 1,024 KB. Do not set the min memory per query server configuration option too high, especially on very busy systems, because the query has to wait1 until it can secure the minimum memory requested, or until the value specified in the query wait server configuration option is exceeded. If more memory is available than the specified minimum value required to execute the query, the query is allowed to make use of the additional memory, provided that the memory can be used effectively by the query.",
      "message": "Set 'min memory per query' option to @{recommended_min_memory_per_query} KB. Current value is '@{min_memory_per_query}'",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/configure-the-min-memory-per-query-server-configuration-option",
      "level": "Low",
      "recommended_min_memory_per_query": 1024,
      "condition": {
        "eq": [
          "@min_memory_per_query",
          "@recommended_min_memory_per_query"
        ]
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "NetworkPacketSize",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration",
        "Network"
      ],
      "displayName": "Option 'network packet size' set to default",
      "description": "The 'network packet size' option sets the packet size (in bytes) that is used across the whole network. Packets are the fixed-size chunks of data that transfer requests and results between clients and servers. The default packet size is 4096 bytes.",
      "message": "Set 'network packet size' option to @{recommended_network_packet_size} bytes. Current value is @{network_packet_size}",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/configure-the-network-packet-size-server-configuration-option",
      "level": "Low",
      "recommended_network_packet_size": 4096,
      "condition": {
        "eq": [
          "@network_packet_size",
          "@recommended_network_packet_size"
        ]
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "NtfsBlockSizeNotFormatted",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": "Windows",
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Performance",
        "Configuration",
        "NTFS"
      ],
      "displayName": "NTFS block size in volumes with database files <> 64KB",
      "description": "A drive can be formatted with different sizes ranging from 512 bytes to 64 KB sizes with the default being 4 KB (4096 bytes). This setting is also called as “Bytes Per Cluster”. The atomic unit of storage in SQL Server is a page which is 8KB in size. Extents are groups of eight 8 KB pages that are physically contiguous to each other for a total of 64 KB. SQL Server uses extents to store data. Hence, on a SQL Server machine the NTFS Allocation unit size hosting SQL database files (Including tempdb files) should be 64 KB.",
      "message": "Set allocation unit size on volume @{volume_mount_point} to 64 KB. Current size is @{Output.BlockSize} bytes",
      "helpLink": "https://docs.microsoft.com/archive/blogs/docast/operating-system-best-practice-configurations-for-sql-server",
      "level": "Low",
      "BlockSize": 65536,
      "condition": {
        "or": [
          {
            "ne": [
              "@volume_id",
              "@Output.DeviceID"
            ]
          },
          {
            "eq": [
              "@Output.BlockSize",
              "@BlockSize"
            ]
          }
        ]
      },
      "probes": [
        "NtfsBlockSize",
        {
          "id": "DatabaseMasterFiles",
          "params": {
            "type": null,
            "dbId": null
          },
          "transform": {
            "type": "aggregate",
            "group": "volume_id",
            "map": {
              "volume_mount_point": {
                "type": "join",
                "comparison": "OrdinalIgnoreCase"
              }
            }
          }
        }
      ]
    },
    {
      "id": "NtfsBlockSizeNotFormatted",
      "itemType": "override",
      "targetFilter": {
        "machineType": "AzureVm"
      },
      "level": "Medium",
      "condition": {
        "or": [
          {
            "ne": [
              "@volume_id",
              "@Output.DeviceID"
            ]
          },
          {
            "or": [
              "@isBoot",
              "@isTemp",
              {
                "eq": [
                  "@Output.BlockSize",
                  "@BlockSize"
                ]
              }
            ]
          }
        ]
      },
      "probes": [
        "NtfsBlockSize",
        {
          "id": "DatabaseMasterFiles",
          "params": {
            "type": null,
            "dbId": null
          },
          "transform": {
            "type": "aggregate",
            "group": "volume_id",
            "map": {
              "volume_mount_point": {
                "type": "join",
                "comparison": "OrdinalIgnoreCase"
              }
            }
          }
        },
        {
          "id": "AzStorage",
          "params": {
            "path": "@DatabaseMasterFiles::volume_id"
          },
          "transform": {
            "type": "aggregate",
            "map": {
              "isBoot": "or",
              "isTemp": "or"
            }
          }
        }
      ]
    },
    {
      "id": "OlapSvcAccSame",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": "Windows",
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "displayName": "'Analysis Services' and 'SQL Server Database Engine' use same account",
      "description": "Running the 'Analysis Services' service under the same account as the 'SQL Server Database Engine' service is not recommended.",
      "message": "Use different accounts for the 'Analysis Services' service and the 'SQL Server Database Engine' service. Now both services use '@{attr::service::MSOLAP.account}' account",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/configure-windows-service-accounts-and-permissions",
      "level": "Low",
      "condition": {
        "or": [
          {
            "not": "@attr::service::MSOLAP"
          },
          {
            "ine": [
              "@attr::service::MSSQL.account",
              "@attr::service::MSOLAP.account"
            ]
          }
        ]
      }
    },
    {
      "id": "OlapSvcStoped",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": "Windows",
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "displayName": "'Analysis Services' service is stopped",
      "description": "The 'Analysis Services' service provides online analytical processing (OLAP) and data mining functionality for business intelligence applications.",
      "message": "Run 'Analysis Services' service",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/manage-the-database-engine-services",
      "level": "Low",
      "condition": {
        "or": [
          {
            "not": "@attr::service::MSOLAP"
          },
          {
            "imatch": [
              "@Output.State",
              "^Running\\.*$"
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ServiceInfo",
          "params": {
            "ServiceName": "@attr::service::MSOLAP.name"
          }
        }
      ]
    },
    {
      "id": "OleAutomationProceduresOn",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration",
        "Security"
      ],
      "displayName": "Option 'Ole Automation Procedures' set to default",
      "description": "Use the 'Ole Automation Procedures' option to specify whether OLE Automation objects can be instantiated within Transact-SQL batches. When OLE Automation Procedures are enabled, a call to 'sp_OACreate' will start the OLE shared execution environment. The 'Ole Automation Procedures' option can be set to the following values: 1 Enabled, 0 Disabled (default value).",
      "message": "Disable 'Ole Automation Procedures' option to avoid security risks",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/ole-automation-procedures-server-configuration-option",
      "level": "Low",
      "condition": {
        "not": "@ole_automation_procedures"
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "PageFileAutoManaged",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": "Windows",
        "engineEdition": "SqlServer",
        "version": "[11.0,)",
        "machineType": {
          "not": "AzureVm"
        }
      },
      "tags": [
        "DefaultRuleset",
        "Performance",
        "Memory",
        "PageFile",
        "SysAdminReq"
      ],
      "displayName": "Page file is not automatically managed",
      "description": "Memory allocation failures can occur due to latencies that are associated with growing the size of a page file to support additional memory requirements in the system. A potential cause of these failures is when the page file size is configured as “automatic.” Automatic page-file size starts with a small page file and grows automatically as needed. The IO system consists of many components, including file system filters, file systems, volume filters, storage filters, and so on. The specific components on a given system can cause variability in page file growth.",
      "message": "Avoid automatic management of page files. Set custom size for page file on drives: '@{PagingFiles.Drive}'",
      "helpLink": "https://support.microsoft.com/help/4055223/memory-allocation-errors-can-be-caused-by-slow-page-file-growth",
      "level": "Low",
      "probes": [
        {
          "id": "PageFileManagement",
          "transform": [
            {
              "type": "parse",
              "map": {
                "PagingFiles": "/^(?<Drive>\\w:)\\\\pagefile.sys 0 0$/x"
              }
            },
            {
              "type": "aggregate",
              "map": {
                "PagingFiles.Drive": "join"
              }
            }
          ]
        }
      ]
    },
    {
      "id": "PageFileAutoManagedAllDrives",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": "Windows",
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Performance",
        "Memory",
        "PageFile",
        "SysAdminReq"
      ],
      "displayName": "Page file is not automatically managed",
      "description": "Memory allocation failures can occur due to latencies that are associated with growing the size of a page file to support additional memory requirements in the system. A potential cause of these failures is when the page file size is configured as “automatic.” Automatic page-file size starts with a small page file and grows automatically as needed. The IO system consists of many components, including file system filters, file systems, volume filters, storage filters, and so on. The specific components on a given system can cause variability in page file growth. ",
      "message": "Disable 'Automatically manage paging file size for all drives' option",
      "helpLink": "https://support.microsoft.com/help/4055223/memory-allocation-errors-can-be-caused-by-slow-page-file-growth",
      "level": "Low",
      "condition": {
        "ne": [
          "@PagingFiles",
          "?:\\pagefile.sys"
        ]
      },
      "probes": [
        "PageFileManagement"
      ]
    },
    {
      "id": "PageFileLess10FreeSpace",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Performance",
        "Memory",
        "PageFile",
        "SysAdminReq"
      ],
      "displayName": "Insufficient page file free space",
      "description": "Page file sizing depends on the system crash dump setting requirements and the peak usage or expected peak usage of the system commit charge. Both considerations are unique to each system, even for systems that are identical. This means that page file sizing is also unique to each system and cannot be generalized.",
      "message": "Revise page file settings. Less than 10% of page file is available",
      "helpLink": "https://docs.microsoft.com/windows/client-management/determine-appropriate-page-file-size",
      "level": "Low",
      "threshold": 0.1,
      "condition": {
        "or": [
          {
            "eq": [
              {
                "sub": [
                  "@total_page_file_kb",
                  "@total_physical_memory_kb"
                ]
              },
              0
            ]
          },
          {
            "gt": [
              {
                "div": [
                  {
                    "sub": [
                      "@available_page_file_kb",
                      "@available_physical_memory_kb"
                    ]
                  },
                  {
                    "sub": [
                      "@total_page_file_kb",
                      "@total_physical_memory_kb"
                    ]
                  }
                ]
              },
              "@threshold"
            ]
          }
        ]
      },
      "probes": [
        "OsSysMemory"
      ]
    },
    {
      "id": "PageFileNotConfigured",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": "Windows",
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Performance",
        "Memory",
        "PageFile",
        "SysAdminReq"
      ],
      "displayName": "Page file not configured",
      "description": "Page file sizing depends on the system crash dump setting requirements and the peak usage or expected peak usage of the system commit charge. Both considerations are unique to each system, even for systems that are identical. This means that page file sizing is also unique to each system and cannot be generalized.",
      "message": "Create page file on server",
      "helpLink": "https://docs.microsoft.com/windows/client-management/determine-appropriate-page-file-size",
      "level": "Low",
      "condition": "@PagingFiles",
      "probes": [
        "PageFileManagement"
      ]
    },
    {
      "id": "PageFileOut",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Performance",
        "Memory",
        "PageFile",
        "SysAdminReq"
      ],
      "displayName": "Memory paged out",
      "description": "Microsoft SQL Server performs dynamic memory management based on the memory requirements of the current load and activities on the system. On Windows, SQL Server can use the memory notification mechanisms that are provided by the QueryMemoryResourceNotification Windows API. Based on this information from the QueryMemoryResourceNotification Windows API or from the memory calculation, SQL Server responds to the current memory situation on a specific system. This provides the following benefits: 1. The system does not page out the working set of the SQL Server process; 2. The necessary database pages are available in memory to reduce physical I/O needs. For more information, see the \"Dynamic memory management\" topic and the \"Server memory options\" topic in SQL Server Books Online.",
      "message": "Revise LPIM settings. Part of SQL Server process memory has been paged out",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/enable-the-lock-pages-in-memory-option-windows",
      "level": "Low",
      "condition": {
        "gt": [
          "@available_page_file_kb",
          0
        ]
      },
      "probes": [
        "OsSysMemory"
      ]
    },
    {
      "id": "PowerPlanSchemeNotRecommended",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": "Windows",
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration",
        "Performance"
      ],
      "displayName": "Power plan is High Performance",
      "description": "In some cases you may experience degraded overall performance on a Windows Server 2008 R2 or later machine when running with the default (Balanced) power plan. The issue may occur irrespective of platform and may be exhibited on both native and virtual environments. The degraded performance may increase the average response time for some tasks and cause performance issues with CPU-intensive applications. Please note that you may not notice performance issues while performing simple operations. However, applications or scripts that intensively use resources (primarily processor and memory) may exhibit the problem. To work around the performance degradation issue, you can switch to the High Performance power plan.  However, this will disable dynamic performance scaling on the platform. Depending on the environment, if the platform is always under a heavy load, then this is a viable solution.",
      "message": "Switch server to High Performance power plan",
      "helpLink": "https://support.microsoft.com/help/2207548/slow-performance-on-windows-server-when-using-the-balanced-power-plan",
      "level": "Medium",
      "powerplanid": "8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c",
      "condition": {
        "or": [
          {
            "eq": [
              "@ActivePowerScheme",
              0
            ]
          },
          {
            "eq": [
              "@ActivePowerScheme",
              "@powerplanid"
            ]
          }
        ]
      },
      "probes": [
        "PowerPlan"
      ]
    },
    {
      "id": "PriorityBoostOn",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": "Windows",
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration",
        "Performance"
      ],
      "displayName": "Option 'priority boost' set to default",
      "description": "The 'priority boost' option used to specify whether Microsoft SQL Server should run at a higher scheduling priority than other processes on the same computer. If this option is set to 1, SQL Server runs at a priority base of '13' scheduler. The default is '0', which is a priority base of '7'.",
      "message": "Set 'priority boost' option to default value",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/configure-the-priority-boost-server-configuration-option",
      "level": "High",
      "condition": {
        "not": "@priority_boost"
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "QueryWaitNotDefault",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "displayName": "Option 'query wait' set to default",
      "description": "Memory-intensive queries (such as those involving sorting and hashing) are queued when there is not enough memory available to run the query. The query wait option specifies the time, in seconds (from 0 through 2147483647), that a query waits for resources before it times out. The default value for this option is -1. This means the time-out is calculated as 25 times the estimated query cost.",
      "message": "Set 'query wait' option to @{default_query_wait}. Current value is @{query_wait}. Increasing maximum wait time may increase amount of time to terminate queries",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/configure-the-query-wait-server-configuration-option",
      "level": "High",
      "default_query_wait": -1,
      "condition": {
        "eq": [
          "@query_wait",
          "@default_query_wait"
        ]
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "RecoveryIntervalOn",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration",
        "Performance"
      ],
      "displayName": "Option 'recovery interval' set to default",
      "description": "The 'recovery interval' option defines an upper limit on the time recovering a database should take. The default recovery-interval value is 0, which allows the Database Engine to automatically configure the recovery interval. Higher values indicate the approximate maximum recovery time, in minutes.",
      "message": "Set 'recovery interval' option to @{default_recovery_interval}. Current value is @{recovery_interval}",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/configure-the-recovery-interval-server-configuration-option",
      "level": "Low",
      "default_recovery_interval": 0,
      "condition": {
        "eq": [
          "@recovery_interval",
          "@default_recovery_interval"
        ]
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "RemoteDacClusterOn",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "displayName": "Remote admin connections enabled on cluster (DAC)",
      "description": "SQL Server provides a dedicated administrator connection (DAC). The DAC lets an administrator access a running server to execute diagnostic functions or Transact-SQL statements, or to troubleshoot problems on the server, even when the server is locked or running in an abnormal state and not responding to a SQL Server Database Engine connection. On cluster configurations, the DAC will be off by default. Users can execute the remote admin connection option of sp_configure to enable the DAC listener to access a remote connection. If SQL Server is unresponsive and the DAC listener is not enabled, you might have to restart SQL Server to connect with the DAC. Therefore, we recommend that you enable the remote admin connections configuration option on clustered systems.",
      "message": "Enable 'remote admin connections' option",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/diagnostic-connection-for-database-administrators",
      "level": "Low",
      "condition": {
        "or": [
          {
            "not": "@is_clustered_server"
          },
          "@remote_admin_connections"
        ]
      },
      "probes": [
        "SysConfiguration",
        "ServerProperties"
      ]
    },
    {
      "id": "RemoteQueryTimeout",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "displayName": "Option 'remote query timeout' set to default",
      "description": "The 'remote query timeout' option specifies how long, in seconds, a remote operation can take before SQL Server times out. The default value for this option is 600, which allows a 10-minute wait. This value applies to an outgoing connection initiated by the Database Engine as a remote query.",
      "message": "Set 'remote query timeout' option to @{recommended_remote_query_timeout}. Current value is @{remote_query_timeout}",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/configure-the-remote-query-timeout-server-configuration-option",
      "level": "Low",
      "recommended_remote_query_timeout": 600,
      "condition": {
        "eq": [
          "@remote_query_timeout",
          "@recommended_remote_query_timeout"
        ]
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "RsSvcAccSame",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": "Windows",
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "displayName": "'Reporting Services' and 'SQL Server Database Engine' use same account",
      "description": "Running the 'Reporting Services' service under the same account as the 'SQL Server Database Engine' service is not recommended.",
      "message": "Use different accounts for 'Reporting Services' service and the 'SQL Server Database Engine' service. Now both services use '@{attr::service::ReportServer.account}' account",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/configure-windows-service-accounts-and-permissions",
      "level": "Low",
      "condition": {
        "or": [
          {
            "not": "@attr::service::ReportServer"
          },
          {
            "ine": [
              "@attr::service::MSSQL.account",
              "@attr::service::ReportServer.account"
            ]
          }
        ]
      }
    },
    {
      "id": "RsSvcStoped",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": "Windows",
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "displayName": "'Reporting Services' service is stopped",
      "description": "'The Reporting Services' service manages, executes, creates, schedules and delivers reports.",
      "message": "Run 'Reporting Services' service",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/manage-the-database-engine-services",
      "level": "Low",
      "condition": {
        "or": [
          {
            "not": "@attr::service::ReportServer"
          },
          {
            "imatch": [
              "@Output.State",
              "^Running\\.*$"
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ServiceInfo",
          "params": {
            "ServiceName": "@attr::service::ReportServer.name"
          }
        }
      ]
    },
    {
      "id": "ScanStartupProcs",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": "Windows",
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "displayName": "Option 'scan for startup procs' disabled on replication servers",
      "description": "Use the scan for startup procs option to scan for automatic execution of stored procedures at SQL Server startup time. If this option is set to 1, SQL Server scans for and runs all automatically run stored procedures that are defined on the server. The default value for scan for startup procs is 0 (do not scan). This option shouldn't be enabled on a SQL Server participating in replication.",
      "message": "Disable 'scan for startup procs' option for servers that participate in replication",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/configure-the-scan-for-startup-procs-server-configuration-option",
      "level": "Low",
      "condition": {
        "or": [
          {
            "not": "@ReplicationInfo::IsInstalled"
          },
          {
            "not": "@startup_stored_procedures"
          }
        ]
      },
      "probes": [
        "ReplicationInfo",
        "SysConfiguration"
      ]
    },
    {
      "id": "SqlSvcAccNotRecommended",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": "Windows",
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "displayName": "'SQL Server Database Engine' service uses non-recommended account",
      "description": "Running the 'SQL Server Database Engine' service under 'NT AUTHORITY\\SYSTEM' or 'NT AUTHORITY\\NETWORKSERVICE' accounts is not recommended for security reasons.",
      "message": "Use another account to run 'SQL Server Database Engine' service. Current account '@{attr::service::MSSQL.account}' is not recommended",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/configure-windows-service-accounts-and-permissions",
      "level": "Low",
      "unrecommendedAccounts": [
        "NT AUTHORITY\\SYSTEM",
        "LOCALSYSTEM",
        "NT AUTHORITY\\NETWORKSERVICE"
      ],
      "condition": {
        "or": [
          "@is_clustered_server",
          {
            "not": {
              "iin": [
                "@attr::service::MSSQL.account",
                "@unrecommendedAccounts"
              ]
            }
          }
        ]
      },
      "probes": [
        "ServerProperties"
      ]
    },
    {
      "id": "SqlSvcAccNotSupported",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": "Windows",
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "displayName": "'SQL Server Database Engine' service uses not supported account",
      "description": "Running the 'SQL Server Database Engine' service under 'NT AUTHORITY\\LOCALSERVICE', 'NT AUTHORITY\\SYSTEM' or 'NT AUTHORITY\\NETWORKSERVICE' accounts is not supported.",
      "message": "Use another account to run 'SQL Server Database Engine' service. Current account '@{attr::service::MSSQL.account}' is not supported",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/configure-windows-service-accounts-and-permissions",
      "level": "Low",
      "localServiceAccount": "NT AUTHORITY\\LOCALSERVICE",
      "unsupportedAccounts": [
        "NT AUTHORITY\\SYSTEM",
        "LOCALSYSTEM",
        "NT AUTHORITY\\NETWORKSERVICE"
      ],
      "condition": {
        "and": [
          {
            "ine": [
              "@attr::service::MSSQL.account",
              "@localServiceAccount"
            ]
          },
          {
            "or": [
              {
                "not": "@is_clustered_server"
              },
              {
                "not": {
                  "iin": [
                    "@attr::service::MSSQL.account",
                    "@unsupportedAccounts"
                  ]
                }
              }
            ]
          }
        ]
      },
      "probes": [
        "ServerProperties"
      ]
    },
    {
      "id": "ThreadExhaustionCPUBound",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Performance"
      ],
      "displayName": "Worker thread exhaustion on CPU-bound system",
      "description": "Consider overall runnable tasks count and schedulers work queue count.",
      "message": "Possible worker thread exhaustion (schedulers work queue count is '@{schedulers_work_queue_count}'). Overall runnable tasks count is '@{overall_runnable_tasks_count}' (> 2), indicating the server might be CPU-bound. Configured workers is '@{max_workers_count}'",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/configure-the-max-worker-threads-server-configuration-option",
      "level": "Low",
      "condition": {
        "or": [
          {
            "le": [
              "@schedulers_work_queue_count",
              1
            ]
          },
          {
            "le": [
              "@overall_runnable_tasks_count",
              2
            ]
          }
        ]
      },
      "probes": [
        "WorkerThreads",
        "SysDmOsSysInfo"
      ]
    },
    {
      "id": "ThreadExhaustionNotCPUBound",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Performance"
      ],
      "displayName": "Possible worker thread exhaustion on non-CPU-bound system",
      "description": "Consider overall runnable tasks count and schedulers work queue count.",
      "message": "Possible worker thread exhaustion (schedulers work queue count is '@{schedulers_work_queue_count}'). Because overall runnable tasks count is '@{overall_runnable_tasks_count}' (<= 2), indicating the server might not be CPU bound, there might be room to increase max_worker_threads (configured workers is '@{max_workers_count}')",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/configure-the-max-worker-threads-server-configuration-option",
      "level": "Low",
      "condition": {
        "or": [
          {
            "le": [
              "@schedulers_work_queue_count",
              1
            ]
          },
          {
            "gt": [
              "@overall_runnable_tasks_count",
              2
            ]
          }
        ]
      },
      "probes": [
        "WorkerThreads",
        "SysDmOsSysInfo"
      ]
    },
    {
      "id": "ThresholdForParallelism",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration",
        "Performance"
      ],
      "displayName": "Non-default value for 'cost threshold for parallelism' option",
      "description": "The 'cost threshold for parallelism' option specifies the threshold at which SQL Server creates and runs parallel plans for queries. SQL Server creates and runs a parallel plan for a query only when the estimated cost to run a serial plan for the same query is higher than the value set in the cost threshold for parallelism. The cost refers to an estimated cost required to run the serial plan on a specific hardware configuration and is not a unit of time. The 'cost threshold for parallelism' option can be set to any value from 0 through 32767. The default value is 5.",
      "message": "Review non-default value @{cost_threshold_for_parallelism} for the 'cost threshold for parallelism' option",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/configure-the-cost-threshold-for-parallelism-server-configuration-option",
      "level": "Information",
      "default_cost_parallel": 5,
      "condition": {
        "eq": [
          "@cost_threshold_for_parallelism",
          "@default_cost_parallel"
        ]
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "WorkerThreadsLargeX64",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": "Windows",
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration",
        "Performance",
        "CPU"
      ],
      "displayName": "Option 'max worker threads' set to recommended value on x64 system",
      "description": "The max worker threads option configures the number of worker threads that are available to SQL Server processes. The default value for max worker threads is 0. This enables SQL Server to automatically configure the number of worker threads at startup.",
      "message": "Reconfigure 'max worker threads' option parameter. Current value (@{max_worker_threads}) is higher than recommended for x64 system (@{recommended_max_worker_threads})",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/configure-the-max-worker-threads-server-configuration-option",
      "level": "Low",
      "recommended_max_worker_threads": 2048,
      "condition": {
        "or": [
          {
            "ne": [
              "@host_architecture",
              64
            ]
          },
          {
            "lt": [
              "@max_worker_threads",
              "@recommended_max_worker_threads"
            ]
          }
        ]
      },
      "probes": [
        "SysDmOsHostInfo",
        "SysConfiguration"
      ]
    },
    {
      "id": "WorkerThreadsLargeX86",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": "Windows",
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration",
        "Performance",
        "CPU"
      ],
      "displayName": "Option 'max worker threads' set to recommended value on x86 system",
      "description": "The max worker threads option configures the number of worker threads that are available to SQL Server processes. The default value for max worker threads is 0. This enables SQL Server to automatically configure the number of worker threads at startup.",
      "message": "Reconfigure 'max worker threads' option. Current value (@{max_worker_threads}) is higher than recommended for x86 system (@{recommended_max_worker_threads})",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/configure-the-max-worker-threads-server-configuration-option",
      "level": "Low",
      "recommended_max_worker_threads": 1024,
      "condition": {
        "or": [
          {
            "ne": [
              "@host_architecture",
              32
            ]
          },
          {
            "lt": [
              "@max_worker_threads",
              "@recommended_max_worker_threads"
            ]
          }
        ]
      },
      "probes": [
        "SysDmOsHostInfo",
        "SysConfiguration"
      ]
    },
    {
      "id": "XpCmdShellOn",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "displayName": "Option 'xp_cmdshell' is disabled",
      "description": "The xp_cmdshell option is a SQL Server configuration option that enables system administrators to control whether the xp_cmdshell extended stored procedure can be executed on a system. By default, the xp_cmdshell option is disabled on new installations. ",
      "message": "Disable 'xp_cmdshell' as it exposes to security risks",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/xp-cmdshell-server-configuration-option",
      "level": "Low",
      "condition": {
        "not": "@xp_cmdshell"
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "AccessCheckCache",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "displayName": "Non-default values for access check cache options",
      "description": "When database objects are accessed by SQL Server, the access check is cached in an internal structure called the access check result cache. The 'access check cache bucket count' and 'access check cache quota' options control the number of hash buckets and number of entries used for access check result cache. The default values of 0 indicate that SQL Server is managing these options.",
      "message": "Review non-default values for access check cache options",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/access-check-cache-server-configuration-options",
      "level": "Information",
      "condition": {
        "and": [
          {
            "eq": [
              "@access_check_cache_quota",
              0
            ]
          },
          {
            "eq": [
              "@access_check_cache_bucket_count",
              0
            ]
          }
        ]
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "AccessCheckCacheRatio",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "displayName": "Access check cache options ratio",
      "description": "When database objects are accessed by SQL Server, the access check is cached in an internal structure called the access check result cache. The 'access check cache bucket count' and 'access check cache quota' options control the number of hash buckets and number of entries used for access check result cache. These options should be set using a ratio of 1:4.",
      "message": "Use a ratio of 1:4 for access check cache options",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/access-check-cache-server-configuration-options",
      "level": "Low",
      "condition": {
        "eq": [
          "@access_check_cache_quota",
          {
            "mul": [
              4,
              "@access_check_cache_bucket_count"
            ]
          }
        ]
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "Affinity64IOMask",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer",
        "platform": [
          "Windows",
          "Linux"
        ],
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Performance",
        "Configuration"
      ],
      "displayName": "Non-default value for 'affinity64 I/O mask' option",
      "description": "The 'affinity64 I/O mask' binds SQL Server disk I/O to a specified subset of CPUs, similar to the 'affinity I/O mask' option. Use 'affinity I/O mask' to bind the first 32 processors, and use 'affinity64 I/O mask' to bind the remaining processors.",
      "message": "Review non-default value @{affinity64_io_mask} for the 'affinity64 I/O mask' option",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/affinity64-input-output-mask-server-configuration-option",
      "level": "Information",
      "condition": {
        "or": [
          {
            "ne": [
              "@architecture",
              64
            ]
          },
          {
            "eq": [
              "@affinity64_io_mask",
              0
            ]
          }
        ]
      },
      "probes": [
        "SysConfiguration",
        "ServerProperties"
      ]
    },
    {
      "id": "Affinity64Mask",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer",
        "platform": [
          "Windows",
          "Linux"
        ],
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Performance",
        "Configuration"
      ],
      "displayName": "Non-default value for 'affinity64 mask' option",
      "description": "The 'affinity64 mask' binds processors to specific threads, similar to the 'affinity mask' option. Use 'affinity mask' to bind the first 32 processors, and use 'affinity64 mask' to bind the remaining processors.",
      "message": "Review non-default value @{affinity64_mask} for the 'affinity64 mask' option as it will be removed in a future version",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/affinity64-mask-server-configuration-option",
      "level": "Low",
      "condition": {
        "or": [
          {
            "ne": [
              "@architecture",
              64
            ]
          },
          {
            "eq": [
              "@affinity64_mask",
              0
            ]
          }
        ]
      },
      "probes": [
        "SysConfiguration",
        "ServerProperties"
      ]
    },
    {
      "id": "AffinityIOMask",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer",
        "platform": [
          "Windows",
          "Linux"
        ],
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Performance",
        "Configuration"
      ],
      "displayName": "Non-default value for 'affinity I/O mask' option",
      "description": "In a multi-processor system, the 'affinity I/O mask' option binds SQL Server disk I/O to a specified subset of CPUs.",
      "message": "Review non-default value @{affinity_io_mask} for the 'affinity I/O mask' option",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/affinity-input-output-mask-server-configuration-option",
      "level": "Information",
      "condition": {
        "eq": [
          "@affinity_io_mask",
          0
        ]
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "AffinityMask",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer",
        "platform": [
          "Windows",
          "Linux"
        ],
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Performance",
        "Configuration"
      ],
      "displayName": "Non-default value for 'affinity mask' option",
      "description": "In a multi-processor system, the 'affinity mask' option is used to assign certain CPUs to an instance of SQL Server. When the 'affinity mask' is at its default value of 0, the instance of SQL Server can use all processors in the system for its threads. Setting the 'affinity mask' to a non-default value, restricts SQL Server to using only the assigned CPUs.",
      "message": "Review non-default value @{affinity_mask} for the 'affinity64 mask' option as it will be removed in a future version",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/affinity-mask-server-configuration-option",
      "level": "Low",
      "condition": {
        "eq": [
          "@affinity_mask",
          0
        ]
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "AGCount",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Performance"
      ],
      "displayName": "Availability database count",
      "description": "The number of databases and availability groups hosted on a single computer (virtual or physical) depends on the hardware and workload. There is no enforced software boundary. However, having more than 100 databases on a single production computer may lead to performance issues, dependent on the workload of the databases.",
      "message": "Review the number of availability databases (@{database_id})",
      "level": "Information",
      "helpLink": "https://learn.microsoft.com/sql/database-engine/availability-groups/windows/prereqs-restrictions-recommendations-always-on-availability",
      "threshold": 100,
      "condition": {
        "le": [
          "@database_id",
          "@threshold"
        ]
      },
      "probes": [
        {
          "id": "AGDatabases",
          "transform": {
            "type": "aggregate",
            "map": {
              "database_id": "count"
            }
          }
        }
      ]
    },
    {
      "id": "AGDbDisjoined",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "tags": [
        "DefaultRuleset",
        "AlwaysOn"
      ],
      "displayName": "Availability database joined state",
      "description": "To add a database to an availability group, the database must be an online, read-write database that exists on the server instance that hosts the primary replica. When you add a database, it joins the availability group as a primary database. No corresponding secondary database exists until backups of the new primary database are restored to the server instance that hosts the secondary replica. The new secondary database is in the RESTORING state until it is joined to the availability group. Joining places the secondary database into the ONLINE state and initiates data synchronization with the corresponding primary database.",
      "message": "Join database '@{databaseName}' to availability group '@{ag_name}' on secondary replica '@{ag_replica_server}'",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/availability-groups/windows/join-a-secondary-database-to-an-availability-group-sql-server",
      "condition": {
        "or": [
          {
            "or": [
              {
                "ne": [
                  "@AGConfiguration::replica_id",
                  "@AGDatabases::replica_id"
                ]
              },
              {
                "ne": [
                  "@is_ag_replica_local",
                  0
                ]
              }
            ]
          },
          "@is_database_joined"
        ]
      },
      "probes": [
        "AGDatabases",
        "AGConfiguration"
      ]
    },
    {
      "id": "AGEndpointEncryption",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "displayName": "Database mirroring endpoint encryption",
      "description": "By default, a database mirroring endpoint requires encryption of data sent over mirroring connections. In this case, the endpoint can connect only to endpoints that also use encryption. Unless you can guarantee that your network is secure, we recommend that you require encryption for your database mirroring connections.",
      "message": "Configure data encryption on endpoint '@{endpoint_name}'",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/availability-groups/windows/prereqs-restrictions-recommendations-always-on-availability",
      "condition": "@is_encryption_enabled",
      "probes": [
        "AGEndpoints"
      ]
    },
    {
      "id": "AgentXPs",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "displayName": "Option 'Agent XPs' is disabled",
      "description": "The 'Agent XPs' option enables the SQL Server Agent extended stored procedures. When this option is disabled, the SQL Server Agent node is not available in SQL Server Management Studio Object Explorer.",
      "message": "Enable 'Agent XPs' option",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/agent-xps-server-configuration-option",
      "level": "Information",
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "condition": "@Agent_XPs",
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "AGFailureConditionLevel",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "tags": [
        "DefaultRuleset",
        "AlwaysOn"
      ],
      "displayName": "Availability group failure-condition level",
      "description": "A flexible failover policy provides granular control over the conditions that cause automatic failover for an availability group. By changing the failure conditions that trigger an automatic failover and the frequency of health checks, you can increase or decrease the likelihood of an automatic failover to support your Service Level Agreement (SLA) for high availability.",
      "message": "Review failure-condition level for availability group '@{ag_name}'",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/availability-groups/windows/configure-flexible-automatic-failover-policy",
      "level": "Information",
      "condition": {
        "or": [
          {
            "or": [
              {
                "ne": [
                  "@ag_replica_role",
                  1
                ]
              },
              "@is_distributed"
            ]
          },
          {
            "eq": [
              "@failure_condition_level",
              3
            ]
          }
        ]
      },
      "probes": [
        "AGConfiguration"
      ]
    },
    {
      "id": "AGHealthCheckTimeout",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "tags": [
        "DefaultRuleset",
        "AlwaysOn"
      ],
      "displayName": "Availability group health check timeout",
      "description": "The Always On resource DLL monitors the status of internal SQL Server components. sp_server_diagnostics reports the health of these components on an interval controlled by health check timeout. The default settings are optimized for quickly reacting to symptoms of hard failures and limiting downtime, but these settings can also be overly aggressive for certain workloads and configurations.",
      "message": "Review non-default value @{health_check_timeout} of health check timeout for availability group '@{ag_name}'. Default value is 30000 milliseconds (30 seconds)",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/availability-groups/windows/availability-group-lease-healthcheck-timeout",
      "level": "Information",
      "condition": {
        "or": [
          {
            "or": [
              {
                "ne": [
                  "@ag_replica_role",
                  1
                ]
              },
              "@is_distributed"
            ]
          },
          {
            "eq": [
              "@health_check_timeout",
              30000
            ]
          }
        ]
      },
      "probes": [
        "AGConfiguration"
      ]
    },
    {
      "id": "AGIsFailoverReady",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "tags": [
        "DefaultRuleset",
        "AlwaysOn"
      ],
      "displayName": "Availability database automatic failover readiness",
      "description": "Within the context of an availability group, the primary role and secondary role of availability replicas are typically interchangeable in a process known as failover. During the failover, a qualified secondary replica takes over the primary role, recovers its databases, and brings them online as the new primary databases. An automatic failover causes a qualified secondary replica to automatically transition to the primary role after the primary replica becomes unavailable.",
      "message": "Database '@{databaseName}' in availability group '@{ag_name}' is not ready for automatic failover. Synchronize database on secondary replica '@{ag_replica_server}'",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/availability-groups/windows/failover-and-failover-modes-always-on-availability-groups#AutomaticFailover",
      "condition": {
        "or": [
          {
            "or": [
              {
                "ne": [
                  "@AGConfiguration::replica_id",
                  "@AGDatabases::replica_id"
                ]
              },
              {
                "ne": [
                  "@AGConfiguration::failover_mode",
                  0
                ]
              },
              {
                "ne": [
                  "@AGConfiguration::availability_mode",
                  1
                ]
              },
              {
                "ne": [
                  "@is_ag_replica_local",
                  0
                ]
              }
            ]
          },
          "@is_failover_ready"
        ]
      },
      "probes": [
        "AGConfiguration",
        "AGDatabases"
      ]
    },
    {
      "id": "AGMultipleDHCPListenerSubnets",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "displayName": "Availability group listener network mode",
      "description": "DHCP network mode is limited to a single subnet that is used for every server instances that hosts a replica in the availability group. To create an availability group across multiple subnets, each subnet requires a static IP address in the listener configuration.",
      "message": "Reconfigure '@{dns_name}' listener for '@{ag_name}' availability group. Use static IP addresses across multiple subnets",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/availability-groups/windows/create-or-configure-an-availability-group-listener-sql-server",
      "condition": {
        "or": [
          {
            "or": [
              {
                "not": "@is_dhcp"
              },
              {
                "ne": [
                  "@ag_id",
                  "@group_id"
                ]
              }
            ]
          },
          {
            "eq": [
              "@network_subnet_ip",
              1
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "AGListener",
          "transform": {
            "type": "aggregate",
            "group": [
              "group_id",
              "listener_id",
              "dns_name"
            ],
            "map": {
              "is_dhcp": "or",
              "network_subnet_ip": "count"
            }
          }
        },
        {
          "id": "AGConfiguration",
          "transform": {
            "type": "aggregate",
            "group": [
              "ag_id",
              "ag_name"
            ]
          }
        }
      ]
    },
    {
      "id": "AGReplicasDisconnected",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "tags": [
        "DefaultRuleset",
        "AlwaysOn"
      ],
      "displayName": "Availability replica connection state",
      "description": "An availability group supports a replicated environment for a discrete set of user databases, known as availability databases. Each set of availability databases is hosted by an availability replica. Two types of availability replicas exist: a single primary replica, which hosts the primary databases, and one to eight secondary replicas, each of which hosts a set of secondary databases and serves as potential failover targets for the availability group. The primary replica sends transaction log records of each primary database to every secondary database. This process - known as data synchronization - occurs at the database level. Every secondary replica caches the transaction log records and then applies them to its corresponding secondary database.",
      "message": "Resolve connection issue on availability replica '@{ag_replica_server}' in availability group '@{ag_name}'",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/availability-groups/windows/overview-of-always-on-availability-groups-sql-server",
      "condition": {
        "or": [
          {
            "not": "@is_on_primary_replica"
          },
          "@ag_replica_connected_state"
        ]
      },
      "probes": [
        "AGConfiguration"
      ]
    },
    {
      "id": "AGReplicasRecoveryHealth",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "tags": [
        "DefaultRuleset",
        "AlwaysOn"
      ],
      "displayName": "Availability replica recovery health",
      "description": "An availability group supports a replicated environment for a discrete set of user databases, known as availability databases. Each set of availability databases is hosted by an availability replica. Two types of availability replicas exist: a single primary replica, which hosts the primary databases, and one to eight secondary replicas, each of which hosts a set of secondary databases and serves as potential failover targets for the availability group. The primary replica sends transaction log records of each primary database to every secondary database. This process - known as data synchronization - occurs at the database level. Every secondary replica caches the transaction log records and then applies them to its corresponding secondary database.",
      "message": "Resolve recovery health state on availability replica '@{ag_replica_server}' in availability group '@{ag_name}'",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/availability-groups/windows/overview-of-always-on-availability-groups-sql-server",
      "condition": {
        "or": [
          {
            "not": "@is_ag_replica_local"
          },
          {
            "eq": [
              "@ag_replica_recovery_health",
              1
            ]
          }
        ]
      },
      "probes": [
        "AGConfiguration"
      ]
    },
    {
      "id": "AGReplicasSynchronized",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "tags": [
        "DefaultRuleset",
        "AlwaysOn"
      ],
      "displayName": "Availablity replica synchronization health",
      "description": "An availability group supports a replicated environment for a discrete set of user databases, known as availability databases. Each set of availability databases is hosted by an availability replica. Two types of availability replicas exist: a single primary replica, which hosts the primary databases, and one to eight secondary replicas, each of which hosts a set of secondary databases and serves as potential failover targets for the availability group. The primary replica sends transaction log records of each primary database to every secondary database. This process - known as data synchronization - occurs at the database level. Every secondary replica caches the transaction log records and then applies them to its corresponding secondary database.",
      "message": "Resolve synchronization issues on availability replica '@{ag_replica_server}' in availability group '@{ag_name}'",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/availability-groups/windows/overview-of-always-on-availability-groups-sql-server",
      "condition": {
        "or": [
          {
            "not": "@is_on_primary_replica"
          },
          {
            "eq": [
              "@ag_replica_synchronization_health",
              2
            ]
          }
        ]
      },
      "probes": [
        "AGConfiguration"
      ]
    },
    {
      "id": "AGTotalNumber",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "tags": [
        "DefaultRuleset",
        "AlwaysOn"
      ],
      "displayName": "Maximum number of Availability Groups",
      "description": "The actual number of databases and availability groups you can put on a computer (VM or physical) depends on the hardware and workload, but there is no enforced limit. Microsoft has tested up to 10 AGs and 100 DBs per physical machine. Signs of overloaded systems can include, but are not limited to, worker thread exhaustion, slow response times for availability group system views and DMVs, and/or stalled dispatcher system dumps.",
      "message": "Review the number of Availability Groups (@{ag_id}) currently hosted on the SQL Server instance",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/availability-groups/windows/prereqs-restrictions-recommendations-always-on-availability#PrerequisitesForAGs",
      "threshold": 10,
      "condition": {
        "le": [
          "@ag_id",
          "@threshold"
        ]
      },
      "probes": [
        {
          "id": "AGConfiguration",
          "transform": {
            "type": "aggregate",
            "map": {
              "ag_id": "count"
            }
          }
        }
      ]
    },
    {
      "id": "AllowUpdates",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer, ManagedInstance",
        "platform": [
          "Windows",
          "Linux"
        ],
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Performance",
        "Configuration"
      ],
      "displayName": "Non-default value for 'allow updates' option",
      "description": "The 'allow updates' option has no effect and will be removed in a future version of Microsoft SQL Server. Avoid using this feature in new development work, and plan to modify applications that currently use this feature.",
      "message": "Review non-default value @{allow_updates} for the 'allow updates' option as it has no effect and will be removed in a future version",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/allow-updates-server-configuration-option",
      "level": "Low",
      "condition": {
        "not": "@allow_updates"
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "AutoStartProcs",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "displayName": "Automated execution of stored procedures is enabled",
      "description": "Automated execution of stored procedures during the SQL Server startup may delay the availability of the SQL Server instance during the startup procedure. It also introduces the risk of execution of unauthorized code.",
      "message": "Disable automated execution of stored procedures: @{sp_name}",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/stored-procedures/execute-a-stored-procedure#execute-stored-procedures-automatically",
      "level": "Low",
      "tags": [
        "DefaultRuleset",
        "Configuration",
        "Security",
        "Performance"
      ],
      "condition": {
        "eq": [
          "@startup_stored_procedures",
          0
        ]
      },
      "probes": [
        "SysConfiguration",
        {
          "id": "StartupProcs",
          "transform": {
            "type": "aggregate",
            "map": {
              "sp_name": {
                "type": "join",
                "limit": 3
              }
            }
          }
        }
      ]
    },
    {
      "id": "AutoUpdateStatsAsync",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "displayName": "Option 'AUTO_UPDATE_STATISTICS_ASYNC' is enabled",
      "description": "The Query Optimizer could choose a suboptimal query plan if statistics are out-of-date when the query compiles. User database has AUTO_UPDATE_STATISTICS_ASYNC enabled on one or more user databases. ",
      "message": "Disable 'AUTO_UPDATE_STATISTICS_ASYNC' option",
      "helpLink": "https://docs.microsoft.com/sql/t-sql/statements/alter-database-transact-sql-set-options#auto_update_statistics_async",
      "level": "Information",
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "condition": {
        "not": "@is_auto_update_stats_async_on"
      },
      "probes": [
        "DatabaseConfiguration"
      ]
    },
    {
      "id": "AzDataDiskCache",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": "Windows",
        "engineEdition": "SqlServer",
        "name": {
          "not": "tempdb"
        },
        "version": "[11.0,)",
        "machineType": "AzureVm"
      },
      "tags": [
        "DefaultRuleset",
        "Performance",
        "DBFileConfiguration",
        "DBConfiguration"
      ],
      "displayName": "Azure disk caching for data files",
      "description": "Uncached IOPS and throughput plus Cached IOPS and throughput will yield the total possible performance available from the virtual machine within the VMs limits.",
      "message": "Set caching to 'ReadOnly' for disk '@{name}' (volume @{volume_mount_point}; LUN @{lun}) as it is used for storing data files. Current setting: '@{caching}'",
      "helpLink": "https://docs.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-storage#data-file-caching-policies",
      "level": "High",
      "condition": {
        "or": [
          "@isBoot",
          "@isTemp",
          {
            "eq": [
              "@caching",
              "ReadOnly"
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "DatabaseMasterFiles",
          "params": {
            "type": 0,
            "is_percent_growth": null
          },
          "transform": {
            "type": "aggregate",
            "group": "volume_id",
            "map": {
              "volume_mount_point": {
                "type": "join",
                "comparison": "OrdinalIgnoreCase"
              }
            }
          }
        },
        {
          "id": "AzStorage",
          "params": {
            "path": "@DatabaseMasterFiles::volume_id"
          }
        },
        {
          "id": "AzDiskMetadata",
          "params": {
            "lun": "@AzStorage::lun"
          }
        }
      ]
    },
    {
      "id": "AzDataDiskStriping",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": "Windows",
        "engineEdition": "SqlServer",
        "version": "[11.0,)",
        "machineType": "AzureVm"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration",
        "Performance"
      ],
      "displayName": "Azure data disk striping",
      "description": "There are throughput and bandwidth limits at the data disk level. Applications that consume resources beyond these limits will be throttled. For more throughput and bandwidth, you can add additional data disks and use disk striping. You can use Storage Spaces inside a virtual machine to combine multiple data disks, creating more storage capacity or performance than is available from a single data disk.",
      "message": "Consider using data disk striping to increase I/O bandwidth of volume @{volume_mount_point}",
      "helpLink": "https://docs.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-storage#disk-striping",
      "level": "Information",
      "condition": {
        "or": [
          {
            "not": "@isData"
          },
          "@isPoolDisk"
        ]
      },
      "probes": [
        {
          "id": "DatabaseMasterFiles",
          "alias": "db_files",
          "params": {
            "dbId": null,
            "type": null
          },
          "transform": {
            "type": "aggregate",
            "group": "volume_id",
            "map": {
              "volume_mount_point": {
                "type": "join",
                "comparison": "OrdinalIgnoreCase"
              }
            }
          }
        },
        {
          "id": "AzStorage",
          "params": {
            "path": "@db_files::volume_id"
          },
          "transform": {
            "type": "aggregate",
            "group": "isData",
            "map": {
              "isPoolDisk": "and"
            }
          }
        }
      ]
    },
    {
      "id": "AzDataOnDataDisks",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": "Windows",
        "engineEdition": "SqlServer",
        "name": {
          "not": "tempdb"
        },
        "version": "[11.0,)",
        "machineType": "AzureVm"
      },
      "tags": [
        "DefaultRuleset",
        "DBFileConfiguration",
        "DBConfiguration"
      ],
      "displayName": "Data files on Azure data disks",
      "description": "Azure data disks can be configured for optimal data security and performance. ",
      "message": "Move data files from @{volume_mount_point} to Premium SSD data disk(s)",
      "helpLink": "https://docs.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist",
      "level": "Medium",
      "condition": {
        "and": [
          {
            "not": "@isBoot"
          },
          {
            "not": "@isTemp"
          }
        ]
      },
      "probes": [
        {
          "id": "DatabaseMasterFiles",
          "params": {
            "type": 0,
            "is_percent_growth": null
          },
          "transform": {
            "type": "aggregate",
            "group": "volume_id",
            "map": {
              "volume_mount_point": {
                "type": "join",
                "comparison": "OrdinalIgnoreCase"
              }
            }
          }
        },
        {
          "id": "AzStorage",
          "params": {
            "path": "@DatabaseMasterFiles::volume_id"
          }
        }
      ]
    },
    {
      "id": "AzDataOnDataDisks",
      "itemType": "override",
      "targetFilter": {
        "name": [
          "master",
          "model",
          "msdb"
        ]
      },
      "level": "Low"
    },
    {
      "id": "AzDbDefaultLocation",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": "Windows",
        "engineEdition": "SqlServer",
        "version": "[11.0,)",
        "machineType": "AzureVm"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration",
        "Performance"
      ],
      "displayName": "Database default locations",
      "description": "Default database file location setting makes new data and transaction log files placed on drives configured for this specific workload.",
      "message": "Configure default @{setting_name} file location",
      "helpLink": "https://docs.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist",
      "level": "Medium",
      "condition": "@setting_value",
      "probes": [
        {
          "id": "DbFilesDefaultLocation",
          "transform": [
            {
              "type": "expandData",
              "keyColumn": "setting_name",
              "valueColumn": "setting_value",
              "columns": [
                "DefaultData",
                "DefaultLog",
                "BackupDirectory"
              ]
            },
            {
              "type": "toString",
              "map": {
                "setting_name": {
                  "data": "DefaultData",
                  "transaction log": "DefaultLog",
                  "backup": "BackupDirectory"
                }
              }
            }
          ]
        }
      ]
    },
    {
      "id": "AzDiskColumnCount",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": "Windows",
        "engineEdition": "SqlServer",
        "version": "[11.0,)",
        "machineType": "AzureVm"
      },
      "tags": [
        "DefaultRuleset",
        "DBFileConfiguration",
        "DBConfiguration",
        "Performance"
      ],
      "displayName": "Storage spaces disk column count",
      "description": "Increasing virtual disk column count improves the disk's performance. The number of disks in the pool is the maximum available number of columns.",
      "message": "Use all @{poolDiskCount} physical disks available in your storage pool for virtual disk (@{volume_mount_point}), currently used: @{columnCount} physical disk(s)",
      "helpLink": "https://docs.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist",
      "level": "Medium",
      "condition": {
        "or": [
          {
            "not": "@isPoolDisk"
          },
          {
            "eq": [
              "@poolDiskCount",
              "@columnCount"
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "DatabaseMasterFiles",
          "params": {
            "type": null,
            "dbId": null
          },
          "transform": {
            "type": "aggregate",
            "group": "volume_id",
            "map": {
              "volume_mount_point": {
                "type": "join",
                "comparison": "OrdinalIgnoreCase"
              }
            }
          }
        },
        {
          "id": "AzStorage",
          "params": {
            "path": "@DatabaseMasterFiles::volume_id"
          },
          "transform": {
            "type": "aggregate",
            "map": {
              "poolDiskCount": "max",
              "columnCount": "max",
              "isPoolDisk": "or"
            }
          }
        }
      ]
    },
    {
      "id": "AzErrorLogLocation",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": "Windows",
        "engineEdition": "SqlServer",
        "version": "[11.0,)",
        "machineType": "AzureVm"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration",
        "Performance"
      ],
      "displayName": "Error log and default trace files on Azure data disk",
      "description": "Storing error log and default trace files on data disk improves performance.",
      "message": "Move error log and default trace files to data disk",
      "helpLink": "https://docs.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist",
      "level": "Medium",
      "condition": "@isData",
      "probes": [
        "ServerProperties",
        {
          "id": "AzStorage",
          "params": {
            "path": "@ServerProperties::error_log_file_path"
          }
        }
      ]
    },
    {
      "id": "AzPremSsdDataFiles",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "name": {
          "not": "tempDb"
        },
        "platform": "Windows",
        "engineEdition": "SqlServer",
        "version": "[11.0,)",
        "machineType": "AzureVm"
      },
      "tags": [
        "DefaultRuleset",
        "Performance",
        "DBFileConfiguration",
        "DBConfiguration"
      ],
      "displayName": "Use premium SSDs for SQL Server data files",
      "description": "Standard HDDs and SSDs have varying latencies and bandwidth and are only recommended for dev/test workloads. Production workloads should use premium SSDs.",
      "message": "Move data files from disk '@{name}' (volume @{volume_mount_point}; LUN @{lun}) to Premium SSD disk",
      "helpLink": "https://docs.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-storage",
      "level": "High",
      "condition": {
        "or": [
          {
            "not": "@isData"
          },
          {
            "imatch": [
              "@storageAccountType",
              "^Premium_\\w+"
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "DatabaseMasterFiles",
          "params": {
            "type": 0,
            "is_percent_growth": null
          },
          "transform": {
            "type": "aggregate",
            "group": "volume_id",
            "map": {
              "volume_mount_point": {
                "type": "join",
                "comparison": "OrdinalIgnoreCase"
              }
            }
          }
        },
        {
          "id": "AzStorage",
          "params": {
            "path": "@DatabaseMasterFiles::volume_id"
          }
        },
        {
          "id": "AzDiskMetadata",
          "params": {
            "lun": "@AzStorage::lun"
          }
        }
      ]
    },
    {
      "id": "AzPremSsdDataFiles",
      "itemType": "override",
      "targetFilter": {
        "name": [
          "master",
          "model",
          "msdb"
        ]
      },
      "level": "Low"
    },
    {
      "id": "AzTempDbFileLocation",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": "Windows",
        "engineEdition": "SqlServer",
        "name": "tempdb",
        "version": "[11.0,)",
        "machineType": "AzureVm"
      },
      "tags": [
        "DefaultRuleset",
        "Performance",
        "DBFileConfiguration",
        "DBConfiguration"
      ],
      "displayName": "Tempdb files on Azure temp drive",
      "description": "Storing tempdb files on a local ephemeral SSD improves the performance of workloads that use temporary objects heavily (e.g. queries handling large recordsets, index rebuilds, row versioning isolation levels, temp tables, and triggers).",
      "message": "Move tempdb files from @{volume_mount_point} to the local ephemeral SSD (temp disk)",
      "helpLink": "https://docs.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist",
      "level": "High",
      "condition": "@isTemp",
      "probes": [
        {
          "id": "DatabaseMasterFiles",
          "params": {
            "type": null,
            "is_percent_growth": null
          },
          "transform": {
            "type": "aggregate",
            "group": "volume_id",
            "map": {
              "volume_mount_point": {
                "type": "join",
                "comparison": "OrdinalIgnoreCase"
              }
            }
          }
        },
        {
          "id": "AzStorage",
          "params": {
            "path": "@DatabaseMasterFiles::volume_id"
          },
          "transform": {
            "type": "aggregate",
            "map": {
              "isTemp": "or"
            }
          }
        }
      ]
    },
    {
      "id": "AzTranLogDiskCache",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": "Windows",
        "engineEdition": "SqlServer",
        "name": {
          "not": "tempdb"
        },
        "version": "[11.0,)",
        "machineType": "AzureVm"
      },
      "tags": [
        "DefaultRuleset",
        "Performance",
        "DBFileConfiguration",
        "DBConfiguration"
      ],
      "displayName": "Azure disk caching for transaction logs",
      "description": "There is no performance benefit to enabling caching for the Transaction log disk, and in fact having either Read-only or Read/Write caching enabled on the log drive can decrease the amount of cache available for reads on the data drive",
      "message": "Set caching to 'None' for disk '@{name}' (volume @{volume_mount_point}; LUN @{lun}) as it is used for storing transaction log files. Current setting: '@{caching}'",
      "helpLink": "https://docs.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-storage#data-file-caching-policies",
      "level": "High",
      "condition": {
        "or": [
          "@isBoot",
          "@isTemp",
          {
            "eq": [
              "@caching",
              "None"
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "DatabaseMasterFiles",
          "params": {
            "type": 1,
            "is_percent_growth": null
          },
          "transform": {
            "type": "aggregate",
            "group": "volume_id",
            "map": {
              "volume_mount_point": {
                "type": "join",
                "comparison": "OrdinalIgnoreCase"
              }
            }
          }
        },
        {
          "id": "AzStorage",
          "params": {
            "path": "@DatabaseMasterFiles::volume_id"
          }
        },
        {
          "id": "AzDiskMetadata",
          "params": {
            "lun": "@AzStorage::lun"
          }
        }
      ]
    },
    {
      "id": "BackupCompression",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "Standard, Enterprise, ManagedInstance",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "displayName": "Option 'backup compression default' is disabled",
      "description": "The 'backup compression default' option determines whether the server instance creates compressed backups by default. Because a compressed backup is smaller than an uncompressed backup of the same data, compressing a backup typically requires less device I/O and therefore usually increases backup speed significantly.",
      "message": "Enable 'backup compression default' option",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/view-or-configure-the-backup-compression-default-server-configuration-option",
      "level": "Information",
      "tags": [
        "DefaultRuleset",
        "Configuration",
        "Performance",
        "Backup"
      ],
      "condition": "@backup_compression",
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "BackupTables",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "displayName": "Too many rows in backup or restore history tables",
      "description": "The upgrade process of a SQL Server instance may appear to hang if the number of rows in the following backup and restore system tables is very high: 'backupfile', 'backupmediafamily', 'backupmediaset', 'backupset', 'restorefile', 'restorefilegroup', 'restorehistory'. This is due to the fact that it would take longer to modify the backup and restore system tables in MSDB database.",
      "message": "Reduce number of rows in table '@{table_name}' to less than @{threshold}",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/system-stored-procedures/sp-delete-backuphistory-transact-sql",
      "level": "Information",
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "threshold": 10000,
      "condition": {
        "lt": [
          "@row_count",
          "@threshold"
        ]
      },
      "probes": [
        "BackupTables"
      ]
    },
    {
      "id": "C2AuditMode",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "displayName": "Non-default value for 'c2 audit mode' option",
      "description": "When enabled, the 'c2 audit mode' option collects all attempts to access statements and objects. Enabling this option triggers a significant amount of data collection over a short period of time for even moderately active Microsoft SQL Server instances.",
      "message": "Review non-default value @{c2_audit_mode} for the 'c2 audit mode' option as it will be removed in a future version",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/c2-audit-mode-server-configuration-option",
      "level": "Information",
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "condition": {
        "not": "@c2_audit_mode"
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "CCCompliance",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "Enterprise, ManagedInstance",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "displayName": "Non-default value for 'common criteria compliance enabled' option",
      "description": "SQL Server is being developed to achieve not only the best performance results but also to be the most secure database system ever released. Microsoft has the commitment to be compliant with the most important standards. The most recent SQL Server Editions are getting these recognitions, including the Common Criteria certification. Part of that commitment is the independent third-party evaluation of our products and in using the Common Criteria (CC, ISO15408) as a proven and accepted process to ensure compliance with Common Evaluation Methodologies.",
      "message": "Review non-default value @{common_criteria_compliance_enabled} for the 'common criteria compliance enabled' option",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/common-criteria-compliance-enabled-server-configuration-option",
      "level": "Information",
      "tags": [
        "DefaultRuleset",
        "Performance",
        "Configuration"
      ],
      "condition": {
        "not": "@common_criteria_compliance_enabled"
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "ClrEnabled",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "displayName": "Non-default value for 'clr enabled' option",
      "description": "This option determines whether user assemblies and CLR functionality or objects can be used on a Microsoft SQL Server instance. Disable this option if you do not plan to use CLR database objects on the SQL Server instance.",
      "message": "Review non-default value @{clr_enabled} for the 'clr enabled' option",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/clr-integration/clr-integration-enabling",
      "level": "Information",
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "condition": {
        "not": "@clr_enabled"
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "ColumnstoreLargePageModel",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "displayName": "Columnstore indexes with large page memory model",
      "description": "Interoperability of Columnstore indexes with large page memory model may cause severe performance issues, access violations, insufficient system memory errors, or a non-yielding Scheduler errors.",
      "message": "Disable trace flag 834 when using Columnstore indexes",
      "helpLink": "https://docs.microsoft.com/sql/t-sql/database-console-commands/dbcc-traceon-trace-flags-transact-sql#tf834",
      "level": "Medium",
      "condition": {
        "or": [
          {
            "not": "@ColumnStoreIndexCount"
          },
          {
            "not": {
              "in": [
                834,
                "@TraceFlag"
              ]
            }
          }
        ]
      },
      "probes": [
        "EnabledGlobalTraceFlags",
        {
          "id": "ServerDatabasesProperties",
          "transform": {
            "type": "aggregate",
            "map": {
              "ColumnStoreIndexCount": "sum"
            }
          }
        }
      ]
    },
    {
      "id": "CompareRunConfigured",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer, ManagedInstance",
        "platform": [
          "Windows",
          "Linux"
        ],
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Performance",
        "Configuration"
      ],
      "displayName": "Run and config values are different",
      "description": "SQL Server instance configuration settings have two values: a run value which is the currently active value and a config value which is the value that was last configured. Generally, these two values are the same, but if a setting has been changed but the change is not yet applied, confusion can arise for administrators and, in extreme cases, the system can become unstable.",
      "message": "Use 'RECONFIGURE' after 'sp_configure' to update run value. Config value is different from run value in: @{unsaved_option}",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/system-catalog-views/sys-configurations-transact-sql",
      "level": "Information",
      "condition": {
        "not": "@unsaved_option"
      },
      "probes": [
        {
          "id": "DifferenceConfigRunValues",
          "transform": {
            "type": "aggregate",
            "map": {
              "unsaved_option": "join"
            }
          }
        }
      ]
    },
    {
      "id": "CompilationsPerSec",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Performance"
      ],
      "displayName": "High SQL compilations frequency",
      "description": "SQL Server will try to reuse compiled plans from the plan cache. The reuse of a plan means that a new plan does not need to be optimized and compiled and results in greater efficiency. A high proportion of compilations indicates many ad-hoc queries and will result in inefficiency. Use sp_executesql for dynamic SQL statements. In addition, investigate the possibility of changing prepared SQL and ad-hoc SQL statements to stored procedures. The FORCED PARAMETERIZATION option can be set at the database level. This makes SQL Server become much more aggressive in deciding which queries to auto-parameterize, but can potentially introduce parameter-sensitivity problems (e.g. parameter sniffing).",
      "message": "Investigate the use of stored procedures, database options and server options to reduce the proportion of plan compilations to batch requests per second (@{sql_compilations_sec:0.##} / @{batch_request_sec:0.##})",
      "helpLink": "https://learn.microsoft.com/sql/relational-databases/performance-monitor/sql-server-sql-statistics-object",
      "threshold": 0.1,
      "condition": {
        "or": [
          {
            "le": [
              "@batch_request_sec",
              100
            ]
          },
          {
            "le": [
              "@sql_compilations_sec",
              {
                "mul": [
                  "@batch_request_sec",
                  "@threshold"
                ]
              }
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "BasicPerformance",
          "alias": "perfA",
          "transform": {
            "type": "performance",
            "counters": {
              "batch_request_sec": "rate"
            }
          }
        },
        {
          "id": "BasicPerformance",
          "alias": "perfB",
          "transform": {
            "type": "performance",
            "counters": {
              "sql_compilations_sec": "rate"
            }
          }
        }
      ]
    },
    {
      "id": "ContainedDbAuthentication",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "displayName": "Non-default value for 'contained database authentication' option",
      "description": "When contained databases are enabled, database users other than members of the 'sysadmin' and 'securityadmin' fixed server roles can grant access to the instance of SQL Server.",
      "message": "Review non-default value @{contained_database_authentication} for the 'contained database authentication' option",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/contained-database-authentication-server-configuration-option",
      "level": "Information",
      "tags": [
        "DefaultRuleset",
        "Configuration",
        "Security"
      ],
      "condition": {
        "not": "@contained_database_authentication"
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "CursorRequestsPerSec",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Performance"
      ],
      "displayName": "High cursor requests frequency",
      "description": "Cursor Requests/sec is the number of cursor requests received by SQL Server. More than 20 cursor requests per 100 Batch Requests/sec on an average may indicate that the applications are designed to use cursors extensively instead of set-based operations. Look at the Cursor Requests/sec counter to get a general overview for how many cursors are being used on the system. Systems that have high CPU utilization because of small fetch sizes typically have hundreds of cursor requests per second. Redesign queries and applications to use set-based operations rather than cursors where possible.",
      "message": "Determine if cursors are the most appropriate means to accomplish the processing or whether a set-based operation, which is generally more efficient, is possible, Cursor Requests/sec (@{cursor_requests_sec:0.##}) per Batch requests/sec (@{batch_request_sec:0.##})  is greater than @{threshold:P0}",
      "helpLink": "https://techcommunity.microsoft.com/t5/sql-server-blog/increase-your-sql-server-performance-by-replacing-cursors-with/ba-p/383359",
      "threshold": 0.2,
      "condition": {
        "or": [
          {
            "le": [
              "@batch_request_sec",
              100
            ]
          },
          {
            "le": [
              "@cursor_requests_sec",
              {
                "mul": [
                  "@batch_request_sec",
                  "@threshold"
                ]
              }
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "BasicPerformance",
          "alias": "perfA",
          "transform": {
            "type": "performance",
            "counters": {
              "batch_request_sec": "rate"
            }
          }
        },
        {
          "id": "BasicPerformance",
          "alias": "perfB",
          "transform": {
            "type": "performance",
            "counters": {
              "cursor_requests_sec": {
                "type": "rate",
                "instance": "_Total"
              }
            }
          }
        }
      ]
    },
    {
      "id": "CursorThreshold",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "displayName": "Non-default value for 'cursor threshold' option",
      "description": "When cursors generate keysets for a result set, the query optimizer estimates how many rows the keyset will contain. If the number is larger than this threshold, the keyset is generated asynchronously. The default value of -1 results in SQL Server generating all keysets asynchronously. If you set the value too low, overall performance may be impacted because small results sets are better built synchronously.",
      "message": "Review non-default value @{cursor_threshold} for the 'cursor threshold' option",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/configure-the-cursor-threshold-server-configuration-option",
      "level": "Information",
      "tags": [
        "DefaultRuleset",
        "Performance",
        "Configuration"
      ],
      "condition": {
        "eq": [
          "@cursor_threshold",
          -1
        ]
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "DatabaseMailXPs",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "displayName": "Non-default value for 'Database Mail XPs' option",
      "description": "Configuring the 'Database Mail XPs' option to 1 enables Database Mail on the instance of SQL Server. This configuration is off by default to reduce the attack surface area of SQL Server. Do not enable this functionality unless you intend to use Database Mail.",
      "message": "Review non-default value @{Database_Mail_XPs} for the 'Database Mail XPs' option",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/database-mail-xps-server-configuration-option",
      "level": "Information",
      "tags": [
        "DefaultRuleset",
        "Configuration",
        "Security"
      ],
      "condition": {
        "not": "@Database_Mail_XPs"
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "DbBackupMedia",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": "Windows",
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Backup",
        "Performance",
        "Configuration",
        "DBConfiguration",
        "DBFileConfiguration"
      ],
      "displayName": "Backup files on a separate physical location",
      "description": "It is recommended that database backups are placed on a separate physical location or device from the database files. When your physical drive that stores your databases malfunctions or crashes, recoverability depends on the ability to access the separate drive or remote device that stored the backups in order to perform a restore. Also, putting the database and backup files on the separate devices optimizes the I/O performance for both the production use of the database and the writing of backups.",
      "message": "Place backup file @{physical_device_name} on a separate physical location from the database files",
      "helpLink": "https://learn.microsoft.com/sql/relational-databases/backup-restore/back-up-and-restore-of-sql-server-databases#best-practice-recommendations",
      "level": "Low",
      "file_type": [
        2,
        102
      ],
      "condition": {
        "or": [
          {
            "not": {
              "intersect": [
                "@device_type",
                "@file_type"
              ]
            }
          },
          {
            "not": {
              "istartswith": [
                "@physical_device_name",
                "@volume_mount_point"
              ]
            }
          }
        ]
      },
      "probes": [
        {
          "id": "DatabaseMasterFiles",
          "params": {
            "type": null,
            "is_percent_growth": null
          },
          "transform": {
            "type": "aggregate",
            "group": "volume_mount_point"
          }
        },
        {
          "id": "DatabaseBackupsMedia",
          "transform": {
            "type": "aggregate",
            "group": "physical_device_name",
            "map": {
              "device_type": "array"
            }
          }
        }
      ]
    },
    {
      "id": "DbCompression",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "name": {
          "not": [
            "master",
            "model",
            "msdb",
            "tempdb"
          ]
        },
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Uncompressed database tables and indexes",
      "description": "The compression capability at either the row or page level provides an opportunity to save disk space and improve performance, with the tradeoff of requiring a bit more CPU to compress and decompress the data, but requiring less memory and disk access improving performance in many workloads. The data pages are kept compressed when they are uploaded to memory. This check fires if a relatively large amount of space is on indexes without compression (for example, more than 10GB).",
      "message": "Turn on compression for these @{ObjectType}: @{ObjectName}, total space used by these objects: @{TotalSpaceMB:N2} MB",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/sql-server-index-design-guide",
      "level": "Information",
      "tags": [
        "DefaultRuleset",
        "Configuration",
        "Performance"
      ],
      "topObjectsForCompression": 10,
      "threshold": 1280000,
      "condition": {
        "lt": [
          "@UncompressedPages",
          "@threshold"
        ]
      },
      "probes": [
        {
          "id": "SpaceUsage",
          "params": {
            "type": "U"
          }
        },
        {
          "id": "TopUncompressedTables",
          "params": {
            "topN": "@topObjectsForCompression"
          },
          "transform": [
            {
              "type": "aggregate",
              "group": "ObjectType",
              "map": {
                "ObjectName": "join",
                "TotalIndexPages": "sum"
              }
            },
            {
              "type": "toString",
              "map": {
                "ObjectType": {
                  "tables": 0,
                  "indexes": 1
                }
              }
            }
          ]
        }
      ],
      "locals": {
        "UncompressedPages": {
          "sub": [
            "@TotalPages",
            "@CompressedPages"
          ]
        },
        "TotalSpaceMB": {
          "div": [
            "@TotalIndexPages",
            128
          ]
        }
      }
    },
    {
      "id": "DbMirroring",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": "Windows",
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration",
        "Deprecated"
      ],
      "displayName": "Database mirroring",
      "description": "Database mirroring is a solution for increasing the availability of a SQL Server database. Mirroring is implemented on a per-database basis and works only with databases that use the full recovery model. Database mirroring is deprecated and will be removed in a future version of SQL Server. Avoid using this feature in new development work, and plan to modify applications that currently use this feature. Use Always On availability groups instead.",
      "message": "Plan to modify applications that currently use database mirroring as it is deprecated and will be removed in a future version",
      "helpLink": "https://learn.microsoft.com/sql/database-engine/database-mirroring/database-mirroring-sql-server",
      "level": "Low",
      "probes": [
        {
          "id": "DatabaseMirroring",
          "transform": {
            "type": "aggregate",
            "map": {
              "database_id": "count"
            }
          }
        }
      ]
    },
    {
      "id": "DbRecoveryModel",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "name": {
          "not": [
            "model",
            "tempdb",
            "msdb",
            "master"
          ]
        },
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Recovery",
        "DatabaseConfiguration"
      ],
      "displayName": "Databases with 'SIMPLE' recovery model",
      "description": "A database with the 'SIMPLE' recovery model does not support log backups. As a result, when you need to restore such a database, all the transactions since the last database backup or differential backup will be lost. Review databases that have the 'SIMPLE' recovery model. If the maximum amount of data loss involved is not acceptable, change the recovery model to 'FULL' or 'BULK_LOGGED' and schedule frequent log backups.",
      "message": "Change recovery model to 'FULL' or 'BULK_LOGGED'",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/backup-restore/recovery-models-sql-server",
      "level": "Medium",
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "condition": {
        "ne": [
          "@recovery_model",
          3
        ]
      },
      "probes": [
        "DatabaseConfiguration"
      ]
    },
    {
      "id": "DbSpaceAvailable",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "displayName": "Low free space in data files",
      "description": "Average available space in data files is less than the threshold.",
      "message": "Increase space for data files. Currently @{spaceAvailableRel:P0} is available. Threshold is set to @{threshold:P0}. Total size of data files: @{totalMB:N2} MB. Free space: @{freeMB:N2} MB",
      "helpLink": "https://docs.microsoft.com/troubleshoot/sql/admin/considerations-autogrow-autoshrink#why-do-i-have-to-worry-about-disk-space-if-size-settings-are-automatically-controlled",
      "level": "Medium",
      "tags": [
        "DefaultRuleset",
        "Configuration",
        "DBFileConfiguration"
      ],
      "condition": {
        "gt": [
          "@spaceAvailableRel",
          "@threshold"
        ]
      },
      "threshold": 0.25,
      "probes": [
        {
          "id": "DatabaseMasterFiles",
          "params": {
            "type": 0,
            "is_percent_growth": null
          },
          "transform": {
            "type": "aggregate",
            "map": {
              "size": "sum",
              "spaceUsed": "sum"
            }
          }
        }
      ],
      "locals": {
        "totalMB": {
          "div": [
            "@size",
            128
          ]
        },
        "freeMB": {
          "div": [
            {
              "sub": [
                "@size",
                "@spaceUsed"
              ]
            },
            128
          ]
        },
        "spaceAvailableRel": {
          "div": [
            {
              "sub": [
                "@size",
                "@spaceUsed"
              ]
            },
            "@size"
          ]
        }
      }
    },
    {
      "id": "DbStandby",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "displayName": "STANDBY mode is enabled",
      "description": "A database in STANDBY mode will be online as READ ONLY, WITH RESTORE LOG allowed. If recovery is not complete, then the availability of the database might be affected. Usually log shipped secondary databases are configured to be in STANDBY mode.",
      "message": "Check database availability. A database is in STANDBY mode",
      "helpLink": "https://docs.microsoft.com/sql/t-sql/statements/restore-statements-arguments-transact-sql#with-options",
      "level": "Information",
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "condition": {
        "not": "@is_in_standby"
      },
      "probes": [
        "DatabaseConfiguration"
      ]
    },
    {
      "id": "DbState",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "displayName": "Database with unavailable state",
      "description": "Database unavailability may affect expected application behavior due to the impossibility of establishing user connections. The issue occurs when a database is in any of the following states: 'RECOVERY_PENDING', 'RECOVERING', 'SUSPECT', or 'RESTORING'.",
      "message": "Check '@{DbName}' database availability. Current database state is: @{DbStateDesc}",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/databases/database-states",
      "level": "Low",
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "condition": {
        "or": [
          {
            "ne": [
              "@source_database_id",
              null
            ]
          },
          {
            "not": {
              "in": [
                "@DbState",
                "@unavailableStates"
              ]
            }
          }
        ]
      },
      "unavailableStates": [
        1,
        2,
        3,
        4
      ],
      "probes": [
        "DatabasesState"
      ]
    },
    {
      "id": "DeadlockFrequency",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Performance"
      ],
      "displayName": "High deadlock frequency",
      "description": "One or more SQL Server instances report a high frequency of deadlocked transactions. This can result in blocking, reduced concurrency, and degraded performance. Get more details on the processes that are causing deadlock between each other. To view deadlock information, the Database Engine provides monitoring tools in the form of Extended Event Sessions with the Deadlock Graph event or the trace flags 1204 or 1222 which writes more detailed information to the SQL Server Error log. Once you have identified the problematic queries you need to optimize the code, indexes, order of operations and isolation level used and required by the process.",
      "message": "Investigate a high frequency of deadlocked transactions (@{number_of_deadlocks_sec:0.##})",
      "helpLink": "https://learn.microsoft.com/sql/relational-databases/sql-server-transaction-locking-and-row-versioning-guide?#deadlocks",
      "condition": {
        "not": "@number_of_deadlocks_sec"
      },
      "probes": [
        {
          "id": "BasicPerformance",
          "transform": {
            "type": "performance",
            "counters": {
              "number_of_deadlocks_sec": {
                "type": "rate",
                "instance": "_Total"
              }
            }
          }
        }
      ]
    },
    {
      "id": "DisallowResultsTriggers",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer, ManagedInstance",
        "platform": [
          "Windows",
          "Linux"
        ],
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "displayName": "Option 'disallow results from triggers' is disabled",
      "description": "Use the 'disallow results from triggers' option to control whether triggers return result sets. Triggers that return result sets may cause unexpected behavior in applications that are not designed to work with them.",
      "message": "Enable 'disallow results from triggers' option as the ability to return result sets from triggers will be removed in a future version",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/disallow-results-from-triggers-server-configuration-option",
      "level": "Information",
      "condition": "@disallow_results_from_triggers",
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "DomainController",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": "Windows",
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration",
        "Security"
      ],
      "displayName": "SQL Server on a domain controller",
      "description": "For security reasons, it is strongly not recommend installing SQL Server on a domain controller.",
      "message": "SQL Server is installed on a domain controller. Consider migrating SQL Server to a dedicated machine",
      "helpLink": "https://learn.microsoft.com/sql/sql-server/install/hardware-and-software-requirements-for-installing-sql-server#DC_support",
      "level": "Medium",
      "dc_roles": [
        4,
        5
      ],
      "condition": {
        "not": {
          "in": [
            "@Output.DomainRole",
            "@dc_roles"
          ]
        }
      },
      "probes": [
        "ComputerSystem"
      ]
    },
    {
      "id": "EKMProvider",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "Standard, Enterprise, ManagedInstance",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "displayName": "Non-default value for 'EKM provider enabled' option",
      "description": "The 'EKM provider enabled' option controls Extensible Key Management device support in SQL Server. SQL Server provides data encryption capabilities together with Extensible Key Management (EKM), using the Microsoft Cryptographic API (MSCAPI) provider for encryption and key generation. Encryption keys for data and key encryption are created in transient key containers, and they must be exported from a provider before they are stored in the database. This approach enables key management that includes an encryption key hierarchy and key backup, to be handled by SQL Server.",
      "message": "Review non-default value @{EKM_provider_enabled} for the 'EKM provider enabled' option",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/ekm-provider-enabled-server-configuration-option",
      "level": "Information",
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "condition": {
        "not": "@EKM_provider_enabled"
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "EKMProvider",
      "itemType": "override",
      "targetFilter": {
        "engineEdition": "Standard",
        "version": "[11.0, 15.0)"
      },
      "enabled": false
    },
    {
      "id": "ErrorLog109",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 109",
      "description": "There are more columns in the INSERT statement than values specified in the VALUES clause. The number of values in the VALUES clause must match the number of columns specified in the INSERT statement.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/database-engine-events-and-errors",
      "level": "Medium",
      "error": 109,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog211",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 211",
      "description": "Possible schema corruption.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/database-engine-events-and-errors",
      "level": "High",
      "error": 211,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog232",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 232",
      "description": "Arithmetic overflow error.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/database-engine-events-and-errors",
      "level": "Information",
      "error": 232,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog566",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 566",
      "description": "An error occurred while writing an audit trace.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/database-engine-events-and-errors",
      "level": "Medium",
      "error": 566,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog602",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 602",
      "description": "Could not find an entry for table or index. This error can occur if a stored procedure references a dropped table, or metadata is corrupted.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/database-engine-events-and-errors",
      "level": "Information",
      "error": 602,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog603",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 603",
      "description": "Could not find an entry for table or index. This error can occur if a stored procedure references a dropped table, or metadata is corrupted.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/database-engine-events-and-errors",
      "level": "Information",
      "error": 603,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog605",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 605",
      "description": "Attempt to fetch a logical page failed. This error generally signifies page or allocation corruption, and often is caused by hardware or disk device driver failure.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-605-database-engine-error",
      "level": "Medium",
      "error": 605,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog608",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 608",
      "description": "No catalog entry found for partition. The metadata is inconsistent.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/database-engine-events-and-errors",
      "level": "Medium",
      "error": 608,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog701",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 701",
      "description": "There is insufficient system memory in resource pool to run this query. Insufficient memory can be caused by a number of factors that include operating system settings, physical memory availability, other components use memory inside SQL Server, or memory limits on the current workload.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-701-database-engine-error",
      "level": "Information",
      "error": 701,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog802",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 802",
      "description": "There is insufficient memory available in the buffer pool. This is caused when the buffer pool is full and the buffer pool cannot grow any larger.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-802-database-engine-error",
      "level": "Medium",
      "error": 802,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog823",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 823",
      "description": "The operating system returned error to SQL Server. This error usually indicates that there is a problem with underlying storage system or the hardware or a driver that is in the path of the I/O request.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-823-database-engine-error",
      "level": "Medium",
      "error": 823,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog824",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 824",
      "description": "SQL Server detected a logical consistency-based I/O error. This error usually indicates that there is a problem with underlying storage system or the hardware or a driver that is in the path of the I/O request.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-824-database-engine-error",
      "level": "Medium",
      "error": 824,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog825",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 825",
      "description": "A read of a file succeeded after failing one or more times. This error indicates that the read operation had to be reissued at least one time, and indicates a major problem with the disk hardware.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-825-database-engine-error",
      "level": "Medium",
      "error": 825,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog829",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 829",
      "description": "A page is marked as RestorePending, which may indicate disk corruption. To recover from this state, perform a restore.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/database-engine-events-and-errors",
      "level": "High",
      "error": 829,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog832",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 832",
      "description": "A page that should have been constant has changed. This usually indicates a memory failure or other hardware or operating system corruption. An external factor has caused a database page to be modified outside the normal SQL Server engine code used to change database pages.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-832-database-engine-error",
      "level": "Medium",
      "error": 832,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog833",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 833",
      "description": "SQL Server has encountered occurrences of I/O requests taking a long time to complete. This error indicates a problem with the I/O subsystem. This problem can be caused by operating system performance issues, hardware errors, firmware errors, device driver problems, or filter driver intervention in the I/O process or storage path of database files.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-833-database-engine-error",
      "level": "Information",
      "error": 833,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog844",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 844",
      "description": "A timeout occurred while waiting for buffer latch. A process is waiting to acquire a latch. This can occur if an I/O operation taking too long to complete.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-844-database-engine-error",
      "level": "Information",
      "error": 844,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog845",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 845",
      "description": "A timeout occurred while waiting for buffer latch. A process was waiting to acquire a latch, but the process waited until the time limit expired and failed to acquire one. This can occur if an I/O operation takes too long to complete.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-845-database-engine-error",
      "level": "Information",
      "error": 845,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog846",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 846",
      "description": "A timeout occurred while waiting for buffer latch. Not continuing to wait. A computer might stop responding, or a timeout or some other disruption of regular operations might occur at the same time that SQL Server writes buffer latch errors to the SQL Server error log.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-846-database-engine-error",
      "level": "Information",
      "error": 846,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog847",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 847",
      "description": "A timeout occurred while waiting for buffer latch. Continuing to wait. A computer might stop responding, or a timeout or some other disruption of regular operations might occur at the same time that SQL Server writes buffer latch errors to the SQL Server error log.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-847-database-engine-error",
      "level": "Information",
      "error": 847,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog905",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 905",
      "description": "A database cannot be started because it contains one or more partitioned tables or indexes. This edition of SQL Server cannot use table and index partitioning.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-905-database-engine-error",
      "level": "Information",
      "error": 905,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog909",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 909",
      "description": "A database cannot be started because it contains one or more objects enabled with data compression or vardecimal storage format. This edition of SQL Server cannot use data compression and vardecimal storage format.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/database-engine-events-and-errors",
      "level": "Information",
      "error": 909,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog933",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 933",
      "description": "A database cannot be started because some of the database functionality is not available in this edition of SQL Server.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/database-engine-events-and-errors",
      "level": "Information",
      "error": 933,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog934",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 934",
      "description": "SQL Server cannot load a database because Change Data Capture is enabled. This edition of SQL Server does not support Change Data Capture.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/database-engine-events-and-errors",
      "level": "Information",
      "error": 934,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog945",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 945",
      "description": "A database cannot be opened due to inaccessible files or insufficient memory or disk space.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-945-database-engine-error",
      "level": "Medium",
      "error": 945,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog1101",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 1101",
      "description": "Could not allocate a new page because of insufficient disk space.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-1101-database-engine-error",
      "level": "Medium",
      "error": 1101,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog1105",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 1105",
      "description": "Could not allocate space for an object because a filegroup is full.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-1105-database-engine-error",
      "level": "Medium",
      "error": 1105,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog1205",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 1205",
      "description": "Transaction was deadlocked on a resources with another process and has been chosen as the deadlock victim. This error indicates that resources are accessed in conflicting order on separate transactions, causing a deadlock.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-1205-database-engine-error",
      "level": "Information",
      "error": 1205,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog1450",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 1450",
      "description": "The ALTER DATABASE command failed because the worker thread cannot be created.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/database-engine-events-and-errors",
      "level": "Medium",
      "error": 1450,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog2570",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 2570",
      "description": "A column value is outside the range of possible values for the column data type.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-2570-database-engine-error",
      "level": "Medium",
      "error": 2570,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog3041",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 3041",
      "description": "BACKUP failed to complete a command.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/database-engine-events-and-errors",
      "level": "Medium",
      "error": 3041,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog3043",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 3043",
      "description": "BACKUP detected an error on page.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/database-engine-events-and-errors",
      "level": "Medium",
      "error": 3043,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog3197",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 3197",
      "description": "I/O is frozen on a database.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/database-engine-events-and-errors",
      "level": "Information",
      "error": 3197,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog3260",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 3260",
      "description": "An internal buffer has become full. The server is out of memory.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-3260-database-engine-error",
      "level": "Information",
      "error": 3260,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog3266",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 3266",
      "description": "A backup data is incorrectly formatted. Backup sets on the media might be damaged and unusable.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/database-engine-events-and-errors",
      "level": "Information",
      "error": 3266,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog3271",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 3271",
      "description": "A nonrecoverable I/O error occurred. This is a general error that occurs when the operating system raises an error while performing I/O during a backup or restore operation.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-3271-database-engine-error",
      "level": "Information",
      "error": 3271,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog3313",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 3313",
      "description": "During redoing of a logged operation, an error occurred.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-3313-database-engine-error",
      "level": "Medium",
      "error": 3313,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog3314",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 3314",
      "description": "During undoing of a logged operation, an error occurred.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-3314-database-engine-error",
      "level": "Medium",
      "error": 3314,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog3316",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 3316",
      "description": "During undo of a logged operation, an error occurred. The row was not found.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/database-engine-events-and-errors",
      "level": "Information",
      "error": 3316,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog3409",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 3409",
      "description": "Performance counter shared memory setup failed.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/database-engine-events-and-errors",
      "level": "Medium",
      "error": 3409,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog3414",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 3414",
      "description": "An error occurred during recovery, preventing a database from restarting.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-3414-database-engine-error",
      "level": "Medium",
      "error": 3414,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog3417",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 3417",
      "description": "Cannot recover the master database. SQL Server is unable to run.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-3417-database-engine-error",
      "level": "Medium",
      "error": 3417,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog3420",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 3420",
      "description": "A database snapshot has failed an IO operation and is marked suspect.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/database-engine-events-and-errors",
      "level": "Information",
      "error": 3420,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog3431",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 3431",
      "description": "Could not recover a database because of unresolved transaction outcomes.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-3431-database-engine-error",
      "level": "Medium",
      "error": 3431,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog3437",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 3437",
      "description": "An error occurred while recovering a database. Unable to connect to Distributed Transaction Coordinator to check the completion status of a transaction.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-3437-database-engine-error",
      "level": "Medium",
      "error": 3437,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog3452",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 3452",
      "description": "Recovery of a database detected possible identity value inconsistency in a table.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-3452-database-engine-error",
      "level": "Information",
      "error": 3452,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog3456",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 3456",
      "description": "Could not redo log record.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-3456-database-engine-error",
      "level": "Medium",
      "error": 3456,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog3619",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 3619",
      "description": "Could not write a checkpoint record because the log is out of space. The transaction log is out of disk space.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-3619-database-engine-error",
      "level": "Medium",
      "error": 3619,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog3859",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 3859",
      "description": "The system catalog was updated directly. This error indicates a user initiated changes to system tables. Manually updating system tables is not supported.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-3859-database-engine-error",
      "level": "Medium",
      "error": 3859,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog5105",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 5105",
      "description": "A file activation error occurred. The physical file name may be incorrect.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/database-engine-events-and-errors",
      "level": "Medium",
      "error": 5105,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog5180",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 5180",
      "description": "Could not open File Control Bank for invalid file. A query or operation may fail when an invalid file ID is referenced.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-5180-database-engine-error",
      "level": "Medium",
      "error": 5180,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog5243",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 5243",
      "description": "An inconsistency was detected during an internal operation. SQL Server detected a structural inconsistency in an in-memory storage engine structure.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-5243-database-engine-error",
      "level": "Information",
      "error": 5243,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog7105",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 7105",
      "description": "A large object data referenced by a database page row cannot be accessed. This is usually caused by transactions that can read uncommitted data on a data page.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-7105-database-engine-error",
      "level": "Information",
      "error": 7105,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog7359",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 7359",
      "description": "The OLE DB provider for a linked server reported a change in schema version between compile time and run time.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/database-engine-events-and-errors",
      "level": "Information",
      "error": 7359,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog8621",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 8621",
      "description": "The query processor ran out of stack space during query optimization. The size of the expanded query is the most likely cause of the error.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-8621-database-engine-error",
      "level": "Medium",
      "error": 8621,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog8628",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 8628",
      "description": "A timeout occurred while waiting to optimize the query.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/database-engine-events-and-errors",
      "level": "Medium",
      "error": 8628,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog8642",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 8642",
      "description": "The query processor could not start the necessary thread resources for parallel query execution.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-8642-database-engine-error",
      "level": "Medium",
      "error": 8642,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog8645",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 8645",
      "description": "A timeout occurred while waiting for memory resources to execute the query.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-8645-database-engine-error",
      "level": "Information",
      "error": 8645,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog8909",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 8909",
      "description": "A page contains an incorrect page ID in its page header.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/database-engine-events-and-errors",
      "level": "Medium",
      "error": 8909,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog8966",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 8966",
      "description": "Unable to read and latch page.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-8966-database-engine-error",
      "level": "Information",
      "error": 8966,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog9002",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 9002",
      "description": "A database transaction log is full.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-9002-database-engine-error",
      "level": "Medium",
      "error": 9002,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog9004",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 9004",
      "description": "An error was encountered while processing the log during rollback, recovery, or replication. This could indicate an error detected by the operating system or an internal consistency error detected by SQL Server.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-9004-database-engine-error",
      "level": "High",
      "error": 9004,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog9642",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 9642",
      "description": "An error occurred in a Service Broker/Database Mirroring transport connection endpoint.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/database-engine-events-and-errors",
      "level": "Information",
      "error": 9642,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog9691",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 9691",
      "description": "An endpoint has stopped listening for connections.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/database-engine-events-and-errors",
      "level": "Medium",
      "error": 9691,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog9692",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 9692",
      "description": "An endpoint cannot listen on a port because it is in use by another process.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-9692-database-engine-error",
      "level": "Information",
      "error": 9692,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog9693",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 9693",
      "description": "An endpoint cannot listen for connections due to an error.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/database-engine-events-and-errors",
      "level": "Information",
      "error": 9693,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog17065",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 17065",
      "description": "This error can be caused by transient, timing-related errors, or by in-memory or on-disk data corruption.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-17065-database-engine-error",
      "level": "Medium",
      "error": 17065,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog17066",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 17066",
      "description": "This error can be caused by transient, timing-related errors, or by in-memory or on-disk data corruption.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-17066-database-engine-error",
      "level": "Medium",
      "error": 17066,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog17067",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 17067",
      "description": "This error can be caused by transient, timing-related errors, or by in-memory or on-disk data corruption.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-17067-database-engine-error",
      "level": "Medium",
      "error": 17067,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog17194",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 17194",
      "description": "This error indicates that the client has closed the connection. This error could occur because the connection timeout has expired.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-17194-database-engine-error",
      "level": "Medium",
      "error": 17194,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog17204",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 17204",
      "description": "Could not open a file. SQL Server was unable to open the file because of the operating system error.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-17204-database-engine-error",
      "level": "Information",
      "error": 17204,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog17207",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 17207",
      "description": "An operating system error occurred while creating or opening a file. SQL Server was unable to open the file because of the operating system error.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-17207-database-engine-error",
      "level": "Information",
      "error": 17207,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog17659",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 17659",
      "description": "A system table has been updated directly and cache coherence may not have been maintained. This error indicates a user initiated changes to system tables. Manually updating system tables is not supported.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-17659-database-engine-error",
      "level": "High",
      "error": 17659,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog17806",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 17806",
      "description": "Security Support Provider Interface handshake failed while establishing a connection with integrated security.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/database-engine-events-and-errors",
      "level": "Medium",
      "error": 17806,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog17832",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 17832",
      "description": "The login packet used to open the connection is structurally invalid. This error could occur because the packet was created improperly or because the packet was damaged during transmission.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-17832-database-engine-error",
      "level": "Information",
      "error": 17832,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog17884",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 17884",
      "description": "New queries assigned to process have not been picked up by a worker thread.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-17884-database-engine-error",
      "level": "Medium",
      "error": 17884,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog17887",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 17887",
      "description": "An IO Completion Listener appears to be non-yielding. This error indicates that there is a possible problem with the I/O Completion Port Listener when executing the I/O Completion routine for a network read/write event.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-17887-database-engine-error",
      "level": "Medium",
      "error": 17887,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog17888",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 17888",
      "description": "All schedulers on a node appear deadlocked due to a large number of waiting worker threads.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/database-engine-events-and-errors",
      "level": "Medium",
      "error": 17888,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog17890",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 17890",
      "description": "A significant part of SQL Server process memory has been paged out. This may result in a performance degradation.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-17890-database-engine-error",
      "level": "Medium",
      "error": 17890,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog18056",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 18056",
      "description": "The client was unable to reuse a session, which had been reset for connection pooling. This error may have been caused by an earlier operation failing.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/database-engine-events-and-errors",
      "level": "Information",
      "error": 18056,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog18204",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 18204",
      "description": "A backup device failed because of the operating system error.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/database-engine-events-and-errors",
      "level": "High",
      "error": 18204,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog18272",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 18272",
      "description": "During restore restart, an I/O error occurred on a checkpoint file.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/database-engine-events-and-errors",
      "level": "Information",
      "error": 18272,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog19034",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 19034",
      "description": "Cannot start C2 audit trace.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/database-engine-events-and-errors",
      "level": "Medium",
      "error": 19034,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog26023",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 26023",
      "description": "SQL Server TCP provider failed to listen on a port. TCP port is already in use.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/database-engine-events-and-errors",
      "level": "Medium",
      "error": 26023,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog26024",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 26024",
      "description": "SQL Server TCP provider failed to listen on a port.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/database-engine-events-and-errors",
      "level": "Medium",
      "error": 26024,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog26037",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 26037",
      "description": "SQL Server Network Interface library could not register the Service Principal Name (SPN) for SQL Server service. Failure to register an SPN may cause integrated authentication to fall back to NTLM instead of Kerberos.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/database-engine-events-and-errors",
      "level": "Medium",
      "error": 26037,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog26038",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 26038",
      "description": "SQL Server Network Interface library could not register the Service Principal Name (SPN) for SQL Server service. This SPN should be deregistered manually to avoid client authentication errors.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/database-engine-events-and-errors",
      "level": "Medium",
      "error": 26038,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog28034",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 28034",
      "description": "Connection handshake failed. A login does not have CONNECT permission on the endpoint.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/database-engine-events-and-errors",
      "level": "Information",
      "error": 28034,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog28036",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 28036",
      "description": "Connection handshake failed. The certificate used by the endpoint was not found.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/database-engine-events-and-errors",
      "level": "Medium",
      "error": 28036,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog28047",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 28047",
      "description": "A login attempt failed with error.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/database-engine-events-and-errors",
      "level": "Information",
      "error": 28047,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog28048",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 28048",
      "description": "A login attempt by an user failed with error.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/errors-events/database-engine-events-and-errors",
      "level": "Information",
      "error": 28048,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog35201",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 35201",
      "description": "A connection timeout has occurred while attempting to establish a connection to an availability replica. Either a networking or firewall issue exists, or the endpoint address provided for the replica is not the database mirroring endpoint.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/availability-groups/windows/troubleshoot-always-on-availability-groups-configuration-sql-server",
      "level": "Information",
      "error": 35201,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog35204",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 35204",
      "description": "The connection between server instances has been disabled because the database mirroring endpoint was either disabled or stopped.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/availability-groups/windows/troubleshoot-always-on-availability-groups-configuration-sql-server",
      "level": "Information",
      "error": 35204,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog35206",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 35206",
      "description": "A connection timeout has occurred on a previously established connection to an availability replica. Either a networking or a firewall issue exists or the availability replica has transitioned to the resolving role.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/availability-groups/windows/troubleshoot-always-on-availability-groups-configuration-sql-server",
      "level": "Information",
      "error": 35206,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog35207",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 35207",
      "description": "Connection attempt on an availability group failed because of error.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/availability-groups/windows/troubleshoot-always-on-availability-groups-configuration-sql-server",
      "level": "Information",
      "error": 35207,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog35217",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 35217",
      "description": "The thread pool for AlwaysOn Availability Groups was unable to start a new worker thread because there are not enough available worker threads.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/availability-groups/windows/troubleshoot-always-on-availability-groups-configuration-sql-server",
      "level": "Medium",
      "error": 35217,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog41142",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 41142",
      "description": "The availability replica for an availability group cannot become the primary replica. One or more databases are not synchronized or have not joined the availability group.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/availability-groups/windows/troubleshoot-always-on-availability-groups-configuration-sql-server",
      "level": "Medium",
      "error": 41142,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLog41144",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Database engine error 41144",
      "description": "A local availability replica is in a failed state. The replica failed to read or update the persisted configuration data.",
      "message": "Database engine error @{error} occurred @{error_count} times in the last @{history_days} days. Last occurrence at @{last_occurrence}.",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/availability-groups/windows/troubleshoot-always-on-availability-groups-configuration-sql-server",
      "level": "Medium",
      "error": 41144,
      "history_days": 7,
      "condition": {
        "or": [
          {
            "ne": [
              "@errorId",
              "@error"
            ]
          },
          {
            "eq": [
              "error_count",
              0
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "ErrorLog",
          "params": {
            "history_days": "@history_days",
            "max_log_size_mb": 50,
            "language": null
          }
        }
      ]
    },
    {
      "id": "ErrorLogAge",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "displayName": "Error log retention settings",
      "description": "The SQL Server error log contains lots of information that is generated by the SQL Server. The error log file is initialized every time that the instance of SQL Server is started. Specify the maximum number of archived error log files created before they are recycled. The default is 6, not including the current one.",
      "message": "Revise error log retention settings. Error log contains less than @{threshold} days of history",
      "helpLink": "https://learn.microsoft.com/troubleshoot/sql/admin/manage-error-log",
      "level": "Low",
      "threshold": 14,
      "condition": {
        "gt": [
          "@age_days",
          "@threshold"
        ]
      },
      "probes": [
        {
          "id": "ErrorLogInfo",
          "transform": {
            "type": "aggregate",
            "map": {
              "age_days": "max"
            }
          }
        }
      ]
    },
    {
      "id": "FileMaxSize",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "displayName": "Setting 'Autogrow' for data files",
      "description": "This check verifies the 'autogrow' settings of data files for all system and user databases. In SQL Server, a log file specified with unlimited growth has a maximum size of 2 TB, and a data file has a maximum size of 16 TB. There is no maximum size when this option is specified for a FILESTREAM container. It continues to grow until the disk is full. If there is no space available, performance issues may occur and the database may become unavailable.",
      "message": "Check 'autogrow' setting. Currently maximum size of @{maxsize_in_mb} MBs is set for @{type_desc} file @{fileName} in database @{databaseName}",
      "helpLink": "https://docs.microsoft.com/sql/t-sql/statements/alter-database-transact-sql-file-and-filegroup-options",
      "level": "Information",
      "tags": [
        "DefaultRuleset",
        "Performance",
        "DBFileConfiguration"
      ],
      "defaultLogValues": [
        -1,
        0,
        268435456
      ],
      "condition": {
        "and": [
          {
            "or": [
              {
                "ne": [
                  "@type",
                  0
                ]
              },
              {
                "le": [
                  "@max_size",
                  0
                ]
              }
            ]
          },
          {
            "or": [
              {
                "ne": [
                  "@type",
                  1
                ]
              },
              {
                "in": [
                  "@max_size",
                  "@defaultLogValues"
                ]
              }
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "DatabaseMasterFiles",
          "params": {
            "type": null,
            "dbId": null
          }
        }
      ],
      "locals": {
        "maxsize_in_mb": {
          "div": [
            "@max_size",
            128
          ]
        }
      }
    },
    {
      "id": "FilestreamAccessLevel",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "displayName": "Non-default value for 'filestream access level' option",
      "description": "The 'filestream access level' option controls the FILESTREAM access level for the instance of SQL Server. By default, this option is disabled, but should be enabled to allow FileStream access or to take advantage of the 'FileTable' feature.",
      "message": "Review non-default value @{filestream_access_level} for the 'filestream access level' option",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/filestream-access-level-server-configuration-option",
      "level": "Information",
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "condition": {
        "eq": [
          "@filestream_access_level",
          0
        ]
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "FillFactor",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer, ManagedInstance",
        "platform": [
          "Windows",
          "Linux"
        ],
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Performance",
        "Configuration"
      ],
      "displayName": "Non-default value for 'fill factor' option",
      "description": "The 'fill factor' option controls the default fill factor that is used when a new index is created or rebuilt. The default value is 0, which means that the leaf level of the index will be filled with the highest possible number of rows.",
      "message": "Review non-default value @{fill_factor} for the 'fill factor' option. A low, nonzero 'fill factor' option value can decrease database read performance",
      "helpLink": "https://docs.microsoft.com/en-us/sql/database-engine/configure-windows/configure-the-fill-factor-server-configuration-option",
      "level": "Information",
      "threshold": 80,
      "condition": {
        "or": [
          {
            "eq": [
              "@fill_factor",
              0
            ]
          },
          {
            "ge": [
              "@fill_factor",
              "@threshold"
            ]
          }
        ]
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "FreeSpaceScansPerSec",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Performance"
      ],
      "displayName": "High free space scans rate",
      "description": "Inserts into heaps require SQL Server to perform free space scans to identify pages with free space to insert rows. An insert into a heap often spends time searching for a location to insert the new row. On the other hand the insert into a clustered table does not have to spend any time searching for space. In most cases it is best to start with a clustered index on every table. There are occasional instances where this is not optimal, but it is extremely rare that the existence of a clustered index hurts performance and it usually helps. Test your workload to ensure that adding a clustered index has no detrimental effects.",
      "message": "Add clustered indexes to heaps and reduce FreeSpace Scans/sec (@{freespace_scans_sec:0.##}) per Batch requests/sec (@{batch_request_sec:0.##}), which is greater than @{threshold:P0}",
      "helpLink": "https://learn.microsoft.com/sql/relational-databases/indexes/heaps-tables-without-clustered-indexes?#when-not-to-use-a-heap",
      "threshold": 0.1,
      "condition": {
        "or": [
          {
            "le": [
              "@batch_request_sec",
              100
            ]
          },
          {
            "le": [
              "@freespace_scans_sec",
              {
                "mul": [
                  "@batch_request_sec",
                  "@threshold"
                ]
              }
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "BasicPerformance",
          "alias": "perfA",
          "transform": {
            "type": "performance",
            "counters": {
              "batch_request_sec": "rate"
            }
          }
        },
        {
          "id": "BasicPerformance",
          "alias": "perfB",
          "transform": {
            "type": "performance",
            "counters": {
              "freespace_scans_sec": "rate"
            }
          }
        }
      ]
    },
    {
      "id": "FtCrawlBandwidthMax",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "displayName": "Non-default value for 'ft crawl bandwidth (max)' option",
      "description": "The 'ft crawl bandwidth (max)' option determines the maximum number of buffers that will be maintained by the full-text memory manager in a small buffer pool. A high value will allocate more memory to the indexing process, therefore reducing the available memory for other SQL Server processes.",
      "message": "Review non-default value @{ft_crawl_bandwidth_max} for the 'ft crawl bandwidth (max)' option as it will be removed in a future version",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/ft-crawl-bandwidth-server-configuration-option",
      "level": "Low",
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "condition": {
        "eq": [
          "@ft_crawl_bandwidth_max",
          100
        ]
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "FtCrawlBandwidthMin",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "displayName": "Non-default value for 'ft crawl bandwidth (min)' option",
      "description": "The 'ft crawl bandwidth (min)' option determines the minimum number of buffers that must be maintained by the full-text memory manager in a small buffer pool. If the SQL Server memory manager requests memory, this minimum number of buffers will generally be maintained.",
      "message": "Review non-default value @{ft_crawl_bandwidth_min} for the 'ft crawl bandwidth (min)' option as it will be removed in a future version",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/ft-crawl-bandwidth-server-configuration-option",
      "level": "Low",
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "condition": {
        "eq": [
          "@ft_crawl_bandwidth_min",
          0
        ]
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "FtNotifyBandwidthMax",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "displayName": "Non-default value for 'ft notify bandwidth (max)' option",
      "description": "The 'ft notify bandwidth (max)' option determines the maximum number of buffers that will be maintained by the full-text memory manager in a large buffer pool. A high value will allocate more memory to the indexing process, therefore reducing the available memory for other SQL Server processes.",
      "message": "Review non-default value @{ft_notify_bandwidth_max} for the 'ft notify bandwidth (max)' option as it will be removed in a future version",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/ft-notify-bandwidth-server-configuration-option",
      "level": "Low",
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "condition": {
        "eq": [
          "@ft_notify_bandwidth_max",
          100
        ]
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "FtNotifyBandwidthMin",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "displayName": "Non-default value for 'ft notify bandwidth (min)' option",
      "description": "The 'ft notify bandwidth (min)' option determines the minimum number of buffers that must be maintained by the full-text memory manager in a large buffer pool. If the SQL Server memory manager requests memory, this minimum number of buffers will generally be maintained.",
      "message": "Review non-default value @{ft_notify_bandwidth_min} for the 'ft notify bandwidth (min)' option as it will be removed in a future version",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/ft-notify-bandwidth-server-configuration-option",
      "level": "Low",
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "condition": {
        "eq": [
          "@ft_notify_bandwidth_min",
          0
        ]
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "FullScansVsIndexSearches",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Performance"
      ],
      "displayName": "Full scans vs index searches",
      "description": "Index searches are preferable to index and table scans. For OLTP applications, optimize for more index searches and less scans. An ideal ratio on a typical system would be approximately 1 full scan for every 1000 index searches. Index searches are preferable to full scans because full scans cause excessive disk I/O and consume more CPU resources. Execution plans or extended events can be used to identify which Transact-SQL statements perform scans. Review table and index strategy, and ensure index and statistics maintenance plans are in place.",
      "message": "Reduce the number of Full Scans (@{full_scans_sec:0.##}) versus Index Searches (@{index_searches_sec:0.##})",
      "helpLink": "https://learn.microsoft.com/sql/relational-databases/sql-server-index-design-guide?#General_Design",
      "threshold": 1000,
      "condition": {
        "or": [
          {
            "le": [
              "@batch_request_sec",
              100
            ]
          },
          {
            "ge": [
              "@index_searches_sec",
              {
                "mul": [
                  "@full_scans_sec",
                  "@threshold"
                ]
              }
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "BasicPerformance",
          "alias": "perfA",
          "transform": {
            "type": "performance",
            "counters": {
              "batch_request_sec": "rate"
            }
          }
        },
        {
          "id": "BasicPerformance",
          "alias": "perfB",
          "transform": {
            "type": "performance",
            "counters": {
              "index_searches_sec": "rate"
            }
          }
        },
        {
          "id": "BasicPerformance",
          "alias": "perfC",
          "transform": {
            "type": "performance",
            "counters": {
              "full_scans_sec": "rate"
            }
          }
        }
      ]
    },
    {
      "id": "FullTextDefaultLang",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "displayName": "Not supported value for 'default full-text language' option",
      "description": "The value of the 'default full-text language' option is used in a full-text index when no language is specified. If the default full-text language is not supported or the linguistic analysis package is not available, CREATE FULLTEXT INDEX and ALTER FULLTEXT INDEX statements will fail.",
      "message": "Set 'default full-text language' option to a supported value",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/configure-the-default-full-text-language-server-configuration-option",
      "condition": {
        "or": [
          {
            "not": "@IsFulltextInstalled"
          },
          {
            "in": [
              "@default_full_text_language",
              "@lcid"
            ]
          }
        ]
      },
      "probes": [
        "SysConfiguration",
        {
          "id": "SysFullTextLanguages",
          "transform": {
            "type": "aggregate",
            "map": {
              "lcid": "array"
            }
          }
        },
        "FullTextServiceInfo"
      ]
    },
    {
      "id": "FullTextNoiseWords",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "displayName": "Non-default value for 'transform noise words' option",
      "description": "If a query using a full-text search predicate contains a noise word (for example, is, the, and) and this configuration setting has been disabled, a warning will be issued and no rows from the query will be returned. The default setting for this option is 0, which indicates that it is off. Enabling this configuration by changing the default to 1 will force noise words to be replaced with an asterisk (*) in the query instead.",
      "message": "Review non-default value @{transform_noise_words} for the 'transform noise words' option",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/transform-noise-words-server-configuration-option",
      "level": "Information",
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "condition": {
        "not": "@transform_noise_words"
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "FullTextPHTimeout",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "displayName": "Non-default value for 'PH timeout' option",
      "description": "The 'PH timeout' option controls the number of seconds that the full-text protocol handler will wait to connect to a database before reaching the timeout threshold. You can increase the 'PH timeout' value when connection attempts are timing out due to temporary network issues.",
      "message": "Review non-default value @{PH_timeout} for the 'PH timeout' option",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/ph-timeout-server-configuration-option",
      "level": "Information",
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "condition": {
        "eq": [
          "@PH_timeout",
          60
        ]
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "InDoubtXactResolution",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "displayName": "Non-default value for 'in-doubt xact resolution' option",
      "description": "The 'in-doubt xact resolution' option controls the default outcome of unresolved Microsoft Distributed Transaction Coordinator (MS DTC) transactions. The default value of 0 means that recovery will fail if MS DTC cannot resolve the in-doubt transactions. Before changing this default, you should consider the effect of your application distributed transactions and make sure that no data integrity issues will occur based on partially committed or aborted activity.",
      "message": "Review non-default value @{in_doubt_xact_resolution} for the 'in-doubt xact resolution' option",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/in-doubt-xact-resolution-server-configuration-option",
      "level": "Information",
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "condition": {
        "eq": [
          "@in_doubt_xact_resolution",
          0
        ]
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "InstantFileInitialization",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": "Windows",
        "engineEdition": "SqlServer",
        "version": [
          "[11.0.7001,12.0)",
          "[12.0.6024,13.0)",
          "[13.0.4001,)"
        ]
      },
      "tags": [
        "DefaultRuleset",
        "DBConfiguration",
        "Performance"
      ],
      "displayName": "Instant file initialization (IFI) is disabled",
      "description": "Instant file initialization (IFI) allows for faster execution of the previously mentioned file operations, since it reclaims used disk space without filling that space with zeros. Instead, disk content is overwritten as new data is written to the files.",
      "message": "Enable instant file initialization",
      "helpLink": "https://docs.microsoft.com/en-us/sql/relational-databases/databases/database-instant-file-initialization",
      "level": "High",
      "condition": {
        "eq": [
          "@instant_file_initialization_enabled",
          "Y"
        ]
      },
      "probes": [
        "InstantFileInitialization"
      ]
    },
    {
      "id": "JdbcModuleVersion",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "displayName": "JDBC Driver for SQL Server version is not supported",
      "description": "The JDBC Driver for SQL Server is a Type 4 Java Database Connectivity (JDBC) 4.2 compliant driver that provides robust data access to SQL Server, Azure SQL Database, and Azure SQL Managed Instance. Java connectivity support is continually improving. It is highly recommend to use the latest version of JDBC driver for SQL Server.",
      "message": "Update JDBC Driver for SQL Server. Current product version @{file_version} of JDBC Driver for SQL Server is out of support",
      "helpLink": "https://docs.microsoft.com/sql/connect/jdbc/understanding-xa-transactions",
      "level": "Medium",
      "tags": [
        "DefaultRuleset",
        "Performance",
        "Security"
      ],
      "condition": {
        "or": [
          {
            "ine": [
              "@module.file_name",
              "sqljdbc_xa.dll"
            ]
          },
          {
            "or": [
              {
                "gt": [
                  "@file_version.major",
                  6
                ]
              },
              {
                "and": [
                  {
                    "eq": [
                      "@file_version.major",
                      6
                    ]
                  },
                  {
                    "ge": [
                      "@file_version.minor",
                      2
                    ]
                  }
                ]
              }
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "OsLoadedModules",
          "transform": {
            "type": "parse",
            "map": {
              "file_version": "/^(?<major>\\d+)\\.(?<minor>\\d+)(?:\\:(?<build>\\d+))?(?:\\.(?<revision>\\d+))?$/x"
            }
          }
        }
      ]
    },
    {
      "id": "LatchWaitTimePerSec",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Performance"
      ],
      "displayName": "High latch wait time",
      "description": "The storage engine must ensure that no other task modifies the contents of a memory structure (like a buffer page) while it is being modified by the current task. It does this by acquiring a latch, updating the row in memory (or any other structure protected by a latch), and then releasing the latch. A latch wait indicates the number of times that a latch could not be granted immediately and the task needed to wait.",
      "message": "Investigate and resolve the cause of high average Latch Wait Times (@{total_latch_wait_time_ms:0.##} ms for @{latch_waits_sec:0.##} per second)",
      "helpLink": "https://learn.microsoft.com/sql/relational-databases/diagnose-resolve-latch-contention",
      "threshold": 10,
      "condition": {
        "or": [
          {
            "le": [
              "@latch_waits_sec",
              0
            ]
          },
          {
            "le": [
              {
                "div": [
                  "@total_latch_wait_time_ms",
                  "@latch_waits_sec"
                ]
              },
              "@threshold"
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "BasicPerformance",
          "alias": "perfA",
          "transform": {
            "type": "performance",
            "counters": {
              "total_latch_wait_time_ms": "rate"
            }
          }
        },
        {
          "id": "BasicPerformance",
          "alias": "perfB",
          "transform": {
            "type": "performance",
            "counters": {
              "latch_waits_sec": "rate"
            }
          }
        }
      ]
    },
    {
      "id": "LazyWritesPerSec",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Performance"
      ],
      "displayName": "Excessive Lazy Writes",
      "description": "This counter tracks how many times a second that the Lazy Writer process is moving dirty pages from the buffer to disk in order to free up buffer space. Typically, this should not be more than 20 per second. Ideally, it should be close to zero. This issue usually indicates memory pressure. Even if you can add physical memory to the server to mitigate this issue in the short-term, it is better to find the root cause, commonly inefficient queries, and troubleshoot those. Improving the indexing design, reducing cursor usage, and avoiding scans can significantly improve the value for this counter.",
      "message": "Find and troubleshoot the cause of excessive Lazy writes per second (@{lazy_writes:0.##})",
      "helpLink": "https://learn.microsoft.com/sql/relational-databases/writing-pages",
      "threshold": 20,
      "condition": {
        "lt": [
          "@lazy_writes",
          "@threshold"
        ]
      },
      "probes": [
        {
          "id": "BasicPerformance",
          "transform": {
            "type": "performance",
            "counters": {
              "lazy_writes": {
                "type": "rate"
              }
            }
          }
        }
      ]
    },
    {
      "id": "LockedPagesInMemory",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": "Windows",
        "engineEdition": "SqlServer",
        "version": "[11.0,)",
        "machineType": "AzureVm"
      },
      "tags": [
        "DefaultRuleset",
        "Performance",
        "Memory"
      ],
      "displayName": "Lock pages in memory",
      "description": "This Windows policy determines which accounts can use a process to keep data in physical memory, preventing the system from paging the data to virtual memory on disk.",
      "message": "Enable the 'Lock pages in memory' option",
      "helpLink": "https://docs.microsoft.com/azure/azure-sql/virtual-machines/windows/performance-guidelines-best-practices-checklist",
      "level": "High",
      "condition": {
        "gt": [
          "@locked_page_allocations_kb",
          0
        ]
      },
      "probes": [
        "SysDmOsProcessMemory"
      ]
    },
    {
      "id": "LockedPagesInMemory",
      "itemType": "override",
      "targetFilter": {
        "version": [
          "[11.0.7001, 12.0)",
          "[12.0.6024, 13.0)",
          "[13.0.4001,)"
        ]
      },
      "condition": {
        "or": [
          {
            "eq": [
              "@sql_memory_model",
              2
            ]
          },
          {
            "eq": [
              "@sql_memory_model",
              3
            ]
          }
        ]
      },
      "probes": [
        "SysDmOsSysInfo"
      ]
    },
    {
      "id": "LockRequestsPerSec",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Performance"
      ],
      "displayName": "Lock requests per batch",
      "description": "Lock Requests/sec reports the number of requests for a type of lock per second. A Lock Requests/sec greater than 500 when compared to Batch Request/sec indicates that batches are acquiring a large number of locks. This suggests inefficient queries. The risk is that blocking may occur. Review high-read queries. In addition, try to reduce the number of reads by tuning your application, the queries executed by the application and the indexing strategy. You can reduce the locks by changing the transaction isolation level, where appropriate.",
      "message": "Review the design of high-read queries and attempt to reduce the number of reads (@{lock_requests_sec:0.##} lock requests for @{batch_request_sec:0.##} batch requests)",
      "helpLink": "https://learn.microsoft.com/sql/relational-databases/sql-server-transaction-locking-and-row-versioning-guide?#Lock_Engine",
      "threshold": 500,
      "condition": {
        "or": [
          {
            "le": [
              "@batch_request_sec",
              100
            ]
          },
          {
            "le": [
              "@lock_requests_sec",
              {
                "mul": [
                  "@batch_request_sec",
                  "@threshold"
                ]
              }
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "BasicPerformance",
          "alias": "perfA",
          "transform": {
            "type": "performance",
            "counters": {
              "batch_request_sec": "rate"
            }
          }
        },
        {
          "id": "BasicPerformance",
          "alias": "perfB",
          "transform": {
            "type": "performance",
            "counters": {
              "lock_requests_sec": {
                "type": "rate",
                "instance": "_Total"
              }
            }
          }
        }
      ]
    },
    {
      "id": "LockWaitTime",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Excessive Lock Waits",
      "tags": [
        "DefaultRuleset",
        "Performance"
      ],
      "description": "Excessive locking reduces overall throughput and increases the latency observed by users. Investigate the cause of lock contention and reduce this as much as possible to resolve lock wait issues. The following methods can be used to reduce lock contention and increase overall throughput: review index straegy, leverage Read Committed Snapshot and Snapshot Isolation whenever possible, avoid situations in which many processes are attempting to perform updates or inserts on the same data page, avoid transactions that include user interaction, keep transactions that modify data as short as possible, keep transactions in one batch, avoid pessimistic locking hints such as holdlock whenever possible, and reduce the fill factor when creating an index to help diminish the chance of random updates requiring the same page.",
      "message": "Investigate the cause of excessive Lock Waits (@{lock_wait_time_ms:0.##} ms.) and resolve lock contention",
      "helpLink": "http://support.microsoft.com/kb/75722",
      "threshold": 500,
      "condition": {
        "le": [
          "@lock_wait_time_ms",
          "@threshold"
        ]
      },
      "probes": [
        {
          "id": "BasicPerformance",
          "transform": {
            "type": "performance",
            "counters": {
              "lock_wait_time_ms": {
                "type": "rate",
                "instance": "_Total"
              }
            }
          }
        }
      ]
    },
    {
      "id": "MaxFTCrawlRange",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "displayName": "Non-default value for 'max full-text crawl range' option",
      "description": "The 'max full-text crawl range' option sets the number of partitions that SQL Server will use during a full-text index crawl. The default option is 4. However, you can increase this value if you want to optimize the crawl performance and you have sufficient CPU capacity.",
      "message": "Review non-default value @{max_full_text_crawl_range} for the 'max full-text crawl range' option",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/max-full-text-crawl-range-server-configuration-option",
      "level": "Information",
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "condition": {
        "eq": [
          "@max_full_text_crawl_range",
          4
        ]
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "MaxTextReplSize",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "displayName": "Non-default value for 'max text repl size' option",
      "description": "The 'max text repl size' option sets the maximum bytes of varchar(max), nvarchar(max), varbinary(max), xml, image, text, and ntext data that can be replicated in a single INSERT, UPDATE, WRITETEXT, or UPDATETEXT operation. If your data modifications exceed this value on replicated columns, you must increase it.",
      "message": "Review non-default value @{max_text_repl_size} for the 'max text repl size' option",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/configure-the-max-text-repl-size-server-configuration-option",
      "level": "Information",
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "condition": {
        "eq": [
          "@max_text_repl_size",
          65536
        ]
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "MediaRetention",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "displayName": "Non-default value for 'media retention' option",
      "description": "The 'media retention' option sets the default length of time to retain a backup set for the Microsoft SQL Server instance. This default length of time protects the set from being overwritten until the specified number of days has elapsed. The default for this configuration is 0 days. However, you can modify it, based on your own corporate policies.",
      "message": "Review non-default value @{media_retention} for the 'media retention' option",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/configure-the-media-retention-server-configuration-option",
      "level": "Information",
      "tags": [
        "DefaultRuleset",
        "Configuration",
        "Backup"
      ],
      "condition": {
        "eq": [
          "@media_retention",
          0
        ]
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "MemOptDBResPool",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "engineEdition": "SqlServer",
        "version": "[12.0,)"
      },
      "tags": [
        "Memory",
        "Performance",
        "DefaultRuleset"
      ],
      "displayName": "In-Memory OLTP database without separate resource pool",
      "description": "A databases with memory-optimized tables should be bound to a separate resource pool.",
      "message": "Bind In-Memory OLTP database to separate resource pool",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/in-memory-oltp/bind-a-database-with-memory-optimized-tables-to-a-resource-pool#bkmk_DefineBinding",
      "condition": {
        "or": [
          {
            "not": "@hekaton_count"
          },
          "@resource_pool_id"
        ]
      },
      "probes": [
        "DatabaseConfiguration"
      ]
    },
    {
      "id": "MemoryGrantsPending",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Performance"
      ],
      "displayName": "Memory grants pending",
      "description": "Memory Grants Pending records the number of connections that are waiting for memory before they can begin processing a memory intensive query such as a sort or hash operation. Connections that wait in this state for a long enough time will eventually get an 8645 error (A time out occurred while waiting for memory resources to execute the query. Rerun the query). If this counter remains above zero for a significant period of time, you will need to determine which queries are doing sorts or hashes and will then need to tune them to see if they can utilize a more efficient plan.",
      "message": "Tune queries to reduce Memory Grants Pending (@{memory_grants_pending})",
      "helpLink": "https://techcommunity.microsoft.com/t5/sql-server-blog/understanding-sql-server-memory-grant/ba-p/383595",
      "condition": {
        "le": [
          "@memory_grants_pending",
          0
        ]
      },
      "probes": [
        {
          "id": "BasicPerformance",
          "transform": {
            "type": "performance",
            "counters": {
              "memory_grants_pending": "max"
            }
          }
        }
      ]
    },
    {
      "id": "MinServerMemory",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "displayName": "Non-default value for 'min server memory (MB)' option",
      "description": "Use the 'min server memory (MB)' option to guarantee a minimum amount of memory available to the SQL Server Memory Manager. The default value for this option is 0. Leave this option at the default value if the SQL Server instance is on a dedicated computer or node that has no other applications or SQL Server instances running concurrently with it.",
      "message": "Review non-default value @{min_server_memory} for the 'min server memory (MB)' option",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/server-memory-server-configuration-options",
      "level": "Information",
      "condition": {
        "eq": [
          "@min_server_memory",
          0
        ]
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "MoreIndexesThanCols",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "name": {
          "not": [
            "master",
            "model",
            "msdb",
            "tempdb"
          ]
        },
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Performance",
        "Indexes"
      ],
      "displayName": "Tables with more indexes than columns",
      "description": "One or more database tables have been identified as having more indexes than columns. During inserts, updates and deletes, every index on a table has to be evaluated and, potentially, updated. If too many indexes exist, SQL Server will spend unnecessary resources maintaining indexes that may not be used. This can significantly affect the amount of disk I/O generated and, subsequently, performance.",
      "message": "Consider removing potentially unnecessary indexes on table @{SchemaName}.@{TableName} that has more indexes than columns",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/sql-server-index-design-guide",
      "level": "Information",
      "condition": {
        "le": [
          {
            "sub": [
              "@IndexCount",
              "@FilteredIndexCount"
            ]
          },
          "@ColumnCount"
        ]
      },
      "probes": [
        "TablesInformation"
      ]
    },
    {
      "id": "NestedTriggers",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "displayName": "Non-default value for 'nested triggers' option",
      "description": "The 'nested triggers' option controls whether an AFTER trigger can cascade. When set to 0, AFTER triggers cannot cascade. The default value for this option is 1.",
      "message": "Review non-default value @{nested_triggers} for the 'nested triggers' option",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/configure-the-nested-triggers-server-configuration-option",
      "level": "Information",
      "condition": "@nested_triggers",
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "OForwardedRecordsPerSec",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Performance"
      ],
      "displayName": "High forwarded records rate",
      "description": "Forwarded records occur when a data record in a heap increases in size and the record's current page does not have the space to store the size increase. The record is moved to a new location, becoming a forwarded record, and the forwarding record is left in the original location to point to the real location of the record. The forwarded record points back to the forwarding record in case its location ever needs to change again. If the table experiences several forward records may indicate the table is fragmented and scanning through the table is very inefficient. Review the table index strategy. Forwarded records can be avoided by:Evaluating creating clustered indexes on heaps. Using default values so that an update does not result in a longer row that is the root cause of the forwarded records. Using a fixed size data type such as CHAR instead of VARCHAR. ALTER TABLE … REBUILD to remove heap fragmentation.",
      "message": "Evaluate index design to reduce Forwarded Records/sec (@{forwarded_records_sec:0.##}) per Batch requests/sec (@{batch_request_sec:0.##}), which is greater than @{threshold:P0}",
      "helpLink": "https://techcommunity.microsoft.com/t5/sql-server-blog/knowing-about-forwarded-records-can-help-diagnose-hard-to-find/ba-p/383189",
      "threshold": 0.1,
      "condition": {
        "or": [
          {
            "le": [
              "@batch_request_sec",
              100
            ]
          },
          {
            "le": [
              "@forwarded_records_sec",
              {
                "mul": [
                  "@batch_request_sec",
                  "@threshold"
                ]
              }
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "BasicPerformance",
          "alias": "perfA",
          "transform": {
            "type": "performance",
            "counters": {
              "batch_request_sec": "rate"
            }
          }
        },
        {
          "id": "BasicPerformance",
          "alias": "perfB",
          "transform": {
            "type": "performance",
            "counters": {
              "forwarded_records_sec": "rate"
            }
          }
        }
      ]
    },
    {
      "id": "OneDbPerPool",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "engineEdition": "SqlServer",
        "version": "[12.0,)"
      },
      "tags": [
        "Memory",
        "Performance",
        "DefaultRuleset"
      ],
      "displayName": "One database per resource pool",
      "description": "Only one database should be bound to a resource pool.",
      "message": "Check whether only one database is bound to resource pool '@{pool_name}'",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/resource-governor/resource-governor-resource-pool",
      "condition": {
        "or": [
          {
            "or": [
              {
                "not": "@hekaton_count"
              },
              {
                "not": "@resource_pool_id"
              },
              {
                "ne": [
                  "@resource_pool_id",
                  "@pool_id"
                ]
              }
            ]
          },
          {
            "eq": [
              "@pool_database_count",
              1
            ]
          }
        ]
      },
      "probes": [
        "DatabaseConfiguration",
        "ResPoolInfo"
      ]
    },
    {
      "id": "OpenObjects",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer, ManagedInstance",
        "platform": [
          "Windows",
          "Linux"
        ],
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Performance",
        "Configuration"
      ],
      "displayName": "Non-default value for 'open objects' option",
      "description": "The 'open objects' option has no effect and will be removed in a future version of Microsoft SQL Server. Avoid using this feature in new development work, and plan to modify applications that currently use this feature.",
      "message": "Review non-default value @{open_objects} for the 'open objects' option as it has no effect and will be removed in a future version",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/open-objects-server-configuration-option",
      "level": "Low",
      "condition": {
        "eq": [
          "@open_objects",
          0
        ]
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "OpenTranSleepingSessions",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Performance"
      ],
      "displayName": "Sleeping sessions with open transactions",
      "description": "In any database, mismanagement of transactions often leads to contention and performance problems in systems that have many users. As the number of users that access the data increases, it becomes important to have applications that use transactions efficiently.",
      "message": "Ensure that client applications use transactions efficiently",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/sql-server-transaction-locking-and-row-versioning-guide#controlling-transactions",
      "level": "Medium",
      "condition": {
        "eq": [
          "@session_id",
          0
        ]
      },
      "probes": [
        {
          "id": "SysOpenTranSessions",
          "params": {
            "user_session": 1,
            "status": "sleeping",
            "last_request_end_min": 15
          },
          "transform": {
            "type": "aggregate",
            "map": {
              "session_id": "count"
            }
          }
        }
      ]
    },
    {
      "id": "OrphanedAuditSpec",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration",
        "Audit"
      ],
      "displayName": "Orphaned server audit specification",
      "description": "The server audit specification collects server-level action groups raised by the Extended Events feature. These actions are sent to the audit, which records them in the target. Deliting server audit may cause an orphaned audit specification. Because an audit with a matching GUID does not exist on the server instance, no audit events will be recorded.",
      "message": "Connect orphaned audit specification @{spec_name} to a server audit",
      "helpLink": "https://learn.microsoft.com/sql/relational-databases/security/auditing/sql-server-audit-database-engine",
      "level": "Low",
      "condition": {
        "iin": [
          "@server_audit_guid",
          "@audit_guid"
        ]
      },
      "probes": [
        {
          "id": "ServerAudits",
          "transform": [
            {
              "type": "aggregate",
              "map": {
                "audit_guid": "array"
              }
            },
            {
              "type": "noData",
              "define": {
                "audit_guid": []
              }
            }
          ]
        },
        "AuditSpecs"
      ]
    },
    {
      "id": "OrphanedDbAuditSpec",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration",
        "Audit"
      ],
      "displayName": "Orphaned database audit specification",
      "description": "The database audit specification collects database-level audit actions raised by the Extended Events feature. These actions are sent to the audit, which records them in the target. Deliting server audit or attaching a database that has an audit specification may cause an orphaned audit specification. Because an audit with a matching GUID does not exist on the server instance, no audit events will be recorded.",
      "message": "Connect orphaned audit specification @{spec_name} to a server audit",
      "helpLink": "https://learn.microsoft.com/sql/relational-databases/security/auditing/sql-server-audit-database-engine",
      "level": "Low",
      "condition": {
        "iin": [
          "@server_audit_guid",
          "@audit_guid"
        ]
      },
      "probes": [
        {
          "id": "ServerAudits",
          "transform": [
            {
              "type": "aggregate",
              "map": {
                "audit_guid": "array"
              }
            },
            {
              "type": "noData",
              "define": {
                "audit_guid": []
              }
            }
          ]
        },
        "AuditSpecs"
      ]
    },
    {
      "id": "OrphanedDbAuditSpec",
      "itemType": "override",
      "targetFilter": {
        "engineEdition": "Standard, Express",
        "version": "[11.0, 13.0.4001)"
      },
      "enabled": false
    },
    {
      "id": "OsLoadedModules",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": "Windows",
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "displayName": "Third-party modules are loaded into SQL Server process address space",
      "description": "Certain modules and filter drivers can be loaded into a system that is running SQL Server. In this case, you may experience performance degradation and consistency issues of SQL Server Database Engine.",
      "message": "Evaluate impact of loading '@{module}' module into SQL Server process address space",
      "helpLink": "https://docs.microsoft.com/troubleshoot/sql/performance/performance-consistency-issues-filter-drivers-modules",
      "level": "Low",
      "tags": [
        "DefaultRuleset",
        "Performance",
        "Security"
      ],
      "native_modules": [
        "ccmcore.dll",
        "ccmperf.dll",
        "frameworkperf.dll",
        "instapi.dll",
        "msdart.dll",
        "msxml3.dll",
        "msxmlsql.dll",
        "odbc32.dll",
        "oleacc.dll",
        "oledb32.dll",
        "xmllite.dll",
        "msadce.dll",
        "msdatl3.dll",
        "ccmprofiler.dll",
        "ccmsqlce.dll",
        "msdasql.dll",
        "odbccp32.dll",
        "umpdc.dll",
        "sqlevn70.rll"
      ],
      "condition": {
        "or": [
          {
            "imatch": [
              "@company",
              "^.*Microsoft Corp.*$"
            ]
          },
          {
            "iin": [
              "@module.file_name",
              "@native_modules"
            ]
          },
          {
            "imatch": [
              "@module.file_name",
              "^xtp_.+\\.dll$"
            ]
          }
        ]
      },
      "probes": [
        "OsLoadedModules"
      ]
    },
    {
      "id": "PageLifeExpectancy",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Performance",
        "Memory"
      ],
      "displayName": "Low page life expectancy",
      "description": "The low page life expectancy counter is too low. This may indicate high turnover of data in the buffer pool, which may lead to reduced performance because of high physical memory I/O.",
      "message": "Investigate the reason for low page life expectancy (@{page_life_expectancy})",
      "helpLink": "https://learn.microsoft.com/sql/relational-databases/performance-monitor/monitor-memory-usage",
      "threshold": 700,
      "condition": {
        "ge": [
          "@page_life_expectancy",
          "@threshold"
        ]
      },
      "probes": [
        {
          "id": "BasicPerformance",
          "transform": {
            "type": "performance",
            "counters": {
              "page_life_expectancy": "average"
            }
          }
        }
      ]
    },
    {
      "id": "PageLookupsPerSec",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Performance"
      ],
      "displayName": "High page lookups frequency",
      "description": "Page Lookups/sec indicates the number of requests per second to find a page in the buffer pool. While this identifies queries that are accessing data in memory, which is good, when divided by batch requests, a high value indicates that each batch request has many page lookups which signifies inefficeiency. Use database management objects (DMOs) to identify queries with high logical disk I/O. Tune these queries to lower disk IO, which will, in turn, lower the page lookups per second compared to batch requests. A high number of Page Lookups/sec indicates that there have been inefficient plans being generated and too many pages are getting looked up. Review table and index strategy, and ensure index and statistics maintenance plans are in place. A high number of Page Lookups/sec indicates that there have been inefficient plans being generated and too many pages are getting looked up. Review table and index strategy, and ensure index and statistics maintenance plans are in place.",
      "message": "Tune queries with high logical disk I/O to lower the page lookups per second (@{page_lookups_sec:0.##}) compared to batch requests (@{batch_request_sec:0.##})",
      "helpLink": "https://learn.microsoft.com/sql/relational-databases/performance-monitor/sql-server-buffer-manager-object",
      "threshold": 100,
      "condition": {
        "or": [
          {
            "le": [
              "@batch_request_sec",
              100
            ]
          },
          {
            "le": [
              "@page_lookups_sec",
              {
                "mul": [
                  "@batch_request_sec",
                  "@threshold"
                ]
              }
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "BasicPerformance",
          "alias": "perfA",
          "transform": {
            "type": "performance",
            "counters": {
              "batch_request_sec": "rate"
            }
          }
        },
        {
          "id": "BasicPerformance",
          "alias": "perfB",
          "transform": {
            "type": "performance",
            "counters": {
              "page_lookups_sec": "rate"
            }
          }
        }
      ]
    },
    {
      "id": "PageSplitsPerSec",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Performance"
      ],
      "displayName": "High page split rate",
      "description": "Splitting a page is a complicated operation and the DML statement that initiated the page split generates excessive I/O, and must wait until the split operation completes. Heavily fragmented indexes may be the result of high Page Splits/sec. You can add a fill factor to your index to leave space for new records. You should consider that this will have no effect if records are added sequentially for this index, because all records will be added to the last page.",
      "message": "Evaluate why the Page Splits/sec is high and investigate the use of index padding to reduce Page Splits/sec (@{page_splits_sec:0.##}) per Batch requests/sec (@{batch_request_sec:0.##})",
      "helpLink": "https://learn.microsoft.com/sql/relational-databases/performance-monitor/sql-server-access-methods-object",
      "threshold": 0.2,
      "condition": {
        "or": [
          {
            "le": [
              "@batch_request_sec",
              100
            ]
          },
          {
            "le": [
              "@page_splits_sec",
              {
                "mul": [
                  "@batch_request_sec",
                  "@threshold"
                ]
              }
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "BasicPerformance",
          "alias": "perfA",
          "transform": {
            "type": "performance",
            "counters": {
              "batch_request_sec": "rate"
            }
          }
        },
        {
          "id": "BasicPerformance",
          "alias": "perfB",
          "transform": {
            "type": "performance",
            "counters": {
              "page_splits_sec": "rate"
            }
          }
        }
      ]
    },
    {
      "id": "PlansUseRatioNotOptimal",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Performance",
        "QueryOptimizer"
      ],
      "displayName": "Cache needs to be cleared of single-use plans",
      "description": "Setting the 'Optimize for ad hoc workloads' option to 1 affects only new plans; plans that are already in the plan cache are unaffected. Make sure to check whether you need to clear the cache from the old single-use plans that may continue to remain.",
      "message": "Check if the plan cache needs to be cleared. Current amount of single-use plans in cache is high (@{SingleUsePlansUseRatio:P0})",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/optimize-for-ad-hoc-workloads-server-configuration-option",
      "level": "Information",
      "threshold": 0.5,
      "condition": {
        "or": [
          {
            "not": "@optimize_for_ad_hoc_workloads"
          },
          {
            "lt": [
              "@SingleUsePlansUseRatio",
              "@threshold"
            ]
          }
        ]
      },
      "probes": [
        "SysConfiguration",
        "CachedPlans.SingleUseRatio"
      ]
    },
    {
      "id": "PoolMemParamSet",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "engineEdition": "SqlServer",
        "version": "[12.0,)"
      },
      "tags": [
        "Memory",
        "Performance",
        "DefaultRuleset"
      ],
      "displayName": "Set 'min_memory_percent' or 'max_memory_percent' parameters",
      "description": "A dedicated resource pool should have either 'min_memory_percent' parameter or 'max_memory_percent' parameter set explicitly. You should not let both parameters have default values at the same time.",
      "message": "Set 'min_memory_percent' or 'max_memory_percent' for resource pool '@{pool_name}'",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/in-memory-oltp/bind-a-database-with-memory-optimized-tables-to-a-resource-pool",
      "condition": {
        "or": [
          {
            "or": [
              {
                "not": "@hekaton_count"
              },
              {
                "not": "@resource_pool_id"
              },
              {
                "ne": [
                  "@resource_pool_id",
                  "@pool_id"
                ]
              }
            ]
          },
          {
            "or": [
              {
                "gt": [
                  "@pool_min_memory",
                  0
                ]
              },
              {
                "lt": [
                  "@pool_max_memory",
                  100
                ]
              }
            ]
          }
        ]
      },
      "probes": [
        "DatabaseConfiguration",
        "ResPoolInfo"
      ]
    },
    {
      "id": "PrecomputeRank",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "displayName": "Non-default value for 'precompute rank' option",
      "description": "The 'precompute rank' option has no effect and will be removed in a future version of Microsoft SQL Server. Avoid using this feature in new development work, and plan to modify applications that currently use this feature.",
      "message": "Review non-default value @{precompute_rank} for the 'precompute rank' option as it has no effect and will be removed in a future version",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/discontinued-database-engine-functionality-in-sql-server",
      "level": "Low",
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "condition": {
        "not": "@precompute_rank"
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "QueryGovernorCostLimit",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "displayName": "Non-default value for 'query governor cost limit' option",
      "description": "The 'query governor cost limit' option indicates the longest time period in seconds that a query can run. Queries with estimated run times longer than this will not run and will return an error. This can result in critical queries not running on your server.",
      "message": "Review non-default value @{query_governor_cost_limit} for the 'query governor cost limit' option",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/configure-the-query-governor-cost-limit-server-configuration-option",
      "level": "Information",
      "tags": [
        "DefaultRuleset",
        "Performance",
        "Configuration"
      ],
      "condition": {
        "eq": [
          "@query_governor_cost_limit",
          0
        ]
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "RecompilationsPerSec",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Performance"
      ],
      "displayName": "High SQL recompilation rate",
      "description": "SQL Server Recompilations/sec is the number of statement recompiles per second. This counts the number of times statement recompiles are triggered. Generally, you want the recompiles to be low. Use dynamic management views and functions to detect queries with the most recompilations. If recompilations are caused by changes in the data then they are necessary, but you should modify statements that cause unnecessary recompilations.",
      "message": "Investigate and resolve the cause of high SQL Re-Compilations/sec (@{sql_recompilations_sec:0.##}) per SQL Compilations/sec (@{sql_compilations_sec:0.##}) ",
      "helpLink": "https://learn.microsoft.com/sql/relational-databases/performance-monitor/sql-server-sql-statistics-object",
      "threshold": 0.1,
      "condition": {
        "or": [
          {
            "le": [
              "@batch_request_sec",
              100
            ]
          },
          {
            "le": [
              "@sql_recompilations_sec",
              {
                "mul": [
                  "@sql_compilations_sec",
                  "@threshold"
                ]
              }
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "BasicPerformance",
          "alias": "perfA",
          "transform": {
            "type": "performance",
            "counters": {
              "batch_request_sec": "rate"
            }
          }
        },
        {
          "id": "BasicPerformance",
          "alias": "perfB",
          "transform": {
            "type": "performance",
            "counters": {
              "sql_recompilations_sec": "rate"
            }
          }
        },
        {
          "id": "BasicPerformance",
          "alias": "perfC",
          "transform": {
            "type": "performance",
            "counters": {
              "sql_compilations_sec": "rate"
            }
          }
        }
      ]
    },
    {
      "id": "RemoteAccess",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "displayName": "Non-default value for 'remote access' option",
      "description": "The 'remote access' option controls the execution of stored procedures from local or remote servers. The default value for this option is 1. This grants permission to run local stored procedures from remote servers or remote stored procedures from the local server.",
      "message": "Review non-default value @{remote_access} for the 'remote access' option as it will be removed in a future version",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/configure-the-remote-access-server-configuration-option",
      "level": "Low",
      "condition": "@remote_access",
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "RemoteDAC",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "displayName": "Non-default value for 'remote admin connections' option",
      "description": "The 'remote admin connections' option enables remote connections to the dedicated administrator connection (DAC) on a Microsoft SQL Server instance. By default, this option is disabled and allows only a local client connection to the DAC. Leave this option disabled if you want to restrict DAC access to only the local client on the stand-alone server. If your SQL Server instance is on a cluster or if you want to use the DAC connection remotely and for some troubleshooting scenarios, you should enable this option.",
      "message": "Review non-default value @{remote_admin_connections} for the 'remote admin connections' option",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/remote-admin-connections-server-configuration-option",
      "level": "Low",
      "tags": [
        "DefaultRuleset",
        "Security",
        "Configuration"
      ],
      "condition": {
        "eq": [
          "@remote_admin_connections",
          0
        ]
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "RemoteLoginTimeout",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "displayName": "Non-default value for 'remote login timeout (s)' option",
      "description": "The 'remote login timeout (s)' option specifies the number of seconds to wait before returning from a failed attempt to log in to a remote server. The default value for this option is 10.",
      "message": "Review non-default value @{remote_login_timeout} for the 'remote login timeout (s)' option",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/configure-the-remote-login-timeout-server-configuration-option",
      "level": "Information",
      "condition": {
        "eq": [
          "@remote_login_timeout",
          10
        ]
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "RemoteProcTrans",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)",
        "platform": "Windows"
      },
      "displayName": "Non-default value for 'remote proc trans' option",
      "description": "The 'remote proc trans' option is used to protect the actions of a server-to-server procedure through a Microsoft Distributed Transaction Coordinator (MS DTC) transaction.",
      "message": "Review non-default value @{remote_proc_trans} for the 'remote proc trans' option as it will be removed in a future version",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/configure-the-remote-proc-trans-server-configuration-option",
      "level": "Low",
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "condition": {
        "not": "@remote_proc_trans"
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "ReplicationXPs",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "displayName": "Non-default value for 'Replication XPs' option",
      "description": "The 'Replication XPs' option opens a significant attack surface area that can be used by an attacker to gather information about the system and potentially abuse the privileges of SQL Server.",
      "message": "Set 'Replication XPs' option to default. This option is for internal use only.",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/replication-xps-server-configuration-option",
      "level": "Low",
      "tags": [
        "DefaultRuleset",
        "Configuration",
        "Security"
      ],
      "condition": {
        "eq": [
          "@Replication_XPs",
          0
        ]
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "ScanPointRevalidation",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Performance"
      ],
      "displayName": "Frequent scan point revalidations",
      "description": "During a range scan on an index, there is an optimization that allows skipping the check of individual rows against a range if it is known that all rows on a page satisfy the range. Whenever a scan places a latch on a page, it tries to qualify the entire page for the range. If the check succeeds, a latch is maintained on the page for the duration of the scan (rather than on the individual rows). Another process can cause the latch to be released, however, by modifying the page. If a page latch has to be released, the scan point must be revalidated when the scan resumes. This is because all rows may no longer meet the scan criteria.",
      "message": "Review clustered index placement to reduce Scan Point Revalidations/sec (@{scan_point_revalidations_sec:0.##})",
      "helpLink": "https://learn.microsoft.com/sql/relational-databases/performance-monitor/sql-server-access-methods-object",
      "threshold": 10,
      "condition": {
        "le": [
          "@scan_point_revalidations_sec",
          "@threshold"
        ]
      },
      "probes": [
        {
          "id": "BasicPerformance",
          "transform": {
            "type": "performance",
            "counters": {
              "scan_point_revalidations_sec": {
                "type": "rate"
              }
            }
          }
        }
      ]
    },
    {
      "id": "ServerTriggerRecursion",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "displayName": "Non-default value for 'server trigger recursion' option",
      "description": "The 'server trigger recursion' option controls whether to allow server-level triggers to fire recursively. When set to 0, server-level triggers cannot be fired recursively. The default value for this option is 1.",
      "message": "Review non-default value @{server_trigger_recursion} for the 'server trigger recursion' option",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/server-trigger-recursion-server-configuration-option",
      "level": "Information",
      "condition": "@server_trigger_recursion",
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "ShowAdvancedOptions",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "displayName": "Option 'show advanced options' is enabled",
      "description": "Some configuration options are designated as advanced options. By default, these options are not available for viewing and changing. When you set 'show advanced options' option to 1, you can list the advanced options by using 'sp_configure' system stored procedure. It is recommended to only use this state temporarily and switch back to 0 when done with the task that required viewing the advanced options.",
      "message": "Disable 'show advanced options' option",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/show-advanced-options-server-configuration-option",
      "level": "Information",
      "condition": {
        "eq": [
          "@show_advanced_options",
          0
        ]
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "SMOAndDMOXPs",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "displayName": "Option 'SMO and DMO XPs' is disabled",
      "description": "The 'SMO and DMO XPs' option determines whether SQL Server Management Objects (SMO) and SQL Server Distributed Management Objects (SQL-DMO) XPs are available. The default for this option is enabled to allow various tools and install packages, including SQL Server hotfixes, to work correctly.",
      "message": "Enable 'SMO and DMO XPs' option",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/smo-and-dmo-xps-server-configuration-option",
      "level": "Information",
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "condition": "@SMO_and_DMO_XPs",
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "SysAdminDefaultDatabase",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "displayName": "Sysadmin logins use non-master default database",
      "description": "This check verifies whether your SQL Sever logins are members of the 'System Administrators' role that use a non-master default database. Sysadmin logins that use a non-master default database impose administrative risks in cases when user databases are dropped.",
      "message": "Set sysadmin logins to use 'master' as default database",
      "level": "Low",
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "condition": {
        "not": "@default_database_name"
      },
      "probes": [
        {
          "id": "SysAdminDefaultDatabase",
          "transform": {
            "type": "aggregate",
            "map": {
              "default_database_name": "count"
            }
          }
        }
      ]
    },
    {
      "id": "TempDBFilesInitialSize",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer",
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "TempDB",
        "Performance",
        "DBFileConfiguration"
      ],
      "displayName": "Tempdb data files initial size",
      "description": "The size and physical placement of the tempdb database can affect the performance of a system. If the size that's defined for tempdb is too small, part of the system-processing load might be taken up with autogrowing tempdb. Space preallocation prevents tempdb from expanding too often, which affects performance.",
      "message": "Preallocate space for all tempdb files by setting the file size to a value large enough to accommodate the typical workload in the environment",
      "helpLink": "https://learn.microsoft.com/sql/relational-databases/databases/tempdb-database#optimizing-tempdb-performance-in-sql-server",
      "level": "Medium",
      "threshold": 8,
      "condition": {
        "gt": [
          "@size_mb",
          "@threshold"
        ]
      },
      "probes": [
        {
          "id": "DatabaseMasterFiles",
          "params": {
            "dbId": 2,
            "type": null
          },
          "transform": {
            "type": "aggregate",
            "map": {
              "size": "min"
            }
          }
        }
      ],
      "locals": {
        "size_mb": {
          "div": [
            {
              "mul": [
                "@size",
                8
              ]
            },
            1024
          ]
        }
      }
    },
    {
      "id": "TempDbSameVolume",
      "itemType": "definition",
      "target": {
        "type": "Database",
        "name": "tempdb",
        "platform": "Windows",
        "engineEdition": "SqlServer",
        "version": "[11.0,)",
        "machineType": {
          "not": "AzureVm"
        }
      },
      "tags": [
        "DefaultRuleset",
        "Performance",
        "DBFileConfiguration"
      ],
      "displayName": "Tempdb and user databases should not share volumes",
      "description": "The tempdb system database is used for temporary objects, internal objects and row versions. Tempdb is often heavily used when queries are executed and, if it has files placed on the same volume as user database files, there can be contention for the IO resources.",
      "message": "Place tempdb on a separate volume. Tempdb and user databases share volume @{volume_mount_point}",
      "helpLink": "https://docs.microsoft.com/sql/relational-databases/databases/tempdb-database",
      "level": "Medium",
      "probes": [
        {
          "id": "DatabaseSharedVolumes",
          "params": {
            "is_system_database": 0
          },
          "transform": [
            {
              "type": "aggregate",
              "group": "volume_mount_point"
            },
            {
              "type": "aggregate",
              "map": {
                "volume_mount_point": "join"
              }
            }
          ]
        }
      ]
    },
    {
      "id": "TwoDigitYearCutoff",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer, ManagedInstance",
        "platform": [
          "Windows",
          "Linux"
        ],
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "displayName": "Non-default value for 'two digit year cutoff' option",
      "description": "The 'two digit year cutoff' option is used to define the two digit year cutoff value when specifying two-digit years in place of four-digit years. Changing this to a non-default value could have unexpected results if the non-default value is inconsistent with other Microsoft SQL Server instances in your environment. This option is an advanced option and should be changed only by an experienced database administrator or certified SQL Server professional.",
      "message": "Set 'two digit year cutoff' option to default",
      "helpLink": "https://docs.microsoft.com/en-us/sql/database-engine/configure-windows/configure-the-two-digit-year-cutoff-server-configuration-option",
      "level": "Information",
      "condition": {
        "eq": [
          "@two_digit_year_cutoff",
          2049
        ]
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "UserConnections",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer, ManagedInstance",
        "platform": [
          "Windows",
          "Linux"
        ],
        "version": "[11.0,)"
      },
      "tags": [
        "DefaultRuleset",
        "Performance",
        "Configuration"
      ],
      "displayName": "Non-default value for 'user connections' option",
      "description": "The 'user connections' option is an advanced option and should be changed only by an experienced database administrator or certified SQL Server professional. Using the 'user connections' option helps avoid overloading the server with too many concurrent connections. You can estimate the number of connections based on system and user requirements.",
      "message": "Review non-default value @{user_connections} for the 'user connections' option",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/configure-the-user-connections-server-configuration-option",
      "level": "Information",
      "condition": {
        "eq": [
          "@user_connections",
          0
        ]
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "UserOptions",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "displayName": "Non-default value for 'user options' option",
      "description": "The 'user options' option defines the user option defaults, such as ARITHABORT, ANSI_WARNINGS, CONCAT_NULL_YIELDS_NULL. The bit positions in user options are identical to those in @@OPTIONS. Each connection has its own @@OPTIONS function, which represents the configuration environment. When logging in to Microsoft SQL Server, a user receives a default environment that assigns the current user options value to @@OPTIONS. Executing SET statements for user options affects the corresponding value in the session's @@OPTIONS function. All connections created after this setting is changed, receive the new value.",
      "message": "Review non-default value @{user_options} for the 'user options' option",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/configure-the-user-options-server-configuration-option",
      "level": "Information",
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "condition": {
        "eq": [
          "@user_options",
          0
        ]
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "WaitsForWorker",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "High Wait for the worker",
      "tags": [
        "DefaultRuleset",
        "Performance",
        "CPU"
      ],
      "description": "SQL Server Wait Statistics\\Wait for Worker counter indicates average time that each SQL Server session is waiting for a worker thread to become available. If the max worker thread setting is set to default, do not increase it. If you configure a number of worker threads to a value that is greater than the default, it is almost always counterproductive and slows performance because of scheduling and resource overhead. Instead, investigate the queries and batches that are holding the threads for the longest duration and engage in fine tuning those queries/batches. Only increase this setting under very unusual circumstances and when rigorous methodical testing demonstrates that it is useful to do so.",
      "message": "Investigate the queries and batches that are holding the threads for the longest duration and engage in fine tuning those queries/batches.Wait for the worker\\Average wait time (ms) (@{wait_for_the_worker}) is greater than @{threshold}",
      "helpLink": "https://learn.microsoft.com/sql/database-engine/configure-windows/configure-the-max-worker-threads-server-configuration-option",
      "threshold": 500,
      "condition": {
        "le": [
          "@wait_for_the_worker",
          "@threshold"
        ]
      },
      "probes": [
        {
          "id": "BasicPerformance",
          "transform": {
            "type": "performance",
            "counters": {
              "wait_for_the_worker": {
                "type": "average",
                "instance": "Average wait time (ms)"
              }
            }
          }
        }
      ]
    },
    {
      "id": "WaitsLogWrite",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "High transaction log disk response time",
      "tags": [
        "DefaultRuleset",
        "Performance"
      ],
      "description": "A high number of waits on Log Writes has been detected. Before any modification to a table can take place, SQL Server must write a record to the Transaction log. Any waits that occur during writes to the Transaction log will result in performance degradation. Evaluate disk performance to identify disk bottlenecks then correlate with SQL Server transactions and tune them.",
      "message": "Improve the disk response time for the drives where the Transaction log resides, especially for write operations, log write waits\\Average wait time (ms) (@{log_write_waits}) is greater than @{threshold}",
      "helpLink": "https://learn.microsoft.com/troubleshoot/sql/performance/troubleshoot-sql-io-performance#writelog",
      "threshold": 500,
      "condition": {
        "le": [
          "@log_write_waits",
          "@threshold"
        ]
      },
      "probes": [
        {
          "id": "BasicPerformance",
          "transform": {
            "type": "performance",
            "counters": {
              "log_write_waits": {
                "type": "average",
                "instance": "Average wait time (ms)"
              }
            }
          }
        }
      ]
    },
    {
      "id": "WaitsNetworkIO",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "High Network IO",
      "tags": [
        "DefaultRuleset",
        "Performance"
      ],
      "description": "Waits on the network I/O are frequently caused by clients not completely processing all data returned by a query or network saturation. Unprocessed results will sit in the output buffer and the SPID will show a wait type for the network I/O until all the results have been received by the client. This introduces the risk of performance degradation. Identify the queries that are waiting on the network I/O and ensure that clients are processing all the results of the query. If you have any network saturation between the server and the application, work to reduce that saturation increasing the number or speed of switches and network cards that are saturated",
      "message": "Investigate the cause of high Network I/O Waits and resolve the issues that you find, network IO waits\\Average wait time (ms) (@{network_io_waits}) is greater than @{threshold}",
      "helpLink": "https://learn.microsoft.com/troubleshoot/sql/performance/troubleshoot-query-async-network-io",
      "threshold": 500,
      "condition": {
        "le": [
          "@network_io_waits",
          "@threshold"
        ]
      },
      "probes": [
        {
          "id": "BasicPerformance",
          "transform": {
            "type": "performance",
            "counters": {
              "network_io_waits": {
                "type": "average",
                "instance": "Average wait time (ms)"
              }
            }
          }
        }
      ]
    },
    {
      "id": "WaitsNonPageLatch",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "High non-Page latch waits",
      "tags": [
        "DefaultRuleset",
        "Performance"
      ],
      "description": "The SQL Server Wait Statistics\\Non-Page Latch Waits counter indicates the average time that each SQL Server session is waiting on non-page latches. Latches are used to synchronize access to cached data pages and other in-memory objects. Typically, latches are only held briefly, and latch wait times should be correspondingly small. A high number for this counter means that many processes are waiting for latch classes that are not related to buffers which, depending on the latch class, could affect your workload.",
      "message": "Non-Page latch waits (@{non_page_latch_waits}) is greater than @{threshold}, take snapshots from sys.dm_os_latch_stats to identify the specific latch class, the identify the queries that are waiting on Non-Page latch and tune them",
      "helpLink": "https://learn.microsoft.com/sql/relational-databases/diagnose-resolve-latch-contention",
      "threshold": 500,
      "condition": {
        "le": [
          "@non_page_latch_waits",
          "@threshold"
        ]
      },
      "probes": [
        {
          "id": "BasicPerformance",
          "transform": {
            "type": "performance",
            "counters": {
              "non_page_latch_waits": {
                "type": "average",
                "instance": "Average wait time (ms)"
              }
            }
          }
        }
      ]
    },
    {
      "id": "WaitsPageIOLatch",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "High Page IO latch waits",
      "tags": [
        "DefaultRuleset",
        "Performance"
      ],
      "description": "The IO latches are a subset of BUF buffer latches that are used when the buffer and associated data page or the index page is in the middle of an I/O operation. PAGEIOLATCH wait types are used for disk-to-memory transfers and a significant wait time for these wait types suggests disk I/O subsystem issues.",
      "message": "Review the disk performance counters including Physical Disk: Disk Sec/Read and Disk Sec/Write and resolve the cause of the high SQL Server Page IO latch wait times (@{page_io_latch_waits} ms), and SQL Server Buffer Manager: Page Life Expectancy to investigate whether there are any disk subsystem issues, review index straegy and query plan for TOP queries with high number of logical reads",
      "helpLink": "https://learn.microsoft.com/troubleshoot/sql/performance/troubleshoot-sql-io-performance",
      "threshold": 500,
      "condition": {
        "le": [
          "@page_io_latch_waits",
          "@threshold"
        ]
      },
      "probes": [
        {
          "id": "BasicPerformance",
          "transform": {
            "type": "performance",
            "counters": {
              "page_io_latch_waits": {
                "type": "average",
                "instance": "Average wait time (ms)"
              }
            }
          }
        }
      ]
    },
    {
      "id": "WaitsPageLatch",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "High Page Latch waits",
      "tags": [
        "DefaultRuleset",
        "Performance"
      ],
      "description": "The SQL Server Wait Statistics\\Page Latch Waits counter indicates the average time that each SQL Server session is waiting for page latches, not including IO latches. Page Latch Waits can cause a bottleneck in your system and a corresponding adverse effect on performance.",
      "message": "Review latch contention, average page latch wait time is @{page_latch_waits} ms",
      "helpLink": "https://learn.microsoft.com/sql/relational-databases/diagnose-resolve-latch-contention",
      "threshold": 500,
      "condition": {
        "le": [
          "@page_latch_waits",
          "@threshold"
        ]
      },
      "probes": [
        {
          "id": "BasicPerformance",
          "transform": {
            "type": "performance",
            "counters": {
              "page_latch_waits": {
                "type": "average",
                "instance": "Average wait time (ms)"
              }
            }
          }
        }
      ]
    },
    {
      "id": "WorkfilesPerSec",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "High Workfiles Created per second",
      "tags": [
        "DefaultRuleset",
        "Performance",
        "Memory"
      ],
      "description": "Workfiles are created by hash operations, and used to store temporary results for hash joins and hash aggregations. SQL Server creates a work file in tempdb when the amount of data being processed is too big to fit into the available memory used for hash operations, and generates a hash warning as a result. Determine the queries that are generating hash warnings using Extended Events.To eliminate or reduce the frequency of hash recursion and bailouts, do one of the following: Make sure that statistics exist on the columns that are being joined or grouped. If statistics exist on the columns, make sure that these are updated. Tune the query to use a different type of join, namely by adding appropriate indexes. Increase available memory on the computer. Hash recursion or bailout occurs when there is not enough memory to process queries in place and they need to spill to disk. Creating or updating the statistics on the column involved in the join is the most effective way to reduce the number of hash recursion or bailouts that occur, namely when appropriate indexes are already in place.",
      "message": "Review query performance to reduce Workfiles Created per sec (@{workfiles_created_sec:0.##})",
      "helpLink": "https://learn.microsoft.com/sql/relational-databases/event-classes/hash-warning-event-class",
      "threshold": 0.2,
      "condition": {
        "or": [
          {
            "le": [
              "@batch_request_sec",
              100
            ]
          },
          {
            "le": [
              "@workfiles_created_sec",
              {
                "mul": [
                  "@batch_request_sec",
                  "@threshold"
                ]
              }
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "BasicPerformance",
          "alias": "br",
          "transform": {
            "type": "performance",
            "counters": {
              "batch_request_sec": "rate"
            }
          }
        },
        {
          "id": "BasicPerformance",
          "alias": "perfB",
          "transform": {
            "type": "performance",
            "counters": {
              "workfiles_created_sec": "rate"
            }
          }
        }
      ]
    },
    {
      "id": "WorkingSetSize",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)",
        "platform": [
          "Windows",
          "Linux"
        ]
      },
      "displayName": "Non-default value for 'set working set size' option",
      "description": "The 'set working set size' option has no effect and will be removed in a future version of Microsoft SQL Server. Avoid using this feature in new development work, and plan to modify applications that currently use this feature.",
      "message": "Review non-default value @{set_working_set_size} for the 'set working set size' option as it has no effect and will be removed in a future version",
      "helpLink": "https://docs.microsoft.com/sql/database-engine/configure-windows/set-working-set-size-server-configuration-option",
      "level": "Low",
      "tags": [
        "DefaultRuleset",
        "Configuration"
      ],
      "condition": {
        "not": "@set_working_set_size"
      },
      "probes": [
        "SysConfiguration"
      ]
    },
    {
      "id": "WorktablesFromCache",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "Low Worktables from Cache Ratio",
      "tags": [
        "DefaultRuleset",
        "Performance",
        "Memory"
      ],
      "description": "The Worktables From Cache Ratio counter records the percentage of worktables that were immediately available from the worktable cache. When a query execution plan is cached, the worktables needed by the plan are not dropped across multiple executions of the plan but only truncated. Because the worktable is cached, the next execution of the query is faster. When the system is low on memory, the execution plan may be removed from the cache and the associated worktables dropped as well.",
      "message": "Review application memory requirements, Worktables from Cache Ratio is (@{worktables_from_cache_ratio:P0})",
      "helpLink": "https://learn.microsoft.com/troubleshoot/sql/performance/troubleshoot-memory-issues",
      "threshold": 0.9,
      "condition": {
        "or": [
          {
            "le": [
              "@batch_request_sec",
              100
            ]
          },
          {
            "le": [
              "@worktables_created_sec",
              {
                "or": [
                  {
                    "mul": [
                      "@batch_request_sec",
                      0.2
                    ]
                  },
                  {
                    "ge": [
                      "@worktables_from_cache_ratio",
                      "@threshold"
                    ]
                  }
                ]
              }
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "BasicPerformance",
          "alias": "br",
          "transform": {
            "type": "performance",
            "counters": {
              "batch_request_sec": "rate"
            }
          }
        },
        {
          "id": "BasicPerformance",
          "alias": "perfB",
          "transform": {
            "type": "performance",
            "counters": {
              "worktables_created_sec": "rate"
            }
          }
        },
        {
          "id": "BasicPerformance",
          "alias": "perfC",
          "transform": {
            "type": "performance",
            "counters": {
              "worktables_from_cache_ratio": {
                "type": "ratio",
                "base": "worktables_from_cache_base"
              }
            }
          }
        }
      ]
    },
    {
      "id": "WorktablesPerSec",
      "itemType": "definition",
      "target": {
        "type": "Server",
        "platform": [
          "Windows",
          "Linux"
        ],
        "engineEdition": "SqlServer, ManagedInstance",
        "version": "[11.0,)"
      },
      "displayName": "High Worktables Created per second",
      "tags": [
        "DefaultRuleset",
        "Performance",
        "Memory"
      ],
      "description": "Worktables are internal tables that are used to hold intermediate results. Worktables are generated for certain GROUP BY, ORDER BY, or UNION queries. For example, if an ORDER BY clause references columns that are not covered by any indexes, the relational engine may need to generate a worktable to sort the result set into the order requested. Worktables are also sometimes used as spools that temporarily hold the result of executing a part of a query plan. Worktables are built in tempdb and are dropped automatically when they are no longer needed.",
      "message": "Review table and index strategy, and ensure index and statistics maintenance plans are in place, Worktables Created/sec (@{worktables_created_sec:0.##}) per Batch requests/sec (@{batch_request_sec:0.##}) is greater than @{threshold:P0}",
      "helpLink": "https://learn.microsoft.com/sql/relational-databases/performance-monitor/sql-server-access-methods-object",
      "threshold": 0.2,
      "condition": {
        "or": [
          {
            "le": [
              "@batch_request_sec",
              100
            ]
          },
          {
            "le": [
              "@worktables_created_sec",
              {
                "mul": [
                  "@batch_request_sec",
                  "@threshold"
                ]
              }
            ]
          }
        ]
      },
      "probes": [
        {
          "id": "BasicPerformance",
          "alias": "br",
          "transform": {
            "type": "performance",
            "counters": {
              "batch_request_sec": "rate"
            }
          }
        },
        {
          "id": "BasicPerformance",
          "alias": "perfB",
          "transform": {
            "type": "performance",
            "counters": {
              "worktables_created_sec": "rate"
            }
          }
        }
      ]
    }
  ],
  "probes": {
    "EnabledGlobalTraceFlags": [
      {
        "type": "SQL",
        "target": {
          "engineEdition": "SqlServer, ManagedInstance",
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "DECLARE @tracestatus TABLE (TraceFlag NVARCHAR(40), [Status] tinyint, [Global] tinyint, [Session] tinyint); INSERT INTO @tracestatus EXEC ('DBCC TRACESTATUS WITH NO_INFOMSGS'); IF NOT EXISTS(SELECT * FROM @tracestatus WHERE Global=1) SELECT 0 AS [TraceFlag], 0 AS [Status] ELSE SELECT [TraceFlag], [Status] FROM @tracestatus WHERE Global=1",
          "transform": {
            "type": "aggregate",
            "map": {
              "TraceFlag": "array"
            }
          }
        }
      }
    ],
    "CountBlackBoxTraces": [
      {
        "type": "SQL",
        "target": {
          "engineEdition": "SqlServer, ManagedInstance",
          "version": "[11.0,)"
        },
        "requires": {
          "server permission": [
            "ALTER TRACE"
          ]
        },
        "implementation": {
          "query": "SELECT COUNT(id) AS [BlackBoxTraceCount] FROM [sys].[traces] WITH (NOLOCK) WHERE [path] LIKE '%blackbox%.trc' AND status = 1;"
        }
      }
    ],
    "CountDefaultTraces": [
      {
        "type": "SQL",
        "target": {
          "engineEdition": "SqlServer, ManagedInstance",
          "version": "[11.0,)"
        },
        "requires": {
          "server permission": [
            "ALTER TRACE"
          ]
        },
        "implementation": {
          "query": "SELECT COUNT(id) AS [DefaultTraceCount] FROM [sys].[traces] WITH (NOLOCK) WHERE is_default = 1 AND status = 1;"
        }
      }
    ],
    "XEvent.SystemHealth": [
      {
        "type": "SQL",
        "target": {
          "engineEdition": "SqlServer, ManagedInstance",
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "SELECT COUNT(name) AS [XEvent.SystemHealthCount] FROM [sys].[dm_xe_sessions] WHERE [name] = 'system_health';"
        }
      }
    ],
    "XEvent.SPServerDiagnostics": [
      {
        "type": "SQL",
        "target": {
          "engineEdition": "SqlServer, ManagedInstance",
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "SELECT COUNT(name) AS [XEvent.SPServerDiagnostics] FROM sys.dm_xe_sessions WHERE [name] = 'sp_server_diagnostics session';"
        }
      }
    ],
    "DeprecatedFeaturesStats": [
      {
        "type": "SQL",
        "target": {
          "engineEdition": "SqlServer, ManagedInstance",
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "SELECT [instance_name] AS [DeprecatedFeature] FROM [sys].[dm_os_performance_counters] WHERE ([object_name] LIKE '%Deprecated Features%') AND ([cntr_value] > 0);",
          "transform": {
            "type": "aggregate",
            "map": {
              "DeprecatedFeature": "join"
            }
          }
        }
      }
    ],
    "DatabaseConfiguration": [
      {
        "type": "SQL",
        "target": {
          "type": "Database",
          "version": "[11.0,12.0)",
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer, ManagedInstance"
        },
        "implementation": {
          "query": "SELECT db.source_database_id, db.is_auto_create_stats_on, db.is_auto_update_stats_on, db.is_auto_update_stats_async_on, 0 AS query_store_state, db.collation_name, ( SELECT collation_name FROM master.sys.databases (NOLOCK) WHERE database_id = 1 ) AS master_collation, db.is_auto_close_on, db.is_auto_shrink_on, db.page_verify_option, db.is_db_chaining_on, NULL AS is_auto_create_stats_incremental_on, db.is_trustworthy_on, db.is_parameterization_forced, db.is_read_only AS IsReadOnly, db.[state] AS DbState, NULL AS [resource_pool_id], 0 AS [hekaton_count], db.state_desc AS DbStateDesc, db.recovery_model, db.is_in_standby FROM [sys].[databases] (NOLOCK) AS db WHERE db.[name] = @TargetName"
        }
      },
      {
        "type": "SQL",
        "target": {
          "type": "Database",
          "version": "[12.0, 13.0)",
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer, ManagedInstance"
        },
        "implementation": {
          "useDatabase": true,
          "query": "SELECT db.source_database_id, db.is_auto_create_stats_on, db.is_auto_update_stats_on, db.is_auto_update_stats_async_on, 0 AS query_store_state, db.collation_name, ( SELECT collation_name FROM master.sys.databases (NOLOCK) WHERE database_id = 1 ) AS master_collation, db.is_auto_close_on, db.is_auto_shrink_on, db.page_verify_option, db.is_db_chaining_on, db.is_auto_create_stats_incremental_on, db.is_trustworthy_on, db.is_parameterization_forced, db.is_read_only AS IsReadOnly, db.[state] AS DbState, db.[resource_pool_id], ( SELECT COUNT(object_id) FROM sys.tables (NOLOCK) WHERE is_memory_optimized = 1 ) AS [hekaton_count], db.state_desc AS DbStateDesc, db.recovery_model, db.is_in_standby FROM [sys].[databases] (NOLOCK) AS db WHERE db.[name] = @TargetName"
        }
      },
      {
        "type": "SQL",
        "target": {
          "type": "Database",
          "version": "[13.0,)",
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer, ManagedInstance"
        },
        "implementation": {
          "useDatabase": true,
          "query": "SELECT db.source_database_id, db.is_auto_create_stats_on, db.is_auto_update_stats_on, db.is_auto_update_stats_async_on, ( SELECT CAST(actual_state AS DECIMAL) FROM [sys].[database_query_store_options] ) AS query_store_state, db.collation_name, ( SELECT collation_name FROM master.sys.databases (NOLOCK) WHERE database_id = 1 ) AS master_collation, db.is_auto_close_on, db.is_auto_shrink_on, db.page_verify_option, db.is_db_chaining_on, db.is_auto_create_stats_incremental_on, db.is_trustworthy_on, db.is_parameterization_forced, db.is_read_only AS IsReadOnly, db.[state] AS DbState, db.[resource_pool_id], ( SELECT COUNT(object_id) FROM sys.tables (NOLOCK) WHERE is_memory_optimized = 1 ) AS [hekaton_count], db.state_desc AS DbStateDesc, db.recovery_model, db.is_in_standby FROM [sys].[databases] (NOLOCK) AS db WHERE db.[name] = @TargetName"
        }
      }
    ],
    "FKNoIndexes": [
      {
        "type": "SQL",
        "target": {
          "type": "Database",
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer, ManagedInstance",
          "version": "[11.0,)"
        },
        "implementation": {
          "useDatabase": true,
          "query": "SELECT QUOTENAME(OBJECT_SCHEMA_NAME(parent_object_id)) + '.' + QUOTENAME(OBJECT_NAME(parent_object_id)) AS TableName FROM ( SELECT FKC.parent_object_id, constraint_object_id, REPLACE(SUBSTRING((SELECT ',' + RTRIM(COL_NAME(k.parent_object_id,parent_column_id)) FROM sys.foreign_key_columns k (NOLOCK) INNER JOIN sys.foreign_keys (NOLOCK) ON k.constraint_object_id = [object_id] AND k.constraint_object_id = FKC.constraint_object_id ORDER BY constraint_column_id FOR XML PATH('')), 2, 8000), ' ,',',') AS [parent_columns] FROM sys.foreign_key_columns FKC (NOLOCK) INNER JOIN sys.objects o (NOLOCK) ON FKC.parent_object_id = o.[object_id] INNER JOIN sys.objects so (NOLOCK) ON FKC.referenced_object_id = so.[object_id] WHERE o.type = 'U' AND so.type = 'U' AND o.is_ms_shipped = 0 GROUP BY o.[schema_id],so.[schema_id],FKC.parent_object_id,constraint_object_id,referenced_object_id ) AS Const LEFT JOIN ( SELECT mst.[object_id], REPLACE(SUBSTRING(( SELECT ',' + RTRIM(ac.name) FROM sys.tables AS st (NOLOCK) INNER JOIN sys.indexes AS mi (NOLOCK) ON st.[object_id] = mi.[object_id] INNER JOIN sys.index_columns AS ic (NOLOCK) ON mi.[object_id] = ic.[object_id] AND mi.[index_id] = ic.[index_id] INNER JOIN sys.all_columns AS ac (NOLOCK) ON st.[object_id] = ac.[object_id] AND ic.[column_id] = ac.[column_id] WHERE i.[object_id] = mi.[object_id] AND i.index_id = mi.index_id AND ic.is_included_column = 0 ORDER BY ac.column_id FOR XML PATH('')), 2, 8000), ' ,',',') AS KeyCols FROM sys.indexes AS i (NOLOCK) INNER JOIN sys.tables AS mst (NOLOCK) ON mst.[object_id] = i.[object_id] WHERE i.[type] IN (1,2,5,6) AND i.is_unique_constraint = 0 AND mst.is_ms_shipped = 0 ) AS IdxConst ON Const.parent_object_id = IdxConst.[object_id] AND Const.parent_columns = IdxConst.KeyCols WHERE IdxConst.[object_id] IS NULL GROUP BY parent_object_id"
        }
      }
    ],
    "Hints.InstanceStatistics": [
      {
        "type": "SQL",
        "target": {
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer, ManagedInstance",
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "SELECT COUNT([counter]) AS [HintUsageCount] FROM [sys].[dm_exec_query_optimizer_info] WHERE ([counter] = 'order hint' OR [counter] = 'join hint') AND occurrence > 1;"
        }
      }
    ],
    "Hints.ModuleUsage": [
      {
        "type": "SQL",
        "target": {
          "type": "Database",
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer, ManagedInstance",
          "version": "[11.0,)"
        },
        "implementation": {
          "useDatabase": true,
          "query": "SELECT ss.name AS [Schema_Name], so.name AS [Object_Name], so.type_desc, CASE WHEN sm.[definition] LIKE '%FORCE ORDER%' THEN '[FORCE ORDER Hint]' WHEN sm.[definition] LIKE '%MERGE JOIN%' OR sm.[definition] LIKE '%LOOP JOIN%' OR sm.[definition] LIKE '%HASH JOIN%' THEN '[JOIN Hint]' END AS Hint FROM [sys].[sql_modules] AS sm WITH (NOLOCK) INNER JOIN [sys].[objects] AS so WITH (NOLOCK) ON sm.[object_id] = so.[object_id] INNER JOIN [sys].[schemas] AS ss WITH (NOLOCK) ON so.[schema_id] = ss.[schema_id] WHERE ( sm.[definition] LIKE '%FORCE ORDER%' OR sm.[definition] LIKE '%MERGE JOIN%' OR sm.[definition] LIKE '%LOOP JOIN%' OR sm.[definition] LIKE '%HASH JOIN%' ) AND OBJECTPROPERTY(sm.[object_id], 'IsMSShipped') = 0;"
        }
      }
    ],
    "CachedPlans.SingleUseRatio": [
      {
        "type": "SQL",
        "target": {
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer, ManagedInstance",
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "DECLARE @Size1 AS REAL, @Size2 AS REAL; SET @Size1=COALESCE((SELECT SUM(CAST(size_in_bytes AS bigint)) AS Size1 FROM [sys].[dm_exec_cached_plans] (NOLOCK) WHERE cacheobjtype LIKE '%Plan%' AND usecounts = 1),0);SET @Size2=COALESCE((SELECT SUM(CAST(size_in_bytes AS bigint)) AS Size2 FROM [sys].[dm_exec_cached_plans] (NOLOCK) WHERE cacheobjtype LIKE '%Plan%' AND usecounts > 1),0);SELECT @Size1/(@Size1+@Size2) AS [SingleUsePlansUseRatio];"
        }
      }
    ],
    "Hypothetical.Indexes": [
      {
        "type": "SQL",
        "target": {
          "type": "Database",
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer, ManagedInstance",
          "version": "[11.0,)"
        },
        "implementation": {
          "useDatabase": true,
          "query": "SELECT QUOTENAME(t.name) AS [Schema], QUOTENAME(o.[name]) AS [Object], i.name AS [IndexName] FROM [sys].[indexes] AS i WITH (NOLOCK) INNER JOIN [sys].[objects] AS o WITH (NOLOCK) ON o.[object_id] = i.[object_id] INNER JOIN [sys].[tables] AS mst WITH (NOLOCK) ON mst.[object_id] = i.[object_id] INNER JOIN [sys].[schemas] AS t WITH (NOLOCK) ON t.[schema_id] = mst.[schema_id] WHERE i.is_hypothetical = 1 and o.is_ms_shipped = 0;"
        }
      }
    ],
    "Hypothetical.Statistics": [
      {
        "type": "SQL",
        "target": {
          "type": "Database",
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer, ManagedInstance",
          "version": "[11.0,)"
        },
        "implementation": {
          "useDatabase": true,
          "query": "SELECT QUOTENAME(t.name) AS [Schema], QUOTENAME(o.[name]) AS [Object], s.name AS [StatName] FROM [sys].[stats] AS s WITH (NOLOCK) INNER JOIN [sys].[objects] AS o (NOLOCK) ON o.[object_id] = s.[object_id] INNER JOIN [sys].[tables] AS mst (NOLOCK) ON mst.[object_id] = s.[object_id] INNER JOIN [sys].[schemas] AS t (NOLOCK) ON t.[schema_id] = mst.[schema_id] WHERE ( s.name LIKE 'hind_%' OR s.name LIKE '_dta_stat%' ) AND auto_created = 0 AND s.name NOT IN ( SELECT name FROM sys.indexes ) AND o.[is_ms_shipped] = 0;"
        }
      }
    ],
    "SQLServerVersion": [
      {
        "type": "CLR",
        "name": "SQLServerVersion",
        "implementation": {
          "class": "Microsoft.SqlServer.Management.Assessment.Probes.ServerVersionProbe"
        }
      }
    ],
    "MissedIndexes": [
      {
        "type": "SQL",
        "target": {
          "type": "Database",
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer, ManagedInstance",
          "version": "[11.0,)"
        },
        "implementation": {
          "useDatabase": true,
          "query": "SELECT RIGHT( i.[statement], LEN(i.[statement]) -(LEN(m.[name]) + 3) ) AS [Table], CASE WHEN ( i.equality_columns IS NOT NULL AND i.inequality_columns IS NULL ) THEN i.equality_columns WHEN ( i.equality_columns IS NULL AND i.inequality_columns IS NOT NULL ) THEN i.inequality_columns ELSE i.equality_columns + ',' + i.inequality_columns END AS [KeyCols], ISNULL(i.included_columns, '') AS [IncludedCols], ( CONVERT(NUMERIC(19, 3), s.user_seeks) + CONVERT(NUMERIC(19, 3), s.user_scans) ) * CONVERT(NUMERIC(19, 3), s.avg_total_user_cost) * CONVERT(NUMERIC(19, 3), s.avg_user_impact) AS [Score] FROM [sys].[dm_db_missing_index_details] i INNER JOIN [master].[sys].[databases] AS m WITH (NOLOCK) ON i.database_id = m.database_id INNER JOIN [sys].[dm_db_missing_index_groups] g ON i.index_handle = g.index_handle INNER JOIN [sys].[dm_db_missing_index_group_stats] s ON s.group_handle = g.index_group_handle WHERE m.[name] = @TargetName AND OBJECTPROPERTY(i.[object_id], 'IsMSShipped') = 0"
        }
      }
    ],
    "DatabaseBackups": [
      {
        "type": "SQL",
        "target": {
          "type": "Database",
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer",
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "SELECT db.recovery_model, db.recovery_model_desc, fb.LastFullBackup, tl.LastTLBackup FROM [master].[sys].[databases] AS db WITH (NOLOCK) LEFT JOIN ( SELECT b.database_name, DATEDIFF(HH, MAX(b.backup_finish_date), GETDATE()) AS LastFullBackup FROM [msdb].[dbo].[backupset] AS b WITH (NOLOCK) WHERE b.is_copy_only = 0 AND b.type = 'D' GROUP BY b.database_name ) fb ON fb.database_name = db.name LEFT JOIN ( SELECT b.database_name, DATEDIFF(HH, MAX(b.backup_finish_date), GETDATE()) AS LastTLBackup FROM [msdb].[dbo].[backupset] AS b WITH (NOLOCK) WHERE b.is_copy_only = 0 AND b.type = 'L' GROUP BY b.database_name HAVING MAX(b.backup_finish_date) >=( SELECT MAX(f.backup_finish_date) FROM [msdb].[dbo].[backupset] AS f WITH (NOLOCK) WHERE f.is_copy_only = 0 AND f.type IN ('D', 'I') AND f.database_name = b.database_name GROUP BY f.database_name ) ) tl ON fb.database_name = tl.database_name WHERE db.name = @TargetName;"
        }
      }
    ],
    "TempDBFiles": [
      {
        "type": "SQL",
        "target": {
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer, ManagedInstance",
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "SELECT COUNT(DISTINCT size) AS filesizeCount FROM tempdb.sys.database_files WITH (NOLOCK) WHERE [type] = 0"
        }
      }
    ],
    "ServerInstanceConfiguration": [
      {
        "type": "SQL",
        "target": {
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer, ManagedInstance",
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "SELECT ( SELECT COUNT(cpu_id) FROM sys.dm_os_schedulers WHERE is_online = 1 AND scheduler_id < 255 AND parent_node_id < 64 ) AS online_logical_processors, ( SELECT COUNT(DISTINCT parent_node_id) FROM sys.dm_os_schedulers WHERE scheduler_id < 255 AND parent_node_id < 64 ) AS numa_nodes, ( SELECT COUNT(*) FROM ( SELECT COUNT(cpu_id) CpuNodeCnt FROM sys.dm_os_schedulers WHERE is_online = 1 AND scheduler_id < 255 AND parent_node_id < 64 GROUP BY parent_node_id, is_online HAVING COUNT(cpu_id) = 1 ) AS Node_CPU ) AS nodes_single_cpu, ( SELECT COUNT(cpu_id) FROM sys.dm_os_schedulers WHERE scheduler_id < 255 AND parent_node_id < 64 ) AS total_logical_processors"
        }
      }
    ],
    "DatabaseMasterFiles": [
      {
        "type": "SQL",
        "target": {
          "type": "Server",
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer, ManagedInstance",
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "SELECT mf.database_id, dbs.name AS databaseName, [type], [type_desc], physical_name, mf.name AS fileName, size, growth, is_percent_growth, mf.max_size, volume_mount_point, volume_id FROM [sys].[master_files] AS mf WITH (NOLOCK) INNER JOIN [sys].databases AS dbs WITH (NOLOCK) ON mf.database_id = dbs.database_id CROSS APPLY sys.dm_os_volume_stats(mf.database_id, mf.file_id) WHERE mf.database_id = ISNULL(@dbId, mf.database_id) AND [type] = ISNULL(@type, [type])"
        }
      },
      {
        "type": "SQL",
        "target": {
          "type": "Database",
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer, ManagedInstance",
          "version": "[11.0,)"
        },
        "implementation": {
          "useDatabase": true,
          "query": "SELECT df.[type], physical_name, df.name AS fileName, size, growth, is_percent_growth, ISNULL(FILEPROPERTY(df.name, 'SpaceUsed'), 0) AS spaceUsed, volume_mount_point, volume_id FROM [sys].[database_files] AS df WITH (NOLOCK) CROSS APPLY sys.dm_os_volume_stats(DB_ID(), df.file_id) WHERE df.[type] = ISNULL(@type, df.[type]) AND is_percent_growth = ISNULL(@is_percent_growth, is_percent_growth)"
        }
      }
    ],
    "InstantFileInitialization": [
      {
        "type": "SQL",
        "target": {
          "version": [
            "[11.0.7001,12.0)",
            "[12.0.6024,13.0)",
            "[13.0.4001,)"
          ],
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer, ManagedInstance"
        },
        "implementation": {
          "query": "SELECT instant_file_initialization_enabled FROM [sys].[dm_server_services] WHERE servicename LIKE 'SQL Server (%)' COLLATE DATABASE_DEFAULT"
        }
      },
      {
        "type": "SQL",
        "target": {
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer, ManagedInstance",
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "SELECT 'N' AS instant_file_initialization_enabled"
        }
      }
    ],
    "IndexesDefinitions": [
      {
        "type": "SQL",
        "target": {
          "type": "Database",
          "version": "[11.0,)",
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer, ManagedInstance"
        },
        "implementation": {
          "useDatabase": true,
          "query": "SELECT i.object_id, QUOTENAME(t.name) + '.' + QUOTENAME(st.name) AS TableName, QUOTENAME(i.name) AS IndexName, QUOTENAME(ac.Name) AS ColumnName, ic.is_included_column, i.is_primary_key, i.filter_definition, i.is_unique, ic.key_ordinal, CASE sty.name WHEN 'nvarchar' THEN ac.max_length / 2 ELSE ac.max_length END AS ColTypeSize, i.fill_factor, i.is_disabled, i.type AS IndexType, ISNULL(index_stat.Hits, 0) AS [Hits], ISNULL(index_stat.Reads_Ratio, 0) AS Reads_Ratio FROM [sys].[tables] AS st WITH (NOLOCK) INNER JOIN [sys].[schemas] AS t WITH (NOLOCK) ON t.[schema_id] = st.[schema_id] INNER JOIN [sys].[indexes] AS i WITH (NOLOCK) ON st.[object_id] = i.[object_id] INNER JOIN [sys].[index_columns] AS ic WITH (NOLOCK) ON i.[object_id] = ic.[object_id] AND i.[index_id] = ic.[index_id] INNER JOIN [sys].[all_columns] AS ac WITH (NOLOCK) ON st.[object_id] = ac.[object_id] AND ic.[column_id] = ac.[column_id] INNER JOIN [sys].[types] AS sty WITH (NOLOCK) ON ac.user_type_id = sty.user_type_id LEFT JOIN( SELECT s.object_id, s.index_id, ( stat.user_seeks + stat.user_scans + stat.user_lookups ) AS [Hits], CAST( CASE WHEN ( stat.user_seeks + stat.user_scans + stat.user_lookups ) = 0 THEN 0 ELSE CONVERT( REAL, ( stat.user_seeks + stat.user_scans + stat.user_lookups ) ) * 100 /CASE ( stat.user_seeks + stat.user_scans + stat.user_lookups + stat.user_updates ) WHEN 0 THEN 1 ELSE CONVERT( REAL, ( stat.user_seeks + stat.user_scans + stat.user_lookups + stat.user_updates ) ) END END AS DECIMAL(18, 2) ) AS [Reads_Ratio] FROM sys.indexes AS s WITH (NOLOCK) INNER JOIN sys.dm_db_index_usage_stats stat on stat.object_id = s.object_id and stat.index_id = s.index_id WHERE s.type IN (2, 6) AND s.is_primary_key = 0 AND s.is_unique_constraint = 0 GROUP BY s.object_id, s.index_id, stat.user_seeks, stat.user_scans, stat.user_lookups, stat.user_updates ) index_stat ON index_stat.object_id = i.object_id AND index_stat.index_id = i.index_id WHERE i.type IN (1, 2, 5, 6) AND st.is_ms_shipped = 0 AND i.is_unique_constraint = 0",
          "transform": {
            "type": "indexDefinition"
          }
        }
      }
    ],
    "UserObjectsCountInMasterDB": [
      {
        "type": "SQL",
        "target": {
          "type": "Database",
          "name": "master",
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "SELECT sao.name AS [Object_Name] FROM master.sys.all_objects AS sao WITH (NOLOCK) INNER JOIN master.sys.schemas AS ss WITH (NOLOCK) ON sao.[schema_id] = ss.[schema_id] WHERE sao.is_ms_shipped = 0 AND sao.[type] IN ('AF', 'FN', 'P', 'IF', 'PC', 'TF', 'TR', 'T', 'V') ORDER BY sao.name, sao.type_desc;",
          "transform": {
            "type": "aggregate",
            "map": {
              "Object_Name": "join"
            }
          }
        }
      }
    ],
    "Autogrow1GB": [
      {
        "type": "SQL",
        "target": {
          "type": "Database",
          "version": "[13.0.4001,)",
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer, ManagedInstance"
        },
        "implementation": {
          "query": "DECLARE @ifi bit IF ( SELECT instant_file_initialization_enabled FROM sys.dm_server_services WHERE servicename LIKE 'SQL Server (%)' COLLATE DATABASE_DEFAULT ) = 'Y' SET @ifi = 1; ELSE SET @ifi = 0; SELECT mf.[name] AS FileName FROM [sys].[master_files] AS mf (NOLOCK) INNER JOIN [sys].[databases] as dbs (NOLOCK) ON mf.database_id = dbs.database_id WHERE [type] >= CASE WHEN @ifi = 1 THEN 1 ELSE 0 END AND [type] < 2 AND ((is_percent_growth = 1 AND ((CONVERT(bigint,size)*8)*growth)/100 > 1048576) OR (is_percent_growth = 0 AND growth*8 > 1048576)) AND dbs.name = @TargetName",
          "transform": {
            "type": "aggregate",
            "map": {
              "FileName": "join"
            }
          }
        }
      }
    ],
    "CpuIdle": [
      {
        "type": "SQL",
        "target": {
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer, ManagedInstance",
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "DECLARE @ts_now bigint; SELECT @ts_now=ms_ticks FROM sys.dm_os_sys_info (NOLOCK); SELECT ISNULL(MIN(SystemIdle),100) AS MinIdle FROM (SELECT AVG(SystemIdle) AS SystemIdle FROM (SELECT record.value('(./Record/SchedulerMonitorEvent/SystemHealth/SystemIdle)[1]', 'int') AS SystemIdle, [TIMESTAMP] FROM (SELECT [TIMESTAMP], CONVERT(xml, record) AS record FROM sys.dm_os_ring_buffers (NOLOCK) WHERE ring_buffer_type = N'RING_BUFFER_SCHEDULER_MONITOR' AND record LIKE '%<SystemHealth>%' AND @ts_now-[TIMESTAMP]<=7200000) AS xrb) AS si GROUP BY (@ts_now-[TIMESTAMP])/600000) AS avg;"
        }
      }
    ],
    "ReplicationErrors": [
      {
        "type": "SQL",
        "target": {
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer, ManagedInstance",
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "DECLARE @cmd NVARCHAR(max) = N''; SELECT @cmd = @cmd + N' USE ' + QUOTENAME([name]) + N'; SELECT msa.publisher_db ,msa.publication FROM dbo.MSdistribution_history AS msh WITH (NOLOCK) INNER JOIN dbo.MSrepl_errors AS mse WITH (NOLOCK) ON mse.id = msh.error_id INNER JOIN dbo.MSdistribution_agents AS msa WITH (NOLOCK) ON msh.agent_id = msa.id WHERE mse.time >= DATEADD(hh, - 24, GETDATE()) GROUP BY msa.publisher_db ,msa.publication;' FROM [master].sys.databases WITH (NOLOCK) WHERE is_distributor = 1; EXEC (@cmd);"
        }
      }
    ],
    "SysAlerts": [
      {
        "type": "SQL",
        "target": {
          "engineEdition": "SqlServer, ManagedInstance",
          "version": "[11.0,)"
        },
        "requires": {
          "object permission on [msdb].[dbo].[sysalerts]": [
            "SELECT"
          ]
        },
        "implementation": {
          "query": "SELECT DISTINCT severity, message_id FROM [msdb].[dbo].[sysalerts] WITH (NOLOCK)",
          "transform": {
            "type": "aggregate",
            "map": {
              "severity": "array",
              "message_id": "array"
            }
          }
        }
      }
    ],
    "WeakPassword": [
      {
        "type": "SQL",
        "target": {
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer, ManagedInstance",
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "DECLARE @word TABLE (word NVARCHAR(50)); INSERT INTO @word VALUES ('0') ,('012') ,('0123') ,('01234') ,('012345') ,('0123456') ,('01234567') ,('012345678') ,('0123456789') ,('01234567890') ,('11111') ,('111111') ,('1111111') ,('11111111') ,('21') ,('321') ,('4321') ,('54321') ,('654321') ,('7654321') ,('87654321') ,('987654321') ,('0987654321') ,('pwd') ,('Password') ,('password') ,('P@ssw0rd') ,('p@ssw0rd') ,('Teste') ,('teste') ,('Test') ,('test') ,('') ,('p@wd') ,('Qwerty') ,('qwerty') ,('Password1') ,('password1'); SELECT RTRIM(s.[name]) AS [PasswordData] FROM [master].sys.sql_logins AS s WITH (NOLOCK) LEFT JOIN @word AS d ON PWDCOMPARE(d.word, s.[password_hash]) = 1 WHERE ( d.word IS NOT NULL OR PWDCOMPARE(RTRIM(RTRIM(s.[name])), s.[password_hash]) = 1 OR ( ( s.[password_hash] IS NULL OR s.[is_policy_checked] = 0 OR s.[is_expiration_checked] = 0 ) AND s.[name] NOT IN ( 'MSCRMSqlClrLogin' ,'##MS_SmoExtendedSigningCertificate##' ,'##MS_PolicyEventProcessingLogin##' ,'##MS_PolicySigningCertificate##' ,'##MS_PolicyTsqlExecutionLogin##' ,'##MS_SQLResourceSigningCertificate##' ,'##MS_SQLReplicationSigningCertificate##' ,'##MS_SQLAuthenticatorCertificate##' ,'##MS_AgentSigningCertificate##' ,'##MS_SQLEnableSystemAssemblyLoadingUser##' ) ) ) AND s.is_disabled = ISNULL(@is_disabled, s.is_disabled)",
          "transform": {
            "type": "aggregate",
            "map": {
              "PasswordData": "join"
            }
          }
        }
      }
    ],
    "VLF": [
      {
        "type": "SQL",
        "target": {
          "type": "Database",
          "engineEdition": "SqlServer, ManagedInstance",
          "version": "[11.0,)"
        },
        "requires": {
          "role": [
            "sysadmin"
          ]
        },
        "implementation": {
          "query": "DBCC LOGINFO (@TargetName) WITH NO_INFOMSGS"
        }
      }
    ],
    "BadNamingSP": [
      {
        "type": "SQL",
        "target": {
          "type": "Database",
          "engineEdition": "SqlServer, ManagedInstance",
          "version": "[11.0,)"
        },
        "implementation": {
          "useDatabase": true,
          "query": "SELECT s.[name] + '.' + so.[name] AS ObjectName FROM sys.objects AS so WITH (NOLOCK) INNER JOIN sys.schemas AS s WITH (NOLOCK) ON so.schema_id = s.schema_id WHERE so.is_ms_shipped = 0 AND [type] = 'P' AND so.[name] LIKE 'sp[_]%' AND so.[name] NOT IN ( 'sp_alterdiagram', 'sp_creatediagram', 'sp_dropdiagram', 'sp_helpdiagramdefinition', 'sp_helpdiagrams', 'sp_renamediagram', 'sp_upgraddiagrams' );",
          "transform": {
            "type": "aggregate",
            "map": {
              "ObjectName": "join"
            }
          }
        }
      }
    ],
    "BadNamingSpecialChars": [
      {
        "type": "SQL",
        "target": {
          "type": "Database",
          "engineEdition": "SqlServer, ManagedInstance",
          "version": "[11.0,)"
        },
        "implementation": {
          "useDatabase": true,
          "query": "SELECT s.[name] + '.' + so.[name] as ObjectName FROM sys.objects AS so WITH (NOLOCK) INNER JOIN sys.schemas AS s WITH (NOLOCK) ON so.schema_id = s.schema_id WHERE so.is_ms_shipped = 0 AND [type] <> 'S' AND ( so.[name] LIKE '% %' OR so.[name] LIKE '%[[]%' OR so.[name] LIKE '%]%' OR so.[name] LIKE '%-%' OR so.[name] LIKE '%.%' OR so.[name] LIKE '%,%' OR so.[name] LIKE '%;%' OR so.[name] LIKE '%' + CHAR(34) + '%' OR so.[name] LIKE '%' + CHAR(39) + '%' );",
          "transform": {
            "type": "aggregate",
            "map": {
              "ObjectName": "join"
            }
          }
        }
      }
    ],
    "BadNamingSpecialCharsColumns": [
      {
        "type": "SQL",
        "target": {
          "type": "Database",
          "engineEdition": "SqlServer, ManagedInstance",
          "version": "[11.0,)"
        },
        "implementation": {
          "useDatabase": true,
          "query": "SELECT s.name + '.' + so.name + '.' + sc.name AS ObjectName FROM sys.columns AS sc WITH (NOLOCK) INNER JOIN sys.objects AS so WITH (NOLOCK) ON sc.object_id = so.object_id INNER JOIN sys.schemas AS s WITH (NOLOCK) ON so.schema_id = s.schema_id WHERE so.is_ms_shipped = 0 AND ( sc.[name] LIKE '% %' OR sc.[name] LIKE '%[[]%' OR sc.[name] LIKE '%]%' OR sc.[name] LIKE '%-%' OR sc.[name] LIKE '%.%' OR sc.[name] LIKE '%,%' OR sc.[name] LIKE '%;%' OR sc.[name] LIKE '%' + CHAR(34) + '%' OR sc.[name] LIKE '%' + CHAR(39) + '%' ) ORDER BY 1;",
          "transform": {
            "type": "aggregate",
            "map": {
              "ObjectName": "join"
            }
          }
        }
      }
    ],
    "BadNamingUserFunctions": [
      {
        "type": "SQL",
        "target": {
          "type": "Database",
          "engineEdition": "SqlServer, ManagedInstance",
          "version": "[11.0,)"
        },
        "implementation": {
          "useDatabase": true,
          "query": "SELECT s.name + '.' + so.name AS ObjectName FROM sys.objects AS so WITH (NOLOCK) INNER JOIN sys.schemas AS s WITH (NOLOCK) ON so.schema_id = s.schema_id WHERE so.is_ms_shipped = 0 AND [type] IN ('FN', 'FS', 'TF', 'IF') AND so.[name] LIKE 'fn[_]%' AND so.[name] NOT IN ('fn_diagram_objects')",
          "transform": {
            "type": "aggregate",
            "map": {
              "ObjectName": "join"
            }
          }
        }
      }
    ],
    "BadNamingKeywords": [
      {
        "type": "SQL",
        "target": {
          "type": "Database",
          "engineEdition": "SqlServer, ManagedInstance",
          "version": "[11.0,)"
        },
        "implementation": {
          "useDatabase": true,
          "query": [
            "DECLARE @KeywordTbl AS TABLE(Keyword VARCHAR(255)) INSERT INTO @KeywordTbl VALUES ('ABSOLUTE'), ('ACTION'), ('ADA'), ('ADD'), ('ADMIN'), ('AFTER'), ('AGGREGATE'), ('ALIAS'), ('ALL'), ('ALLOCATE'), ('ALTER'), ('AND'), ('ANY'), ('ARE'), ('ARRAY'), ('AS'), ('ASC'), ('ASSERTION'), ('AT'), ('AUTHORIZATION'), ('AVG'), ('BACKUP'), ('BEFORE'), ('BEGIN'), ('BETWEEN'), ('BINARY'), ('BIT'), ('BIT_LENGTH'), ('BLOB'), ('BOOLEAN'), ('BOTH'), ('BREADTH'), ('BREAK'), ('BROWSE'), ('BULK'), ('BY'), ('CALL'), ('CASCADE'), ('CASCADED'), ('CASE'), ('CAST'), ('CATALOG'), ('CHAR'), ('CHAR_LENGTH'), ('CHARACTER'), ('CHARACTER_LENGTH'), ('CHECK'), ('CHECKPOINT'), ('CLASS'), ('CLOB'), ('CLOSE'), ('CLUSTERED'), ('COALESCE'), ('COLLATE'), ('COLLATION'), ('COLUMN'), ('COMMIT'), ('COMPLETION'), ('COMPUTE'), ('CONNECT'), ('CONNECTION'), ('CONSTRAINT'), ('CONSTRAINTS'), ('CONSTRUCTOR'), ('CONTAINS'), ('CONTAINSTABLE'), ('CONTINUE'), ('CONVERT'), ('CORRESPONDING'), ('COUNT'), ('CREATE'), ('CROSS'), ('CUBE'), ('CURRENT'), ('CURRENT_DATE'), ('CURRENT_PATH'), ('CURRENT_ROLE'), ('CURRENT_TIME'), ('CURRENT_TIMESTAMP'), ('CURRENT_USER'), ('CURSOR'), ('CYCLE'), ('DATA'), ('DATABASE'), ('DATE'), ('DAY'), ('DBCC'), ('DEALLOCATE'), ('DEC'), ('DECIMAL'), ('DECLARE'), ('DEFAULT'), ('DEFERRABLE'), ('DEFERRED'), ('DELETE'), ('DENY'), ('DEPTH'), ('DEREF'), ('DESC'), ('DESCRIBE'), ('DESCRIPTOR'), ('DESTROY'), ('DESTRUCTOR'), ('DETERMINISTIC'), ('DIAGNOSTICS'), ('DICTIONARY'), ('DISCONNECT'), ('DISK'), ('DISTINCT'), ('DISTRIBUTED'), ('DOMAIN'), ('DOUBLE'), ('DROP'), ('DUMMY'), ('DUMP'), ('DYNAMIC') SELECT [schema]+'.'+[ObjName] AS ObjectName FROM ( SELECT s.name [schema], so.name [ObjName], type, type_desc FROM sys.objects AS so WITH (NOLOCK) INNER JOIN sys.schemas AS s WITH (NOLOCK) ON so.schema_id = s.schema_id WHERE so.is_ms_shipped = 0 AND [type] <> 'S') AS ObjNames CROSS JOIN @KeywordTbl WHERE ObjName like '% '+Keyword+' %' COLLATE DATABASE_DEFAULT OR ObjName like '% '+Keyword COLLATE DATABASE_DEFAULT OR ObjName = Keyword COLLATE DATABASE_DEFAULT",
            "DECLARE @KeywordTbl AS TABLE(Keyword VARCHAR(255)) INSERT INTO @KeywordTbl VALUES ('EACH'), ('ELSE'), ('END'), ('END-EXEC'), ('EQUALS'), ('ERRLVL'), ('ESCAPE'), ('EVERY'), ('EXCEPT'), ('EXCEPTION'), ('EXEC'), ('EXECUTE'), ('EXISTS'), ('EXIT'), ('EXTERNAL'), ('EXTRACT'), ('FALSE'), ('FETCH'), ('FILE'), ('FILLFACTOR'), ('FIRST'), ('FLOAT'), ('FOR'), ('FOREIGN'), ('FORTRAN'), ('FOUND'), ('FREE'), ('FREETEXT'), ('FREETEXTTABLE'), ('FROM'), ('FULL'), ('FULLTEXTTABLE'), ('FUNCTION'), ('GENERAL'), ('GET'), ('GLOBAL'), ('GO'), ('GOTO'), ('GRANT'), ('GROUP'), ('GROUPING'), ('HAVING'), ('HOLDLOCK'), ('HOST'), ('HOUR'), ('IDENTITY'), ('IDENTITY_INSERT'), ('IDENTITYCOL'), ('IF'), ('IGNORE'), ('IMMEDIATE'), ('IN'), ('INCLUDE'), ('INDEX'), ('INDICATOR'), ('INITIALIZE'), ('INITIALLY'), ('INNER'), ('INOUT'), ('INPUT'), ('INSENSITIVE'), ('INSERT'), ('INT'), ('INTEGER'), ('INTERSECT'), ('INTERVAL'), ('INTO'), ('IS'), ('ISOLATION'), ('ITERATE'), ('JOIN'), ('KEY'), ('KILL'), ('LANGUAGE'), ('LARGE'), ('LAST'), ('LATERAL'), ('LEADING'), ('LEFT'), ('LESS'), ('LEVEL'), ('LIKE'), ('LIMIT'), ('LINENO'), ('LOAD'), ('LOCAL'), ('LOCALTIME'), ('LOCALTIMESTAMP'), ('LOCATOR'), ('LOWER'), ('MAP'), ('MATCH'), ('MAX'), ('MIN'), ('MINUTE'), ('MODIFIES'), ('MODIFY'), ('MODULE'), ('MONTH') SELECT [schema]+'.'+[ObjName] AS ObjectName FROM ( SELECT s.name [schema], so.name [ObjName], type, type_desc FROM sys.objects AS so WITH (NOLOCK) INNER JOIN sys.schemas AS s WITH (NOLOCK) ON so.schema_id = s.schema_id WHERE so.is_ms_shipped = 0 AND [type] <> 'S') AS ObjNames CROSS JOIN @KeywordTbl WHERE ObjName like '% '+Keyword+' %' COLLATE DATABASE_DEFAULT OR ObjName like '% '+Keyword COLLATE DATABASE_DEFAULT OR ObjName = Keyword COLLATE DATABASE_DEFAULT",
            "DECLARE @KeywordTbl AS TABLE(Keyword VARCHAR(255)) INSERT INTO @KeywordTbl VALUES ('NAMES'), ('NATIONAL'), ('NATURAL'), ('NCHAR'), ('NCLOB'), ('NEW'), ('NEXT'), ('NO'), ('NOCHECK'), ('NONCLUSTERED'), ('NONE'), ('NOT'), ('NULL'), ('NULLIF'), ('NUMERIC'), ('OBJECT'), ('OCTET_LENGTH'), ('OF'), ('OFF'), ('OFFSETS'), ('OLD'), ('ON'), ('ONLY'), ('OPEN'), ('OPENDATASOURCE'), ('OPENQUERY'), ('OPENROWSET'), ('OPENXML'), ('OPERATION'), ('OPTION'), ('OR'), ('ORDER'), ('ORDINALITY'), ('OUT'), ('OUTER'), ('OUTPUT'), ('OVER'), ('OVERLAPS'), ('PAD'), ('PARAMETER'), ('PARAMETERS'), ('PARTIAL'), ('PASCAL'), ('PATH'), ('PERCENT'), ('PLAN'), ('POSITION'), ('POSTFIX'), ('PRECISION'), ('PREFIX'), ('PREORDER'), ('PREPARE'), ('PRESERVE'), ('PRIMARY'), ('PRINT'), ('PRIOR'), ('PRIVILEGES'), ('PROC'), ('PROCEDURE'), ('PUBLIC'), ('RAISERROR'), ('READ'), ('READS'), ('READTEXT'), ('REAL'), ('RECONFIGURE'), ('RECURSIVE'), ('REF'), ('REFERENCES'), ('REFERENCING'), ('RELATIVE'), ('REPLICATION'), ('RESTORE'), ('RESTRICT'), ('RESULT'), ('RETURN'), ('RETURNS'), ('REVOKE'), ('RIGHT'), ('ROLE'), ('ROLLBACK'), ('ROLLUP'), ('ROUTINE'), ('ROW'), ('ROWCOUNT'), ('ROWGUIDCOL'), ('ROWS'), ('RULE') SELECT [schema]+'.'+[ObjName] AS ObjectName FROM ( SELECT s.name [schema], so.name [ObjName], type, type_desc FROM sys.objects AS so WITH (NOLOCK) INNER JOIN sys.schemas AS s WITH (NOLOCK) ON so.schema_id = s.schema_id WHERE so.is_ms_shipped = 0 AND [type] <> 'S') AS ObjNames CROSS JOIN @KeywordTbl WHERE ObjName like '% '+Keyword+' %' COLLATE DATABASE_DEFAULT OR ObjName like '% '+Keyword COLLATE DATABASE_DEFAULT OR ObjName = Keyword COLLATE DATABASE_DEFAULT",
            "DECLARE @KeywordTbl AS TABLE(Keyword VARCHAR(255)) INSERT INTO @KeywordTbl VALUES ('SAVE'), ('SAVEPOINT'), ('SCHEMA'), ('SCOPE'), ('SCROLL'), ('SEARCH'), ('SECOND'), ('SECTION'), ('SELECT'), ('SEQUENCE'), ('SESSION'), ('SESSION_USER'), ('SET'), ('SETS'), ('SETUSER'), ('SHUTDOWN'), ('SIZE'), ('SMALLINT'), ('SOME'), ('SPACE'), ('SPECIFIC'), ('SPECIFICTYPE'), ('SQL'), ('SQLCA'), ('SQLCODE'), ('SQLERROR'), ('SQLEXCEPTION'), ('SQLSTATE'), ('SQLWARNING'), ('START'), ('STATE'), ('STATEMENT'), ('STATIC'), ('STATISTICS'), ('STRUCTURE'), ('SUBSTRING'), ('SUM'), ('SYSTEM_USER'), ('TABLE'), ('TEMPORARY'), ('TERMINATE'), ('TEXTSIZE'), ('THAN'), ('THEN'), ('TIME'), ('TIMESTAMP'), ('TIMEZONE_HOUR'), ('TIMEZONE_MINUTE'), ('TO'), ('TOP'), ('TRAILING'), ('TRAN'), ('TRANSACTION'), ('TRANSLATE'), ('TRANSLATION'), ('TREAT'), ('TRIGGER'), ('TRIM'), ('TRUE'), ('TRUNCATE'), ('UNDER'), ('UNION'), ('UNIQUE'), ('UNKNOWN'), ('UNNEST'), ('UPDATE'), ('UPDATETEXT'), ('UPPER'), ('USAGE'), ('USE'), ('USER'), ('USING'), ('VALUE'), ('VALUES'), ('VARCHAR'), ('VARIABLE'), ('VARYING'), ('VIEW'), ('WAITFOR'), ('WHEN'), ('WHENEVER'), ('WHERE'), ('WHILE'), ('WITH'), ('WITHOUT'), ('WORK'), ('WRITE'), ('WRITETEXT'), ('YEAR'), ('ZONE') SELECT [schema]+'.'+[ObjName] AS ObjectName FROM ( SELECT s.name [schema], so.name [ObjName], type, type_desc FROM sys.objects AS so WITH (NOLOCK) INNER JOIN sys.schemas AS s WITH (NOLOCK) ON so.schema_id = s.schema_id WHERE so.is_ms_shipped = 0 AND [type] <> 'S') AS ObjNames CROSS JOIN @KeywordTbl WHERE ObjName like '% '+Keyword+' %' COLLATE DATABASE_DEFAULT OR ObjName like '% '+Keyword COLLATE DATABASE_DEFAULT OR ObjName = Keyword COLLATE DATABASE_DEFAULT"
          ],
          "transform": {
            "type": "aggregate",
            "map": {
              "ObjectName": "join"
            }
          }
        }
      }
    ],
    "DeprecatedFeaturesSQLModules": [
      {
        "type": "SQL",
        "target": {
          "type": "Database",
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer, ManagedInstance",
          "version": "[11.0,)"
        },
        "implementation": {
          "useDatabase": true,
          "timeout": 360,
          "query": "DECLARE @tblKeywords AS TABLE ( KeywordID INT IDENTITY(1,1) PRIMARY KEY, Keyword VARCHAR(64), DeprecatedIn TINYINT, DiscontinuedIn TINYINT, PCounter VARCHAR(255) ) INSERT INTO @tblKeywords VALUES ('disk init', NULL, 9, NULL), ('disk resize', NULL, 9, NULL), ('for load', NULL, 9, NULL), ('dbcc dbrepair', NULL, 9, NULL), ('dbcc newalloc', NULL, 9, NULL), ('dbcc pintable', NULL, 9, 'DBCC [UN]PINTABLE'), ('dbcc unpintable', NULL, 9, 'DBCC [UN]PINTABLE'), ('dbcc rowlock', NULL, 9, NULL), ('dbcc textall', NULL, 9, NULL), ('dbcc textalloc', NULL, 9, NULL), ('*=', NULL, 9, 'Non-ANSI *= or =* outer join operators'), ('=*', NULL, 9, 'Non-ANSI *= or =* outer join operators'), ('setuser', 9, NULL, 'SETUSER'), ('sp_helpdevice', 9, NULL, 'sp_helpdevice'), ('sp_addtype', 9, NULL, 'sp_addtype'), ('sp_attach_db', 9, NULL, 'sp_attach_db'), ('sp_attach_single_file_db', 9, NULL, 'sp_attach_single_file_db'), ('sp_bindefault', 9, NULL, 'sp_bindefault'), ('sp_unbindefault', 9, NULL, 'sp_unbindefault'), ('sp_bindrule', 9, NULL, 'sp_bindrule'), ('sp_unbindrule', 9, NULL, 'sp_unbindrule'), ('create default', 9, NULL, 'CREATE_DROP_DEFAULT'), ('drop default', 9, NULL, 'CREATE_DROP_DEFAULT'), ('create rule', 9, NULL, 'CREATE_DROP_RULE'), ('drop rule', 9, NULL, 'CREATE_DROP_RULE'), ('sp_renamedb', 9, NULL, 'sp_renamedb'), ('sp_resetstatus', 9, NULL, 'sp_resetstatus'), ('dbcc dbreindex', 9, NULL, 'DBCC DBREINDEX'), ('dbcc indexdefrag', 9, NULL, 'DBCC INDEXDEFRAG'), ('dbcc showcontig', 9, NULL, 'DBCC SHOWCONTIG'), ('sp_addextendedproc', 9, NULL, 'sp_addextendedproc'), ('sp_dropextendedproc', 9, NULL, 'sp_dropextendedproc'), ('sp_helpextendedproc', 9, NULL, 'sp_helpextendedproc'), ('xp_loginconfig', 1, NULL, 'xp_loginconfig'), ('sp_fulltext_catalog', 9, NULL, 'sp_fulltext_catalog'), ('sp_fulltext_table', 9, NULL, 'sp_fulltext_table'), ('sp_fulltext_column', 9, NULL, 'sp_fulltext_column'), ('sp_fulltext_database', 9, NULL, 'sp_fulltext_database'), ('sp_help_fulltext_tables', 9, NULL, 'sp_help_fulltext_tables'), ('sp_help_fulltext_columns', 9, NULL, 'sp_help_fulltext_columns'), ('sp_help_fulltext_catalogs', 9, NULL, 'sp_help_fulltext_catalogs'), ('sp_help_fulltext_tables_cursor', 9, NULL, 'sp_help_fulltext_tables_cursor'), ('sp_help_fulltext_columns_cursor', 9, NULL, 'sp_help_fulltext_columns_cursor'), ('sp_help_fulltext_catalogs_cursor', 9, NULL, 'sp_help_fulltext_catalogs_cursor'), ('fn_get_sql', 9, NULL, 'fn_get_sql'), ('sp_indexoption', 9, NULL, 'sp_indexoption'), ('sp_lock', 9, NULL, 'sp_lock'), ('indexkey_property', 9, NULL, 'INDEXKEY_PROPERTY'), ('file_id', 9, NULL, 'FILE_ID'), ('sp_certify_removable', 9, NULL, 'sp_certify_removable'), ('sp_create_removable', 9, NULL, 'sp_create_removable'), ('sp_dbremove', 9, NULL, 'sp_dbremove'), ('sp_addapprole', 9, NULL, 'sp_addapprole'), ('sp_dropapprole', 9, NULL, 'sp_dropapprole'), ('sp_addlogin', 9, NULL, 'sp_addlogin'), ('sp_droplogin', 9, NULL, 'sp_droplogin'), ('sp_adduser', 9, NULL, 'sp_adduser'), ('sp_dropuser', 9, NULL, 'sp_dropuser'), ('sp_grantdbaccess', 9, NULL, 'sp_grantdbaccess'), ('sp_revokedbaccess', 9, NULL, 'sp_revokedbaccess'), ('sp_addrole', 9, NULL, 'sp_addrole'), ('sp_droprole', 9, NULL, 'sp_droprole'), ('sp_approlepassword', 9, NULL, 'sp_approlepassword'), ('sp_password', 9, NULL, 'sp_password'), ('sp_changeobjectowner', 9, NULL, 'sp_changeobjectowner'), ('sp_defaultdb', 9, NULL, 'sp_defaultdb'), ('sp_defaultlanguage', 9, NULL, 'sp_defaultlanguage'), ('sp_denylogin', 9, NULL, 'sp_denylogin'), ('sp_grantlogin', 9, NULL, 'sp_grantlogin'), ('sp_revokelogin', 9, NULL, 'sp_revokelogin'), ('user_id', 9, NULL, 'USER_ID'), ('sp_srvrolepermission', 9, NULL, 'sp_srvrolepermission'), ('sp_dbfixedrolepermission', 9, NULL, 'sp_dbfixedrolepermission'), ('text', 9, NULL, 'Data types: text ntext or image'), ('ntext', 9, NULL, 'Data types: text ntext or image'), ('image', 9, NULL, 'Data types: text ntext or image'), ('textptr', 9, NULL, 'TEXTPTR'), ('textvalid', 9, NULL, 'TEXTVALID'), ('sp_addalias', 9, 10, NULL), ('no_log', 9, 10, NULL), ('truncate_only', 9, 10, NULL), ('backup transaction', 9, 10, NULL), ('dbcc concurrencyviolation', 9, 10, NULL), ('sp_addgroup', 9, 10, NULL), ('sp_changegroup', 9, 10, NULL), ('sp_dropgroup', 9, 10, NULL), ('sp_helpgroup', 9, 10, NULL), ('sp_makewebtask', NULL, 10, NULL), ('sp_dropwebtask', NULL, 10, NULL), ('sp_runwebtask', NULL, 10, NULL), ('sp_enumcodepages', NULL, 10, NULL), ('dump', 9, 10, NULL), ('load', 9, 10, NULL), ('sp_articlesynctranprocs', NULL, 10, NULL), ('sp_diskdefault', NULL, 10, NULL), ('sp_eventlog', NULL, 10, NULL), ('sp_getmbcscharlen', NULL, 10, NULL), ('sp_helplog', NULL, 10, NULL), ('sp_helpsql', NULL, 10, NULL), ('sp_ismbcsleadbyte', NULL, 10, NULL), ('sp_lock2', NULL, 10, NULL), ('sp_msget_current_activity', NULL, 10, NULL), ('sp_msset_current_activity', NULL, 10, NULL), ('sp_msobjessearch', NULL, 10, NULL), ('xp_enum_activescriptengines', NULL, 10, NULL), ('xp_eventlog', NULL, 10, NULL), ('xp_getadmingroupname', NULL, 10, NULL), ('xp_getfiledetails', NULL, 10, NULL), ('xp_getlocalsystemaccountname', NULL, 10, NULL), ('xp_isntadmin', NULL, 10, NULL), ('xp_mslocalsystem', NULL, 10, NULL), ('xp_msnt2000', NULL, 10, NULL), ('xp_msplatform', NULL, 10, NULL), ('xp_setsecurity', NULL, 10, NULL), ('xp_varbintohexstr', NULL, 10, NULL), ('spt_datatype_info', NULL, 10, NULL), ('spt_datatype_info_ext', NULL, 10, NULL), ('spt_provider_types', NULL, 10, NULL), ('spt_server_info', NULL, 10, NULL), ('spt_values', NULL, 10, NULL), ('sysfulltextnotify ', NULL, 10, NULL), ('syslocks', NULL, 10, NULL), ('sysproperties', NULL, 10, NULL), ('sysprotects_aux', NULL, 10, NULL), ('sysprotects_view', NULL, 10, NULL), ('sysremote_catalogs', NULL, 10, NULL), ('sysremote_column_privileges', NULL, 10, NULL), ('sysremote_columns', NULL, 10, NULL), ('sysremote_foreign_keys', NULL, 10, NULL), ('sysremote_indexes', NULL, 10, NULL), ('sysremote_primary_keys', NULL, 10, NULL), ('sysremote_provider_types', NULL, 10, NULL), ('sysremote_schemata', NULL, 10, NULL), ('sysremote_statistics', NULL, 10, NULL), ('sysremote_table_privileges', NULL, 10, NULL), ('sysremote_tables', NULL, 10, NULL), ('sysremote_views', NULL, 10, NULL), ('syssegments', NULL, 10, NULL), ('sysxlogins', NULL, 10, NULL), ('sp_droptype', 10, NULL, 'sp_droptype'), ('@@remserver', 10, NULL, 'REMSERVER'), ('remote_proc_transactions', 10, NULL, 'SET REMOTE_PROC_TRANSACTIONS'), ('sp_addumpdevice', 10, NULL, 'ADDING TAPE DEVICE'), ('xp_grantlogin', 10, NULL, 'xp_grantlogin'), ('xp_revokelogin', 10, NULL, 'xp_revokelogin'), ('grant all', 10, NULL, 'ALL Permission'), ('deny all', 10, NULL, 'ALL Permission'), ('revoke all', 10, NULL, 'ALL Permission'), ('fn_virtualservernodes', 10, NULL, 'fn_virtualservernodes'), ('fn_servershareddrives', 10, NULL, 'fn_servershareddrives'), ('writetext', 10, NULL, 'UPDATETEXT or WRITETEXT'), ('updatetext', 10, NULL, 'UPDATETEXT or WRITETEXT'), ('readtext', 10, NULL, 'READTEXT'), ('torn_page_detection', 10, NULL, 'ALTER DATABASE WITH TORN_PAGE_DETECTION'), ('set rowcount', 10, NULL, 'SET ROWCOUNT'), ('dbo_only', 9, 11, 'RESTORE DATABASE or LOG WITH DBO_ONLY'), ('mediapassword', 9, 11, 'BACKUP DATABASE or LOG WITH MEDIAPASSWORD'), ('password', 9, 11, 'BACKUP DATABASE or LOG WITH PASSWORD'), ('with append', 10, 11, 'CREATE TRIGGER WITH APPEND'), ('sp_dboption', 9, 11, 'sp_dboption'), ('databaseproperty', 9, 11, 'DATABASEPROPERTY'), ('fastfirstrow', 10, 11, 'FASTFIRSTROW'), ('sp_addserver', 10, 11, 'sp_addserver'), ('sp_dropalias', 9, 11, 'sp_dropalias'), ('disable_def_cnst_chk', 10, 11, 'SET DISABLE_DEF_CNST_CHK'), ('sp_activedirectory_obj', NULL, 11, NULL), ('sp_activedirectory_scp', NULL, 11, NULL), ('sp_activedirectory_start', NULL, 11, NULL), ('sys.database_principal_aliases', NULL, 11, 'database_principal_aliases'), ('compute', 10, 11, 'COMPUTE [BY]'), ('compute by', 10, 11, 'COMPUTE [BY]'), ('sp_change_users_login', 11, NULL, 'sp_change_users_login'), ('sp_depends', 11, NULL, 'sp_depends'), ('sp_getbindtoken', 11, NULL, 'sp_getbindtoken'), ('sp_bindsession', 11, NULL, 'sp_bindsession'), ('fmtonly', 11, NULL, 'SET FMTONLY ON'), ('raiserror', 11, NULL, 'Oldstyle RAISEERROR'), ('sp_db_increased_partitions', 11, NULL, 'sp_db_increased_partitions'), ('databasepropertyex(''isfulltextenabled'')', 11, NULL, 'DATABASEPROPERTYEX(''IsFullTextEnabled'')'), ('sp_dbcmptlevel', 11, NULL, 'sp_dbcmptlevel'), ('set ansi_nulls off', 11, NULL, 'SET ANSI_NULLS OFF'), ('set ansi_padding off', 11, NULL, 'SET ANSI_PADDING OFF'), ('set concat_null_yields_null off', 11, NULL, 'SET CONCAT_NULL_YIELDS_NULL OFF'), ('set offsets', 11, NULL, 'SET OFFSETS'), ('sys.numbered_procedures', 12, NULL, 'numbered_procedures'), ('sys.numbered_procedure_parameters', 12, NULL, 'numbered_procedure_parameters'), ('sys.sql_dependencies', 12, NULL, 'sql_dependencies'), ('sp_db_vardecimal_storage_format', 12, NULL, 'sp_db_vardecimal_storage_format'), ('sp_estimated_rowsize_reduction_for_vardecimal', 12, NULL, 'sp_estimated_rowsize_reduction_for_vardecimal'), ('sp_trace_create', 12, NULL, 'sp_trace_create'), ('sp_trace_setevent', 12, NULL, 'sp_trace_setevent'), ('sp_trace_setstatus', 12, NULL, 'sp_trace_setstatus'), ('fn_trace_geteventinfo', 12, NULL, 'fn_trace_geteventinfo'), ('fn_trace_getfilterinfo', 12, NULL, 'fn_trace_getfilterinfo'), ('fn_trace_gettable', 12, NULL, 'fn_trace_gettable'), ('sys.traces', 12, NULL, NULL), ('sys.trace_events', 12, NULL, NULL), ('sys.trace_event_bindings', 12, NULL, NULL), ('sys.trace_categories', 12, NULL, NULL), ('sys.trace_columns', 12, NULL, NULL), ('sys.trace_subclass_values', 12, NULL, NULL), ('disable_interleaved_execution_tvf', 10, 15, NULL), ('disable_batch_mode_memory_grant_feedback', 10, 15, NULL), ('disable_batch_mode_adaptive_joins', 10, 15, NULL) DECLARE @sqlmajorver INT; SELECT @sqlmajorver=CONVERT(int,(@@microsoftversion/0x1000000) & 0xff) DELETE FROM @tblKeywords WHERE DeprecatedIn>@sqlmajorver OR DiscontinuedIn>@sqlmajorver DELETE k FROM @tblKeywords k LEFT JOIN ( SELECT instance_name FROM sys.dm_os_performance_counters pc WHERE [object_name] LIKE '%Deprecated Features%' AND cntr_value > 0 ) X ON X.instance_name = k.PCounter COLLATE DATABASE_DEFAULT WHERE X.instance_name IS NULL SELECT DISTINCT RTRIM(tk.PCounter) Feature, QUOTENAME(ss.name) + '.' + QUOTENAME(so.name) AS ObjectName FROM sys.sql_modules sm (NOLOCK) INNER JOIN sys.objects so (NOLOCK) ON sm.[object_id]=so.[object_id] INNER JOIN sys.schemas ss (NOLOCK) ON so.[schema_id]=ss.[schema_id] CROSS JOIN @tblKeywords tk WHERE PATINDEX('%' + tk.Keyword + '%', LOWER(sm.[definition]) COLLATE DATABASE_DEFAULT) > 1 AND OBJECTPROPERTY(sm.[object_id], 'IsMSShipped') = 0",
          "transform": {
            "type": "aggregate",
            "group": "Feature",
            "map": {
              "ObjectName": "join"
            }
          }
        }
      }
    ],
    "DeprecatedFeaturesJobs": [
      {
        "type": "SQL",
        "target": {
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer, ManagedInstance",
          "version": "[11.0,)"
        },
        "requires": {
          "object permission on [msdb].[dbo].[sysjobs]": [
            "SELECT"
          ],
          "object permission on [msdb].[dbo].[sysjobsteps]": [
            "SELECT"
          ]
        },
        "implementation": {
          "query": [
            "USE [msdb]; IF (SELECT COUNT(instance_name) FROM sys.dm_os_performance_counters WHERE [object_name] LIKE '%Deprecated Features%' AND cntr_value>0)>0 BEGIN DECLARE @sqlmajorver INT; SELECT @sqlmajorver=CONVERT(int,(@@microsoftversion / 0x1000000) & 0xff); DECLARE @tblKeywords as TABLE (KeywordID int IDENTITY(1,1) PRIMARY KEY, Keyword VARCHAR(64), DeprecatedIn tinyint, DiscontinuedIn tinyint) INSERT INTO @tblKeywords VALUES ('disk init',NULL,9),('disk resize',NULL,9),('for load',NULL,9),('dbcc dbrepair',NULL,9),('dbcc newalloc',NULL,9),('dbcc pintable',NULL,9),('dbcc unpintable',NULL,9),('dbcc rowlock',NULL,9),('dbcc textall',NULL,9),('dbcc textalloc',NULL,9),('*=',NULL,9),('=*',NULL,9),('setuser',9,NULL),('sp_helpdevice',9,NULL),('sp_addtype',9,NULL),('sp_attach_db',9,NULL),('sp_attach_single_file_db',9,NULL),('sp_bindefault',9,NULL),('sp_unbindefault',9,NULL),('sp_bindrule',9,NULL),('sp_unbindrule',9,NULL),('create default',9,NULL),('drop default',9,NULL),('create rule',9,NULL),('drop rule',9,NULL),('sp_renamedb',9,NULL),('sp_resetstatus',9,NULL),('dbcc dbreindex',9,NULL),('dbcc indexdefrag',9,NULL),('dbcc showcontig',9,NULL),('sp_addextendedproc',9,NULL),('sp_dropextendedproc',9,NULL),('sp_helpextendedproc',9,NULL),('xp_loginconfig',1,NULL),('sp_fulltext_catalog',9,NULL),('sp_fulltext_table',9,NULL),('sp_fulltext_column',9,NULL),('sp_fulltext_database',9,NULL),('sp_help_fulltext_tables',9,NULL),('sp_help_fulltext_columns',9,NULL),('sp_help_fulltext_catalogs',9,NULL),('sp_help_fulltext_tables_cursor',9,NULL),('sp_help_fulltext_columns_cursor',9,NULL) DELETE FROM @tblKeywords WHERE DeprecatedIn>@sqlmajorver OR DiscontinuedIn>@sqlmajorver SELECT 'Job: '+sj.[name]+' Step: '+sjs.step_name AS ObjectName,Keyword FROM msdb.dbo.sysjobsteps sjs (NOLOCK) INNER JOIN msdb.dbo.sysjobs sj (NOLOCK) ON sjs.job_id=sj.job_id CROSS JOIN @tblKeywords tk WHERE PATINDEX('%'+tk.Keyword+'%',LOWER(sjs.[command]) COLLATE DATABASE_DEFAULT)>1 AND sjs.[subsystem] = 'TSQL'; END",
            "USE [msdb]; IF (SELECT COUNT(instance_name) FROM sys.dm_os_performance_counters WHERE [object_name] LIKE '%Deprecated Features%' AND cntr_value>0)>0 BEGIN DECLARE @sqlmajorver INT; SELECT @sqlmajorver=CONVERT(int,(@@microsoftversion / 0x1000000) & 0xff); DECLARE @tblKeywords as TABLE (KeywordID int IDENTITY(1,1) PRIMARY KEY, Keyword VARCHAR(64), DeprecatedIn tinyint, DiscontinuedIn tinyint) INSERT INTO @tblKeywords VALUES ('sp_help_fulltext_catalogs_cursor',9,NULL),('fn_get_sql',9,NULL),('sp_indexoption',9,NULL),('sp_lock',9,NULL),('indexkey_property',9,NULL),('file_id',9,NULL),('sp_certify_removable',9,NULL),('sp_create_removable',9,NULL),('sp_dbremove',9,NULL),('sp_addapprole',9,NULL),('sp_dropapprole',9,NULL),('sp_addlogin',9,NULL),('sp_droplogin',9,NULL),('sp_adduser',9,NULL),('sp_dropuser',9,NULL),('sp_grantdbaccess',9,NULL),('sp_revokedbaccess',9,NULL),('sp_addrole',9,NULL),('sp_droprole',9,NULL),('sp_approlepassword',9,NULL),('sp_password',9,NULL),('sp_changeobjectowner',9,NULL),('sp_defaultdb',9,NULL),('sp_defaultlanguage',9,NULL),('sp_denylogin',9,NULL),('sp_grantlogin',9,NULL),('sp_revokelogin',9,NULL),('user_id',9,NULL),('sp_srvrolepermission',9,NULL),('sp_dbfixedrolepermission',9,NULL),('text',9,NULL),('ntext',9,NULL),('image',9,NULL),('textptr',9,NULL),('textvalid',9,NULL),('sp_addalias',9,10),('no_log',9,10),('truncate_only',9,10),('backup transaction',9,10),('dbcc concurrencyviolation',9,10),('sp_addgroup',9,10),('sp_changegroup',9,10),('sp_dropgroup',9,10),('sp_helpgroup',9,10),('sp_makewebtask',NULL,10),('sp_dropwebtask',NULL,10),('sp_runwebtask',NULL,10),('sp_enumcodepages',NULL,10),('dump',9,10),('load',9,10),('sp_articlesynctranprocs',NULL,10),('sp_diskdefault',NULL,10),('sp_eventlog',NULL,10) DELETE FROM @tblKeywords WHERE DeprecatedIn>@sqlmajorver OR DiscontinuedIn>@sqlmajorver SELECT 'Job: '+sj.[name]+' Step: '+sjs.step_name AS ObjectName,Keyword FROM msdb.dbo.sysjobsteps sjs (NOLOCK) INNER JOIN msdb.dbo.sysjobs sj (NOLOCK) ON sjs.job_id=sj.job_id CROSS JOIN @tblKeywords tk WHERE PATINDEX('%'+tk.Keyword+'%',LOWER(sjs.[command]) COLLATE DATABASE_DEFAULT)>1 AND sjs.[subsystem] = 'TSQL'; END",
            "USE [msdb]; IF (SELECT COUNT(instance_name) FROM sys.dm_os_performance_counters WHERE [object_name] LIKE '%Deprecated Features%' AND cntr_value>0)>0 BEGIN DECLARE @sqlmajorver INT; SELECT @sqlmajorver=CONVERT(int,(@@microsoftversion / 0x1000000) & 0xff); DECLARE @tblKeywords as TABLE (KeywordID int IDENTITY(1,1) PRIMARY KEY, Keyword VARCHAR(64), DeprecatedIn tinyint, DiscontinuedIn tinyint) INSERT INTO @tblKeywords VALUES ('sp_getmbcscharlen',NULL,10),('sp_helplog',NULL,10),('sp_helpsql',NULL,10),('sp_ismbcsleadbyte',NULL,10),('sp_lock2',NULL,10),('sp_msget_current_activity',NULL,10),('sp_msset_current_activity',NULL,10),('sp_msobjessearch',NULL,10),('xp_enum_activescriptengines',NULL,10),('xp_eventlog',NULL,10),('xp_getadmingroupname',NULL,10),('xp_getfiledetails',NULL,10),('xp_getlocalsystemaccountname',NULL,10),('xp_isntadmin',NULL,10),('xp_mslocalsystem',NULL,10),('xp_msnt2000',NULL,10),('xp_msplatform',NULL,10) DELETE FROM @tblKeywords WHERE DeprecatedIn>@sqlmajorver OR DiscontinuedIn>@sqlmajorver SELECT 'Job: '+sj.[name]+' Step: '+sjs.step_name AS ObjectName,Keyword FROM msdb.dbo.sysjobsteps sjs (NOLOCK) INNER JOIN msdb.dbo.sysjobs sj (NOLOCK) ON sjs.job_id=sj.job_id CROSS JOIN @tblKeywords tk WHERE PATINDEX('%'+tk.Keyword+'%',LOWER(sjs.[command]) COLLATE DATABASE_DEFAULT)>1 AND sjs.[subsystem] = 'TSQL'; END",
            "USE [msdb]; IF (SELECT COUNT(instance_name) FROM sys.dm_os_performance_counters WHERE [object_name] LIKE '%Deprecated Features%' AND cntr_value>0)>0 BEGIN DECLARE @sqlmajorver INT; SELECT @sqlmajorver=CONVERT(int,(@@microsoftversion / 0x1000000) & 0xff); DECLARE @tblKeywords as TABLE (KeywordID int IDENTITY(1,1) PRIMARY KEY, Keyword VARCHAR(64), DeprecatedIn tinyint, DiscontinuedIn tinyint) INSERT INTO @tblKeywords VALUES ('xp_setsecurity',NULL,10),('xp_varbintohexstr',NULL,10),('spt_datatype_info',NULL,10),('spt_datatype_info_ext',NULL,10),('spt_provider_types',NULL,10),('spt_server_info',NULL,10),('spt_values',NULL,10),('sysfulltextnotify ',NULL,10),('syslocks',NULL,10),('sysproperties',NULL,10),('sysprotects_aux',NULL,10),('sysprotects_view',NULL,10),('sysremote_catalogs',NULL,10),('sysremote_column_privileges',NULL,10),('sysremote_columns',NULL,10),('sysremote_foreign_keys',NULL,10) DELETE FROM @tblKeywords WHERE DeprecatedIn>@sqlmajorver OR DiscontinuedIn>@sqlmajorver SELECT 'Job: '+sj.[name]+' Step: '+sjs.step_name AS ObjectName,Keyword FROM msdb.dbo.sysjobsteps sjs (NOLOCK) INNER JOIN msdb.dbo.sysjobs sj (NOLOCK) ON sjs.job_id=sj.job_id CROSS JOIN @tblKeywords tk WHERE PATINDEX('%'+tk.Keyword+'%',LOWER(sjs.[command]) COLLATE DATABASE_DEFAULT)>1 AND sjs.[subsystem] = 'TSQL'; END",
            "USE [msdb]; IF (SELECT COUNT(instance_name) FROM sys.dm_os_performance_counters WHERE [object_name] LIKE '%Deprecated Features%' AND cntr_value>0)>0 BEGIN DECLARE @sqlmajorver INT; SELECT @sqlmajorver=CONVERT(int,(@@microsoftversion / 0x1000000) & 0xff); DECLARE @tblKeywords as TABLE (KeywordID int IDENTITY(1,1) PRIMARY KEY, Keyword VARCHAR(64), DeprecatedIn tinyint, DiscontinuedIn tinyint) INSERT INTO @tblKeywords VALUES ('sysremote_indexes',NULL,10),('sysremote_primary_keys',NULL,10),('sysremote_provider_types',NULL,10),('sysremote_schemata',NULL,10),('sysremote_statistics',NULL,10),('sysremote_table_privileges',NULL,10),('sysremote_tables',NULL,10),('sysremote_views',NULL,10),('syssegments',NULL,10),('sysxlogins',NULL,10),('sp_droptype',10,NULL),('@@remserver',10,NULL),('remote_proc_transactions',10,NULL),('sp_addumpdevice',10,NULL),('xp_grantlogin',10,NULL),('xp_revokelogin',10,NULL),('grant all',10,NULL),('deny all',10,NULL),('revoke all',10,NULL),('fn_virtualservernodes',10,NULL),('fn_servershareddrives',10,NULL),('writetext',10,NULL),('updatetext',10,NULL),('readtext',10,NULL),('torn_page_detection',10,NULL),('set rowcount',10,NULL),('dbo_only',9,11 ) DELETE FROM @tblKeywords WHERE DeprecatedIn>@sqlmajorver OR DiscontinuedIn>@sqlmajorver SELECT 'Job: '+sj.[name]+' Step: '+sjs.step_name AS ObjectName,Keyword FROM msdb.dbo.sysjobsteps sjs (NOLOCK) INNER JOIN msdb.dbo.sysjobs sj (NOLOCK) ON sjs.job_id=sj.job_id CROSS JOIN @tblKeywords tk WHERE PATINDEX('%'+tk.Keyword+'%',LOWER(sjs.[command]) COLLATE DATABASE_DEFAULT)>1 AND sjs.[subsystem] = 'TSQL'; END",
            "USE [msdb]; IF (SELECT COUNT(instance_name) FROM sys.dm_os_performance_counters WHERE [object_name] LIKE '%Deprecated Features%' AND cntr_value>0)>0 BEGIN DECLARE @sqlmajorver INT; SELECT @sqlmajorver=CONVERT(int,(@@microsoftversion / 0x1000000) & 0xff); DECLARE @tblKeywords as TABLE (KeywordID int IDENTITY(1,1) PRIMARY KEY, Keyword VARCHAR(64), DeprecatedIn tinyint, DiscontinuedIn tinyint) INSERT INTO @tblKeywords VALUES ('mediapassword',9,11 ),('password',9,11 ),('with append',10,11),('sp_dboption',9,11),('databaseproperty',9,11),('fastfirstrow',10,11),('sp_addserver',10,11 ),('sp_dropalias',9,11),('disable_def_cnst_chk',10,11),('sp_activedirectory_obj',NULL,11),('sp_activedirectory_scp',NULL,11),('sp_activedirectory_start',NULL,11),('sys.database_principal_aliases',NULL,11),('compute',10,11),('compute by',10,11),('sp_change_users_login',11,NULL),('sp_depends',11,NULL),('sp_getbindtoken',11,NULL),('sp_bindsession',11,NULL),('fmtonly',11,NULL),('raiserror',11,NULL),('sp_db_increased_partitions',11,NULL),('databasepropertyex(''isfulltextenabled'')',11,NULL),('sp_dbcmptlevel',11,NULL),('set ansi_nulls off',11,NULL),('set ansi_padding off',11,NULL),('set concat_null_yields_null off',11,NULL),('set offsets',11,NULL),('sys.numbered_procedures',12,NULL),('sys.numbered_procedure_parameters',12,NULL),('sys.sql_dependencies',12,NULL),('sp_db_vardecimal_storage_format',12,NULL),('sp_estimated_rowsize_reduction_for_vardecimal',12,NULL),('sp_trace_create',12,NULL),('sp_trace_setevent',12,NULL),('sp_trace_setstatus',12,NULL),('fn_trace_geteventinfo',12,NULL),('fn_trace_getfilterinfo',12,NULL),('fn_trace_gettable',12,NULL),('sys.traces',12,NULL),('sys.trace_events',12,NULL),('sys.trace_event_bindings',12,NULL),('sys.trace_categories',12,NULL),('sys.trace_columns',12,NULL),('sys.trace_subclass_values',12,NULL),('sp_addremotelogin',10,14),('sp_dropremotelogin',10,14),('sp_helpremotelogin',10,14),('sp_remoteoption',10,14) DELETE FROM @tblKeywords WHERE DeprecatedIn>@sqlmajorver OR DiscontinuedIn>@sqlmajorver SELECT 'Job: '+sj.[name]+' Step: '+sjs.step_name AS ObjectName,Keyword FROM msdb.dbo.sysjobsteps sjs (NOLOCK) INNER JOIN msdb.dbo.sysjobs sj (NOLOCK) ON sjs.job_id=sj.job_id CROSS JOIN @tblKeywords tk WHERE PATINDEX('%'+tk.Keyword+'%',LOWER(sjs.[command]) COLLATE DATABASE_DEFAULT)>1 AND sjs.[subsystem] = 'TSQL'; END"
          ],
          "transform": {
            "type": "aggregate",
            "group": "ObjectName",
            "map": {
              "Keyword": "join"
            }
          }
        }
      }
    ],
    "AffinityNUMANodeNoAssignedCPUs": [
      {
        "type": "SQL",
        "target": {
          "platform": "Windows",
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "WITH cpuCTE (node, afin) AS (SELECT DISTINCT(parent_node_id), is_online FROM sys.dm_os_schedulers WHERE scheduler_id < 255 AND parent_node_id < 64 GROUP BY parent_node_id, is_online) SELECT COUNT(DISTINCT(node)) AS NodeCnt FROM cpuCTE WHERE afin = 0 AND node NOT IN ( SELECT DISTINCT(node) FROM cpuCTE WHERE afin = 1)"
        }
      }
    ],
    "IndexesGuidKeyColumns": [
      {
        "type": "SQL",
        "target": {
          "type": "Database",
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer, ManagedInstance",
          "version": "[11.0,)"
        },
        "implementation": {
          "useDatabase": true,
          "query": "SELECT CONCAT(ss.[name], '.', t.[name], '.', i.[name]) AS IndexName FROM [sys].[indexes] AS i WITH (NOLOCK) INNER JOIN [sys].[tables] AS t WITH (NOLOCK) ON t.[object_id] = i.[object_id] INNER JOIN [sys].[schemas] AS ss WITH (NOLOCK) ON ss.[schema_id] = t.[schema_id] INNER JOIN [sys].[index_columns] AS sic WITH (NOLOCK) ON sic.[object_id] = t.[object_id] AND sic.index_id = i.index_id INNER JOIN [sys].[columns] AS sc WITH (NOLOCK) ON sc.[object_id] = t.[object_id] AND sc.column_id = sic.column_id INNER JOIN [sys].[types] AS sty WITH (NOLOCK) ON sc.user_type_id = sty.user_type_id WHERE sic.is_included_column = 0 AND sty.name = 'uniqueidentifier' and i.type = 1 AND i.is_unique_constraint = 0 AND t.is_ms_shipped = 0 GROUP BY ss.name, t.[name], i.name HAVING COUNT(sty.name) > 0",
          "transform": {
            "type": "aggregate",
            "map": {
              "IndexName": "join"
            }
          }
        }
      }
    ],
    "SuspectPagesValidation": [
      {
        "type": "SQL",
        "target": {
          "type": "Database",
          "platform": [
            "Windows",
            "Linux"
          ],
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "IF ( SELECT COUNT(*) FROM msdb.dbo.suspect_pages WITH (NOLOCK) WHERE ( event_type = 1 OR event_type = 2 OR event_type = 3 ) ) > 0 BEGIN SELECT CASE event_type WHEN 1 THEN 'Error 823 or unspecified Error 824' WHEN 2 THEN 'Bad Checksum' WHEN 3 THEN 'Torn Page' ELSE NULL END AS [EventType] FROM msdb.dbo.suspect_pages (NOLOCK) WHERE ( event_type = 1 OR event_type = 2 OR event_type = 3 ) AND DB_NAME(database_id) =(@TargetName) END;"
        }
      }
    ],
    "SparseFilesValidation": [
      {
        "type": "SQL",
        "target": {
          "type": "Database",
          "platform": [
            "Windows",
            "Linux"
          ],
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "IF ( SELECT COUNT(sd.database_id) FROM sys.databases AS sd WITH (NOLOCK) INNER JOIN sys.master_files AS smf WITH (NOLOCK) ON sd.database_id = smf.database_id WHERE sd.source_database_id IS NULL AND smf.is_sparse = 1 ) > 0 BEGIN SELECT 'Database_checks' AS [Category], 'DB_nonSnap_Sparse' AS [Information], DB_NAME(sd.database_id) AS database_name, smf.name AS [SparseFiles], smf.physical_name FROM sys.databases AS sd WITH (NOLOCK) INNER JOIN sys.master_files AS smf WITH (NOLOCK) ON sd.database_id = smf.database_id WHERE sd.source_database_id IS NULL AND smf.is_sparse = 1 AND DB_NAME(sd.database_id) = @TargetName END;"
        }
      }
    ],
    "TableIndexes": [
      {
        "type": "SQL",
        "target": {
          "type": "Database",
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer, ManagedInstance",
          "version": "[11.0,)"
        },
        "implementation": {
          "useDatabase": true,
          "query": "SELECT s.name+'.'+t.name AS TableName, COUNT(si.index_id) AS IndexCount, MIN(si.index_id) AS MinIndexId, MAX(si.index_id) AS MaxIndexId FROM sys.indexes AS si (NOLOCK) INNER JOIN sys.tables AS t (NOLOCK) ON si.[object_id]=t.[object_id] INNER JOIN sys.schemas AS s (NOLOCK) ON s.[schema_id]=t.[schema_id] WHERE si.is_hypothetical=0 AND OBJECTPROPERTY(t.[object_id], 'IsMSShipped') = 0 GROUP BY s.name,t.name"
        }
      }
    ],
    "TableIndexesPartitioned": [
      {
        "type": "SQL",
        "target": {
          "type": "Database",
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer, ManagedInstance",
          "version": "[11.0,)"
        },
        "implementation": {
          "useDatabase": true,
          "query": "SELECT DISTINCT s.name+'.'+t.name AS TableName, i.name AS IndexName FROM sys.tables AS t (NOLOCK) INNER JOIN sys.indexes AS i (NOLOCK) ON t.[object_id]=i.[object_id] INNER JOIN sys.data_spaces AS ds (NOLOCK) ON ds.data_space_id=i.data_space_id INNER JOIN sys.schemas AS s (NOLOCK) ON s.[schema_id]=t.[schema_id] WHERE t.[type]='U' AND i.[type] IN (1,2) AND i.is_hypothetical=0 AND t.name IN(SELECT ob.name FROM sys.tables AS ob (NOLOCK) INNER JOIN sys.indexes AS ind (NOLOCK) ON ind.[object_id]=ob.[object_id] INNER JOIN sys.data_spaces AS sds (NOLOCK) ON sds.data_space_id=ind.data_space_id WHERE sds.[type]='PS' GROUP BY ob.name) AND ds.[type]<>'PS' AND OBJECTPROPERTY(t.[object_id], 'IsMSShipped') = 0"
        }
      }
    ],
    "SystemHealth": [
      {
        "type": "SQL",
        "target": {
          "platform": [
            "Windows",
            "Linux"
          ],
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "IF EXISTS (SELECT [object_id] FROM tempdb.sys.objects (NOLOCK) WHERE [object_id]=OBJECT_ID('tempdb.dbo.#SystemHealthSessionData')) DROP TABLE #SystemHealthSessionData; IF NOT EXISTS (SELECT [object_id] FROM tempdb.sys.objects (NOLOCK) WHERE [object_id]=OBJECT_ID('tempdb.dbo.#SystemHealthSessionData')) CREATE TABLE #SystemHealthSessionData (target_data XML); INSERT INTO #SystemHealthSessionData SELECT CAST(xet.target_data AS XML) FROM sys.dm_xe_session_targets xet INNER JOIN sys.dm_xe_sessions xe ON xe.address=xet.event_session_address WHERE xe.name='system_health' IF (SELECT COUNT(*) FROM #SystemHealthSessionData a WHERE CONVERT(VARCHAR(max), target_data) LIKE '%error_reported%')>0 BEGIN ;WITH cteHealthSession (EventXML) AS (SELECT C.query('.') EventXML FROM #SystemHealthSessionData a CROSS APPLY a.target_data.nodes('/RingBufferTarget/event') AS T(C)),cteErrorReported (EventTime, ErrorNumber) AS (SELECT EventXML.value('(/event/@timestamp)[1]','datetime') AS EventTime,EventXML.value('(/event/data[@name=''error_number'']/value)[1]','int') AS ErrorNumber FROM cteHealthSession WHERE EventXML.value('(/event/@name)[1]','VARCHAR(500)')='error_reported') SELECT ErrorNumber AS [Error_Number], DATEDIFF(hour,MAX(EventTime),GETUTCDATE()) AS [Last_Logged_Days_Ago],COUNT(ErrorNumber) AS Error_Count FROM cteErrorReported a INNER JOIN sys.messages b ON a.ErrorNumber=b.message_id WHERE b.language_id=1033 GROUP BY a.ErrorNumber, b.[text] END"
        }
      }
    ],
    "CompatibilityLevel": [
      {
        "type": "SQL",
        "target": {
          "type": "Database",
          "platform": [
            "Windows",
            "Linux"
          ],
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "SELECT compatibility_level as [CompatibilityLevel] FROM sys.databases WITH (NOLOCK) where name = @TargetName"
        }
      }
    ],
    "PendingIORequests": [
      {
        "type": "SQL",
        "target": {
          "platform": [
            "Windows",
            "Linux"
          ],
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "DECLARE @IOCnt INT SET @IOCnt=1 WHILE @IOCnt<5 BEGIN IF EXISTS(SELECT * FROM sys.dm_io_pending_io_requests WHERE io_type=@io_type) BREAK; WAITFOR DELAY '00:00:01' SET @IOCnt=@IOCnt+1 END; IF @IOCnt<5 SELECT 1"
        }
      }
    ],
    "DBMetaInfo": [
      {
        "type": "SQL",
        "target": {
          "type": "Database",
          "platform": [
            "Windows",
            "Linux"
          ],
          "version": "[11.0,)"
        },
        "requires": {
          "role": [
            "sysadmin"
          ]
        },
        "implementation": {
          "query": "DBCC DBINFO(@TargetName) WITH TABLERESULTS,NO_INFOMSGS",
          "transform": {
            "type": "dbInfo"
          }
        }
      }
    ],
    "StatSamplingRate": [
      {
        "type": "SQL",
        "target": {
          "type": "Database",
          "platform": [
            "Windows",
            "Linux"
          ],
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "SELECT CONCAT(sh.[name], '.', o.[name]) AS FullName, CAST(sp.rows_sampled /(sp.[rows] * 1.00) AS DECIMAL(5, 2)) AS stat_sampling_rate FROM sys.objects AS o WITH (NOLOCK) INNER JOIN sys.tables AS mst WITH (NOLOCK) ON mst.[object_id] = o.[object_id] INNER JOIN sys.stats AS ss WITH (NOLOCK) ON ss.[object_id] = o.[object_id] INNER JOIN sys.schemas AS sh WITH (NOLOCK) ON sh.[schema_id] = o.[schema_id] CROSS APPLY sys.dm_db_stats_properties(o.[object_id], ss.[stats_id]) AS sp WHERE sp.[rows] > 0 AND sp.rows_sampled /(sp.[rows] * 1.00) < @threshold"
        }
      }
    ],
    "IndexStatistics": [
      {
        "type": "SQL",
        "target": {
          "type": "Database",
          "platform": [
            "Windows",
            "Linux"
          ],
          "version": "[11.0,12.0)"
        },
        "implementation": {
          "useDatabase": true,
          "timeout": 180,
          "query": "SELECT CASE i.[type] WHEN 0 THEN CONCAT(SCHEMA_NAME(t.schema_id), '.', t.[name], ' (HEAP)') ELSE CONCAT(SCHEMA_NAME(t.schema_id), '.', t.[name], '.', i.[name]) END AS IndexFullName, stat.fragmentation, stat.page_count, i.[type] AS IndexType FROM sys.indexes AS i WITH (NOLOCK) INNER JOIN sys.tables AS t WITH (NOLOCK) ON t.[object_id] = i.[object_id] AND t.is_ms_shipped = 0 INNER JOIN ( SELECT [object_id], index_id, SUM(ps.avg_fragmentation_in_percent) AS fragmentation, SUM(ps.page_count) AS page_count FROM sys.dm_db_index_physical_stats(DB_ID(), NULL, NULL, NULL, NULL) ps WHERE ps.index_level = 0 AND ps.alloc_unit_type_desc = 'IN_ROW_DATA' GROUP BY [object_id], index_id ) stat ON stat.index_id = i.index_id AND stat.[object_id] = i.[object_id] WHERE i.[type] IN (0, 1, 2)"
        }
      },
      {
        "type": "SQL",
        "target": {
          "type": "Database",
          "platform": [
            "Windows",
            "Linux"
          ],
          "version": "[12.0,)"
        },
        "implementation": {
          "useDatabase": true,
          "timeout": 180,
          "query": "SELECT CASE i.[type] WHEN 0 THEN CONCAT(SCHEMA_NAME(t.schema_id), '.', t.[name], ' (HEAP)') ELSE CONCAT(SCHEMA_NAME(t.schema_id), '.', t.[name], '.', i.[name]) END AS IndexFullName, stat.fragmentation, stat.page_count, 0 AS fragmentation_CI, 0 AS [state], i.[type] AS IndexType FROM sys.indexes AS i WITH (NOLOCK) INNER JOIN sys.tables AS t WITH (NOLOCK) ON t.[object_id] = i.[object_id] AND t.is_ms_shipped = 0 INNER JOIN ( SELECT [object_id], index_id, SUM(ps.avg_fragmentation_in_percent) AS fragmentation, SUM(ps.page_count) AS page_count FROM sys.dm_db_index_physical_stats(DB_ID(), NULL, NULL, NULL, NULL) ps WHERE ps.index_level = 0 AND ps.alloc_unit_type_desc = 'IN_ROW_DATA' GROUP BY [object_id], index_id ) stat ON stat.index_id = i.index_id AND stat.[object_id] = i.[object_id] WHERE i.[type] IN (0, 1, 2, 7) UNION SELECT CONCAT(SCHEMA_NAME(t.schema_id), '.', t.[name], '.', i.[name]) AS IndexFullName, 0, 0, SUM( (ISNULL(rg.deleted_rows, 1) * 100) /CASE WHEN rg.total_rows = 0 THEN 1 ELSE rg.total_rows END ), rg.[state], i.[type] FROM sys.column_store_row_groups AS rg WITH (NOLOCK) INNER JOIN sys.indexes AS i WITH (NOLOCK) ON i.index_id = rg.index_id and i.[object_id] = rg.[object_id] INNER JOIN sys.tables AS t WITH (NOLOCK) ON t.[object_id] = rg.[object_id] AND t.is_ms_shipped = 0 GROUP BY rg.[object_id], i.[name], t.[name], t.[schema_id], rg.[state], i.[type]"
        }
      }
    ],
    "XTPIndexHashStatistics": [
      {
        "type": "SQL",
        "target": {
          "type": "Database",
          "platform": [
            "Windows",
            "Linux"
          ],
          "version": "[12.0,)"
        },
        "implementation": {
          "useDatabase": true,
          "query": "IF NOT EXISTS( SELECT * FROM sys.filegroups where [type] = 'FX' ) RETURN; DECLARE @tmpXIS TABLE( [object_id] int, [schema_name] VARCHAR(100) COLLATE database_default, [table_name] VARCHAR(300) COLLATE database_default, [index_id] int, [index_name] VARCHAR(300) COLLATE database_default, total_bucket_count bigint, empty_bucket_count bigint, avg_chain_length bigint, max_chain_length bigint, KeyCols VARCHAR(4000) COLLATE database_default, DistinctCnt bigint NULL, isdone bit ) INSERT INTO @tmpXIS SELECT xis.[object_id], t.name, o.name, xis.index_id, si.name, xhis.total_bucket_count, xhis.empty_bucket_count, xhis.avg_chain_length, xhis.max_chain_length, SUBSTRING( ( SELECT ',' + ac.name FROM sys.tables AS st WITH (NOLOCK) INNER JOIN sys.indexes AS i WITH (NOLOCK) ON st.[object_id] = i.[object_id] INNER JOIN sys.index_columns AS ic WITH (NOLOCK) ON i.[object_id] = ic.[object_id] AND i.[index_id] = ic.[index_id] INNER JOIN sys.all_columns AS ac WITH (NOLOCK) ON st.[object_id] = ac.[object_id] AND ic.[column_id] = ac.[column_id] WHERE si.[object_id] = i.[object_id] AND si.index_id = i.index_id AND ic.is_included_column = 0 ORDER BY ic.key_ordinal FOR XML PATH('') ), 2, 8000 ) AS KeyCols, NULL distinctCntOUT, 0 FROM sys.dm_db_xtp_hash_index_stats AS xhis INNER JOIN sys.dm_db_xtp_index_stats AS xis ON xis.[object_id] = xhis.[object_id] AND xis.[index_id] = xhis.[index_id] INNER JOIN sys.indexes AS si (NOLOCK) ON xis.[object_id] = si.[object_id] AND xis.[index_id] = si.[index_id] INNER JOIN sys.objects AS o (NOLOCK) ON si.[object_id] = o.[object_id] INNER JOIN sys.tables AS mst (NOLOCK) ON mst.[object_id] = o.[object_id] INNER JOIN sys.schemas AS t (NOLOCK) ON t.[schema_id] = mst.[schema_id] WHERE o.[type] = 'U' DECLARE @objectid int, @indexid int, @sqlcmd NVARCHAR(4000), @params NVARCHAR(500), @schema_name VARCHAR(100), @table_name VARCHAR(300), @KeyCols VARCHAR(4000), @distinctCnt bigint IF EXISTS ( SELECT TOP 1 [object_id] FROM @tmpXIS WHERE isdone = 0 ) BEGIN WHILE ( SELECT COUNT([object_id]) FROM @tmpXIS WHERE isdone = 0 ) > 0 BEGIN SELECT TOP 1 @objectid = [object_id], @indexid = [index_id], @schema_name = [schema_name], @table_name = [table_name], @KeyCols = KeyCols FROM @tmpXIS WHERE isdone = 0 SELECT @sqlcmd = 'SELECT @distinctCntOUT=COUNT(*) FROM (SELECT DISTINCT ' + @KeyCols + ' FROM ' + @schema_name + '.' + @table_name + ') t1;' EXECUTE sp_executesql @sqlcmd, N'@distinctCntOUT bigint OUTPUT', @distinctCntOUT = @distinctCnt OUTPUT UPDATE @tmpXIS SET DistinctCnt = @distinctCnt, isdone = 1 WHERE [object_id] = @objectid AND [index_id] = @indexid; END; END; SELECT CONCAT([schema_name], '.', table_name, '.', index_name) AS IndexFullName, FLOOR( ( CAST(empty_bucket_count AS FLOAT) / total_bucket_count ) * 100 ) EmptyBucketPct, total_bucket_count, avg_chain_length, DistinctCnt FROM @tmpXIS"
        }
      }
    ],
    "XTPNonClusteredIndexHashStatistics": [
      {
        "type": "SQL",
        "target": {
          "type": "Database",
          "platform": [
            "Windows",
            "Linux"
          ],
          "version": "[12.0,)"
        },
        "implementation": {
          "useDatabase": true,
          "query": "SELECT DISTINCT CONCAT(t.name, '.', o.name, '.', si.name) AS IndexFullName, FLOOR( ( CAST(page_update_retry_count AS FLOAT) /CASE WHEN page_update_count = 0 THEN 1 ELSE page_update_count END ) * 100 ) AS page_update_count_pct, FLOOR( ( CAST(page_consolidation_retry_count AS FLOAT) /CASE WHEN page_consolidation_count = 0 THEN 1 ELSE page_consolidation_count END ) * 100 ) AS page_consolidation_count_pct, FLOOR( ( CAST(page_split_retry_count AS FLOAT) /CASE WHEN page_split_count = 0 THEN 1 ELSE page_split_count END ) * 100 ) AS page_split_count_pct, FLOOR( ( CAST(key_split_retry_count AS FLOAT) /CASE WHEN key_split_count = 0 THEN 1 ELSE key_split_count END ) * 100 ) AS key_split_count_pct, FLOOR( ( CAST(page_merge_retry_count AS FLOAT) /CASE WHEN page_merge_count = 0 THEN 1 ELSE page_merge_count END ) * 100 ) AS page_merge_count_pct, FLOOR( ( CAST(key_merge_retry_count AS FLOAT) /CASE WHEN key_merge_count = 0 THEN 1 ELSE key_merge_count END ) * 100 ) AS key_merge_count_pct FROM sys.dm_db_xtp_nonclustered_index_stats AS xnis (NOLOCK) INNER JOIN sys.dm_db_xtp_index_stats AS xis (NOLOCK) ON xis.[object_id] = xnis.[object_id] AND xis.[index_id] = xnis.[index_id] INNER JOIN sys.indexes AS si (NOLOCK) ON xis.[object_id] = si.[object_id] AND xis.[index_id] = si.[index_id] INNER JOIN sys.objects AS o (NOLOCK) ON si.[object_id] = o.[object_id] INNER JOIN sys.tables AS mst (NOLOCK) ON mst.[object_id] = o.[object_id] INNER JOIN sys.schemas AS t (NOLOCK) ON t.[schema_id] = mst.[schema_id] WHERE o.[type] = 'U'"
        }
      }
    ],
    "CpuUsage": [
      {
        "type": "SQL",
        "target": {
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer, ManagedInstance",
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "DECLARE @ts_now bigint; SELECT @ts_now = ms_ticks FROM sys.dm_os_sys_info(NOLOCK); SELECT 100 - SystemIdle AS AVGTotalCPUUsage ,AVGSQLCPUUsage ,100 - SystemIdle - AVGSQLCPUUsage AS AVGCPUUsageByOther FROM ( SELECT AVG(SystemIdle) AS SystemIdle ,AVG(SQLProcessUtilization) AS AVGSQLCPUUsage FROM ( SELECT record.value('(./Record/SchedulerMonitorEvent/SystemHealth/SystemIdle)[1]', 'int') AS SystemIdle ,record.value('(./Record/SchedulerMonitorEvent/SystemHealth/ProcessUtilization)[1]', 'int') AS SQLProcessUtilization FROM ( SELECT CONVERT(xml, record) AS record FROM sys.dm_os_ring_buffers(NOLOCK) WHERE ring_buffer_type = N'RING_BUFFER_SCHEDULER_MONITOR' AND record LIKE '%<SystemHealth>%' AND @ts_now - [timestamp] <= 7200000 ) AS xrb ) AS si ) AS a WHERE SystemIdle IS NOT NULL AND AVGSQLCPUUsage IS NOT NULL"
        }
      }
    ],
    "TF6533SpatialFunctionsUsage": [
      {
        "type": "SQL",
        "target": {
          "type": "Database",
          "platform": [
            "Windows",
            "Linux"
          ],
          "version": "[11.0,)"
        },
        "implementation": {
          "useDatabase": true,
          "query": "SELECT DISTINCT 1 AS InUse FROM sys.sql_modules (NOLOCK) WHERE OBJECTPROPERTY([object_id],'IsMSShipped')=0 AND (PATINDEX('%.strelate(%',LOWER([definition]) COLLATE DATABASE_DEFAULT)>1 OR PATINDEX('%.stasbinary(%',LOWER([definition]) COLLATE DATABASE_DEFAULT)>1)",
          "transform": {
            "type": "noData",
            "define": {
              "InUse": 0
            }
          }
        }
      }
    ],
    "FKNotTrusted": [
      {
        "type": "SQL",
        "target": {
          "type": "Database",
          "platform": [
            "Windows",
            "Linux"
          ],
          "version": "[11.0,)"
        },
        "implementation": {
          "useDatabase": true,
          "query": "SELECT CONCAT(QUOTENAME(t.name),'.',QUOTENAME(mst.name),'.',QUOTENAME(FKC.name)) AS [constraint_name] FROM sys.foreign_keys FKC (NOLOCK) INNER JOIN sys.objects o (NOLOCK) ON FKC.parent_object_id=o.[object_id] INNER JOIN sys.tables mst (NOLOCK) ON mst.[object_id]=o.[object_id] INNER JOIN sys.schemas t (NOLOCK) ON t.[schema_id]=mst.[schema_id] WHERE o.type='U' AND FKC.is_not_trusted=1 AND FKC.is_not_for_replication=0 AND o.[is_ms_shipped] = 0 GROUP BY o.[schema_id],mst.[object_id],FKC.name,t.name,mst.name UNION ALL SELECT CONCAT(QUOTENAME(t.name),'.',QUOTENAME(mst.name),'.',QUOTENAME(CC.name)) FROM sys.check_constraints CC (NOLOCK) INNER JOIN sys.objects o (NOLOCK) ON CC.parent_object_id=o.[object_id] INNER JOIN sys.tables mst (NOLOCK) ON mst.[object_id]=o.[object_id] INNER JOIN sys.schemas t (NOLOCK) ON t.[schema_id]=mst.[schema_id] WHERE o.type='U' AND CC.is_not_trusted=1 AND CC.is_not_for_replication=0 AND CC.is_disabled=0 AND o.[is_ms_shipped] = 0 GROUP BY t.[schema_id],mst.[object_id],CC.name,t.name,mst.name",
          "transform": {
            "type": "aggregate",
            "map": {
              "constraint_name": "join"
            }
          }
        }
      }
    ],
    "ObjectStatistics": [
      {
        "type": "SQL",
        "target": {
          "type": "Database",
          "platform": [
            "Windows",
            "Linux"
          ],
          "version": "[11.0.3000,)"
        },
        "implementation": {
          "useDatabase": true,
          "query": "SELECT DISTINCT CONCAT(t.name, '.', OBJECT_NAME(mst.[object_id])) AS [TableName], ss.name AS [StatName], sp.[rows], sp.modification_counter, sp.rows_sampled FROM sys.objects AS o WITH (NOLOCK) INNER JOIN sys.tables AS mst WITH (NOLOCK) ON mst.[object_id] = o.[object_id] INNER JOIN sys.schemas AS t WITH (NOLOCK) ON t.[schema_id] = mst.[schema_id] INNER JOIN sys.stats AS ss WITH (NOLOCK) ON ss.[object_id] = mst.[object_id] CROSS APPLY sys.dm_db_stats_properties(ss.[object_id], ss.[stats_id]) AS sp WHERE sp.[rows] > 0"
        }
      },
      {
        "type": "SQL",
        "target": {
          "type": "Database",
          "platform": [
            "Windows",
            "Linux"
          ],
          "version": "[11.0, 11.0.3000)"
        },
        "implementation": {
          "useDatabase": true,
          "query": "SELECT DISTINCT CONCAT(t.name, '.', OBJECT_NAME(mst.[object_id])) AS [TableName], ss.name AS [StatName], SUM(p.[rows]) AS [rows], si.rowmodctr AS modification_counter, 0 AS rows_sampled FROM sys.sysindexes AS si WITH (NOLOCK) INNER JOIN sys.objects AS o WITH (NOLOCK) ON si.id = o.[object_id] INNER JOIN sys.tables AS mst WITH (NOLOCK) ON mst.[object_id] = o.[object_id] INNER JOIN sys.schemas AS t WITH (NOLOCK) ON t.[schema_id] = mst.[schema_id] INNER JOIN sys.stats AS ss WITH (NOLOCK) ON ss.[object_id] = o.[object_id] INNER JOIN sys.partitions AS p WITH (NOLOCK) ON p.[object_id] = ss.[object_id] LEFT JOIN sys.indexes i WITH (NOLOCK) ON si.id = i.[object_id] AND si.indid = i.index_id WHERE o.type <> 'S' AND i.name IS NOT NULL GROUP BY mst.[object_id], t.name, rowmodctr, ss.name HAVING SUM(p.[rows]) > 0"
        }
      }
    ],
    "AzVmProps": [
      {
        "type": "AzMetadata",
        "target": {
          "engineEdition": "SqlServer",
          "platform": "Windows",
          "version": "[11.0,)",
          "machineType": "AzureVm"
        },
        "implementation": {
          "query": "$.compute"
        }
      }
    ],
    "DiskFragmentationAnalysis": [
      {
        "type": "WMI",
        "target": {
          "platform": "Windows",
          "engineEdition": "SqlServer",
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "SELECT DeviceID, Name FROM Win32_Volume WHERE DriveType=3 AND Name LIKE '_:\\\\'",
          "methods": {
            "da": "DefragAnalysis"
          }
        }
      }
    ],
    "ErrorLogInfo": [
      {
        "type": "SQL",
        "target": {
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer",
          "version": "[11.0,)"
        },
        "requires": {
          "object permission on sys.xp_enumerrorlogs": [
            "EXECUTE"
          ]
        },
        "implementation": {
          "query": "DECLARE @errorlogs TABLE ( id INT ,[date] NVARCHAR(256) ,size BIGINT ) INSERT INTO @errorlogs EXEC [master].sys.xp_enumerrorlogs SELECT * ,DATEDIFF(dd, [date], GETDATE()) AS age_days FROM @errorlogs"
        }
      }
    ],
    "FullTextServiceInfo": [
      {
        "type": "SQL",
        "target": {
          "engineEdition": "SqlServer, ManagedInstance",
          "platform": [
            "Windows",
            "Linux"
          ],
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "SELECT ISNULL(FULLTEXTSERVICEPROPERTY('IsFulltextInstalled'), 0) AS [IsFulltextInstalled] ,FULLTEXTSERVICEPROPERTY('VerifySignature') AS [VerifySignature] ,FULLTEXTSERVICEPROPERTY('LoadOSResources') AS [LoadOSResources];"
        }
      }
    ],
    "IsClusteredServer": [
      {
        "type": "SQL",
        "target": {
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer",
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "SELECT SERVERPROPERTY('IsClustered') AS is_clustered_server"
        }
      }
    ],
    "MisalignedDiskPartition": [
      {
        "type": "WMI",
        "target": {
          "platform": "Windows",
          "engineEdition": "SqlServer",
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "SELECT Name, StartingOffset FROM Win32_DiskPartition WHERE StartingOffset < $threshold"
        }
      }
    ],
    "NtfsBlockSize": [
      {
        "type": "WMI",
        "target": {
          "platform": "Windows",
          "engineEdition": "SqlServer",
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "SELECT name, blocksize, deviceid FROM Win32_Volume WHERE Capacity <> NULL"
        }
      }
    ],
    "OsSysMemory": [
      {
        "type": "SQL",
        "target": {
          "engineEdition": "SqlServer, ManagedInstance",
          "platform": [
            "Windows",
            "Linux"
          ],
          "version": "[11.0,)"
        },
        "implementation": {
          "useDatabase": true,
          "query": "SELECT * FROM sys.dm_os_sys_memory(NOLOCK)"
        }
      }
    ],
    "PageFileManagement": [
      {
        "type": "Registry",
        "target": {
          "engineEdition": "SqlServer",
          "platform": "Windows",
          "version": "[11.0,)"
        },
        "implementation": {
          "query": {
            "HKEY_LOCAL_MACHINE": {
              "System\\CurrentControlSet\\Control\\Session Manager\\Memory Management": [
                "PagingFiles"
              ]
            }
          }
        }
      }
    ],
    "PowerPlan": [
      {
        "type": "Registry",
        "target": {
          "platform": "Windows",
          "engineEdition": "SqlServer",
          "version": "[11.0,)"
        },
        "implementation": {
          "query": {
            "HKEY_LOCAL_MACHINE": {
              "SOFTWARE\\Policies\\Microsoft\\Power\\PowerSettings": [
                "ActivePowerScheme"
              ],
              "SYSTEM\\CurrentControlSet\\Control\\Power\\User\\PowerSchemes": [
                "ActivePowerScheme"
              ]
            }
          }
        }
      }
    ],
    "ProcessBlockingChains": [
      {
        "type": "SQL",
        "target": {
          "type": "Database",
          "version": "[11.0,)",
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer"
        },
        "implementation": {
          "useDatabase": true,
          "query": "SELECT es.[session_id] AS [blocked_spid], es.[status] AS [blocked_spid_status], ot.task_state AS [blocked_task_status], COALESCE ( owt.wait_duration_ms, ABS(CONVERT(BIGINT,(DATEDIFF(ms, es.last_request_start_time, GETDATE())))) ) / 60000 AS [block_time_min] FROM sys.dm_exec_sessions es LEFT OUTER JOIN sys.dm_exec_requests er ON es.session_id = er.session_id LEFT OUTER JOIN sys.dm_exec_connections ec ON es.session_id = ec.session_id LEFT OUTER JOIN sys.dm_os_waiting_tasks wt ON es.session_id = wt.session_id LEFT OUTER JOIN sys.dm_os_tasks ot ON er.session_id = ot.session_id AND er.request_id = ot.request_id LEFT OUTER JOIN ( SELECT waiting_task_address, wait_duration_ms, ROW_NUMBER() OVER (PARTITION BY waiting_task_address ORDER BY wait_duration_ms DESC) AS row_num FROM sys.dm_os_waiting_tasks WHERE wait_type <> 'SP_SERVER_DIAGNOSTICS_SLEEP' ) owt ON ot.task_address = owt.waiting_task_address AND owt.row_num = 1 OUTER APPLY sys.dm_exec_sql_text(COALESCE(er.sql_handle, ec.most_recent_sql_handle)) AS query WHERE CONVERT(VARCHAR(max), query.text) not like '%sp_server_diagnostics%' AND (es.session_id <> @@SPID AND es.is_user_process = 1) AND (es.session_id IN (SELECT er3.blocking_session_id FROM sys.dm_exec_requests er3) OR er.blocking_session_id IS NOT NULL) AND ((owt.wait_duration_ms/1000) > @waitThreshold OR (er.total_elapsed_time/1000) > @waitThreshold OR er.total_elapsed_time IS NULL) AND er.database_id = DB_ID(@TargetName)"
        }
      }
    ],
    "ReplicationInfo": [
      {
        "type": "Registry",
        "target": {
          "engineEdition": "SqlServer",
          "platform": "Windows",
          "version": "[11.0,)"
        },
        "implementation": {
          "instance": true,
          "query": {
            "HKEY_LOCAL_MACHINE": {
              "SOFTWARE\\Microsoft\\MSSQLServer\\Replication": [
                "IsInstalled"
              ]
            }
          }
        }
      }
    ],
    "ServerBIOSInfo": [
      {
        "type": "Registry",
        "target": {
          "engineEdition": "SqlServer",
          "platform": "Windows",
          "version": "[11.0,)"
        },
        "implementation": {
          "query": {
            "HKEY_LOCAL_MACHINE": {
              "HARDWARE\\DESCRIPTION\\System\\BIOS": [
                "BIOSVendor"
              ]
            }
          }
        }
      }
    ],
    "ServerCPUInfo": [
      {
        "type": "Registry",
        "target": {
          "engineEdition": "SqlServer",
          "platform": "Windows",
          "version": "[11.0,)"
        },
        "implementation": {
          "query": {
            "HKEY_LOCAL_MACHINE": {
              "HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\*": [
                "ProcessorNameString"
              ]
            }
          },
          "transform": {
            "type": "rename",
            "map": {
              "CPUid": "RegistryKeyName"
            }
          }
        }
      }
    ],
    "ServiceControl": [
      {
        "type": "PowerShell",
        "target": {
          "engineEdition": "SqlServer",
          "platform": "Windows",
          "version": "[11.0,)"
        },
        "implementation": {
          "command": "Get-Service -Name $ServiceName | Select-Object -Property Status, Name"
        }
      }
    ],
    "SysConfiguration": [
      {
        "type": "SQL",
        "target": {
          "engineEdition": "SqlServer, ManagedInstance",
          "platform": [
            "Windows",
            "Linux"
          ],
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "SELECT [name], [value] FROM sys.configurations WITH(NOLOCK)",
          "transform": [
            {
              "type": "nameValuePairs",
              "keyColumn": "name",
              "valueColumn": "value",
              "map": {
                "allow updates": "allow_updates",
                "Ad Hoc Distributed Queries": "ad_hoc_distributed_queries",
                "affinity mask": "affinity_mask",
                "affinity I/O mask": "affinity_io_mask",
                "affinity64 mask": "affinity64_mask",
                "affinity64 I/O mask": "affinity64_io_mask",
                "automatic soft-NUMA disabled": "automatic_soft_NUMA_disabled",
                "backup compression default": "backup_compression",
                "blocked process threshold (s)": "block_threshold",
                "clr enabled": "clr_enabled",
                "cost threshold for parallelism": "cost_threshold_for_parallelism",
                "cross db ownership chaining": "cross_db_ownership_chaining",
                "default trace enabled": "default_trace_enabled",
                "index create memory (KB)": "index_create_memory",
                "lightweight pooling": "lightweight_pooling",
                "locks": "locks",
                "max worker threads": "max_worker_threads",
                "max degree of parallelism": "max_dop",
                "max server memory (MB)": "max_server_memory",
                "min memory per query (KB)": "min_memory_per_query",
                "min server memory (MB)": "min_server_memory",
                "network packet size (B)": "network_packet_size",
                "Ole Automation Procedures": "ole_automation_procedures",
                "optimize for ad hoc workloads": "optimize_for_ad_hoc_workloads",
                "priority boost": "priority_boost",
                "query wait (s)": "query_wait",
                "recovery interval (min)": "recovery_interval",
                "remote access": "remote_access",
                "remote admin connections": "remote_admin_connections",
                "remote login timeout (s)": "remote_login_timeout",
                "remote query timeout (s)": "remote_query_timeout",
                "scan for startup procs": "startup_stored_procedures",
                "xp_cmdshell": "xp_cmdshell",
                "fill factor (%)": "fill_factor",
                "disallow results from triggers": "disallow_results_from_triggers",
                "nested triggers": "nested_triggers",
                "server trigger recursion": "server_trigger_recursion",
                "open objects": "open_objects",
                "user connections": "user_connections",
                "max full-text crawl range": "max_full_text_crawl_range",
                "ft crawl bandwidth (max)": "ft_crawl_bandwidth_max",
                "ft crawl bandwidth (min)": "ft_crawl_bandwidth_min",
                "ft notify bandwidth (max)": "ft_notify_bandwidth_max",
                "ft notify bandwidth (min)": "ft_notify_bandwidth_min",
                "show advanced options": "show_advanced_options",
                "cursor threshold": "cursor_threshold",
                "set working set size": "set_working_set_size",
                "user options": "user_options",
                "max text repl size (B)": "max_text_repl_size",
                "media retention": "media_retention",
                "query governor cost limit": "query_governor_cost_limit",
                "transform noise words": "transform_noise_words",
                "precompute rank": "precompute_rank",
                "PH timeout (s)": "PH_timeout",
                "in-doubt xact resolution": "in_doubt_xact_resolution",
                "common criteria compliance enabled": "common_criteria_compliance_enabled",
                "EKM provider enabled": "EKM_provider_enabled",
                "filestream access level": "filestream_access_level",
                "access check cache bucket count": "access_check_cache_bucket_count",
                "access check cache quota": "access_check_cache_quota",
                "Agent XPs": "Agent_XPs",
                "Database Mail XPs": "Database_Mail_XPs",
                "SMO and DMO XPs": "SMO_and_DMO_XPs",
                "Replication XPs": "Replication_XPs",
                "contained database authentication": "contained_database_authentication",
                "remote proc trans": "remote_proc_trans",
                "c2 audit mode": "c2_audit_mode",
                "default language": "default_language",
                "default full-text language": "default_full_text_language",
                "two digit year cutoff": "two_digit_year_cutoff"
              }
            },
            {
              "type": "defaultValue",
              "map": {
                "automatic_soft_NUMA_disabled": 0
              }
            }
          ]
        }
      }
    ],
    "SysDmOsHostInfo": [
      {
        "type": "SQL",
        "target": {
          "engineEdition": "SqlServer",
          "platform": "Windows",
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "SELECT N'Windows' AS [host_platform] ,CASE WHEN [windows_release] IN ( '6.3' ,'10.0' ) AND ( @@VERSION LIKE N'%Build 10586%' OR @@VERSION LIKE N'%Build 14393%' ) THEN N'10.0' ELSE [windows_release] END AS [host_release] ,CASE WHEN @@VERSION LIKE '%<X64>%' THEN 64 ELSE 32 END AS [host_architecture] FROM sys.dm_os_windows_info(NOLOCK)",
          "transform": {
            "type": "parse",
            "map": {
              "host_release": "/^(?<major>\\d+)\\.(?<minor>\\d+)(?:\\.(?<build>\\d+))?(?:\\.(?<revision>\\d+))?$/x"
            }
          }
        }
      },
      {
        "type": "SQL",
        "target": {
          "engineEdition": "SqlServer",
          "platform": "Linux",
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "SELECT [host_platform] AS [host_platform] ,[host_release] AS [host_release] ,64 AS [host_architecture] FROM sys.dm_os_host_info(NOLOCK)",
          "transform": {
            "type": "parse",
            "map": {
              "host_release": "/^(?<major>\\d+)\\.(?<minor>\\d+)(?:\\.(?<build>\\d+))?(?:\\.(?<revision>\\d+))?$/x"
            }
          }
        }
      }
    ],
    "SysDmOsProcessMemory": [
      {
        "type": "SQL",
        "target": {
          "engineEdition": "SqlServer, ManagedInstance",
          "platform": [
            "Windows",
            "Linux"
          ],
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "SELECT locked_page_allocations_kb FROM sys.dm_os_process_memory (NOLOCK)"
        }
      }
    ],
    "SysDmOsSysInfo": [
      {
        "type": "SQL",
        "target": {
          "engineEdition": "SqlServer, ManagedInstance",
          "platform": [
            "Windows",
            "Linux"
          ],
          "version": [
            "[11.0.7001,12.0)",
            "[12.0.6024,13.0)",
            "[13.0.4001,)"
          ]
        },
        "implementation": {
          "query": "SELECT max_workers_count, virtual_machine_type, sql_memory_model FROM sys.dm_os_sys_info (NOLOCK)"
        }
      },
      {
        "type": "SQL",
        "target": {
          "engineEdition": "SqlServer, ManagedInstance",
          "platform": [
            "Windows",
            "Linux"
          ],
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "SELECT max_workers_count, virtual_machine_type, 0 AS sql_memory_model FROM sys.dm_os_sys_info (NOLOCK)"
        }
      }
    ],
    "Win32Volume": [
      {
        "type": "SQL",
        "target": {
          "platform": "Windows",
          "engineEdition": "SqlServer",
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "SELECT DISTINCT CASE WHEN LEFT(physical_name, 1)= '\\' THEN LEFT(physical_name, charindex('\\',physical_name,5)) ELSE LEFT(physical_name,3) END AS [masterFilesVolumeName] FROM sys.master_files WITH (NOLOCK) WHERE [database_id] <> 32767;"
        }
      }
    ],
    "WorkerThreads": [
      {
        "type": "SQL",
        "target": {
          "engineEdition": "SqlServer",
          "platform": [
            "Windows",
            "Linux"
          ],
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "SELECT (SUM(runnable_tasks_count) / COUNT(scheduler_id)) AS [overall_runnable_tasks_count], SUM(work_queue_count) AS [schedulers_work_queue_count] FROM sys.dm_os_schedulers WHERE parent_node_id < 64 AND scheduler_id < 255"
        }
      }
    ],
    "AGConfiguration": [
      {
        "type": "SQL",
        "target": {
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer",
          "version": "[11.0, 13.0)"
        },
        "runFor": {
          "feature": [
            "HADR"
          ]
        },
        "implementation": {
          "query": "SELECT ag.group_id AS ag_id, ag.[name] AS ag_name, ar.replica_id, ar.replica_server_name AS ag_replica_server, ar_state.is_local AS is_ag_replica_local, ar.availability_mode, ar.availability_mode_desc, ar.failover_mode, ar.failover_mode_desc, ar_state.[role] AS ag_replica_role, ar_state.role_desc AS ag_replica_role_desc, ar_state.operational_state AS ag_replica_operational_state, ISNULL(ar_state.operational_state_desc, 'UNKNOWN') AS ag_replica_operational_state_desc, ar_state.connected_state AS ag_replica_connected_state, ar_state.synchronization_health AS ag_replica_synchronization_health, ar.secondary_role_allow_connections, ar.secondary_role_allow_connections_desc, avg_state.primary_recovery_health, avg_state.primary_recovery_health_desc, avg_state.synchronization_health, avg_state.synchronization_health_desc, ar.backup_priority, ag.automated_backup_preference, ag.automated_backup_preference_desc, ag.failure_condition_level, ag.health_check_timeout, ar.session_timeout, ar.endpoint_url, CASE WHEN loc_r.replica_id IS NOT NULL THEN 1 ELSE 0 END AS is_on_primary_replica, CAST(0 AS BIT) AS is_distributed, ar_state.recovery_health AS ag_replica_recovery_health FROM sys.availability_groups AS ag WITH (NOLOCK) INNER JOIN sys.availability_replicas AS ar WITH (NOLOCK) ON ag.group_id = ar.group_id INNER JOIN sys.dm_hadr_availability_replica_states AS ar_state WITH (NOLOCK) ON ar.replica_id = ar_state.replica_id INNER JOIN sys.dm_hadr_availability_group_states AS avg_state WITH (NOLOCK) ON avg_state.group_id = ag.group_id LEFT JOIN sys.dm_hadr_availability_replica_states AS loc_r WITH (NOLOCK) ON loc_r.is_local = 1 AND loc_r.[role] = 1 AND loc_r.group_id = ag.group_id"
        }
      },
      {
        "type": "SQL",
        "target": {
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer",
          "version": "[13.0,)"
        },
        "runFor": {
          "feature": [
            "HADR"
          ]
        },
        "implementation": {
          "query": "SELECT ag.group_id AS ag_id, ag.[name] AS ag_name, ar.replica_id, ar.replica_server_name AS ag_replica_server, ar_state.is_local AS is_ag_replica_local, ar.availability_mode, ar.availability_mode_desc, ar.failover_mode, ar.failover_mode_desc, ar_state.[role] AS ag_replica_role, ar_state.role_desc AS ag_replica_role_desc, ar_state.operational_state AS ag_replica_operational_state, ISNULL(ar_state.operational_state_desc, 'UNKNOWN') AS ag_replica_operational_state_desc, ar_state.connected_state AS ag_replica_connected_state, ar_state.synchronization_health AS ag_replica_synchronization_health, ar.secondary_role_allow_connections, ar.secondary_role_allow_connections_desc, avg_state.primary_recovery_health, avg_state.primary_recovery_health_desc, avg_state.synchronization_health, avg_state.synchronization_health_desc, ar.backup_priority, ag.automated_backup_preference, ag.automated_backup_preference_desc, ag.failure_condition_level, ag.health_check_timeout, ar.session_timeout, ar.endpoint_url, CASE WHEN loc_r.replica_id IS NOT NULL THEN 1 ELSE 0 END AS is_on_primary_replica, ag.is_distributed, ar_state.recovery_health AS ag_replica_recovery_health FROM sys.availability_groups AS ag WITH (NOLOCK) INNER JOIN sys.availability_replicas AS ar WITH (NOLOCK) ON ag.group_id = ar.group_id INNER JOIN sys.dm_hadr_availability_replica_states AS ar_state WITH (NOLOCK) ON ar.replica_id = ar_state.replica_id INNER JOIN sys.dm_hadr_availability_group_states AS avg_state WITH (NOLOCK) ON avg_state.group_id = ag.group_id LEFT JOIN sys.dm_hadr_availability_replica_states AS loc_r WITH (NOLOCK) ON loc_r.is_local = 1 AND loc_r.[role] = 1 AND loc_r.group_id = ag.group_id"
        }
      }
    ],
    "AGDatabases": [
      {
        "type": "SQL",
        "target": {
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer",
          "version": "[11.0,)"
        },
        "runFor": {
          "feature": [
            "HADR"
          ]
        },
        "implementation": {
          "query": "SELECT d.database_id, DB_NAME(d.database_id) AS databaseName, d.group_id AS ag_id, d.replica_id, d.synchronization_state, d.synchronization_state_desc, d.synchronization_health, d.synchronization_health_desc, d.database_state, d.database_state_desc, rcs.is_database_joined, rcs.is_failover_ready, rcs.is_pending_secondary_suspend FROM sys.dm_hadr_database_replica_states AS d WITH (NOLOCK) INNER JOIN sys.dm_hadr_database_replica_cluster_states AS rcs WITH (NOLOCK) ON rcs.replica_id = d.replica_id AND rcs.group_database_id = d.group_database_id"
        }
      }
    ],
    "AGEndpoints": [
      {
        "type": "SQL",
        "target": {
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer",
          "version": "[11.0,)"
        },
        "runFor": {
          "feature": [
            "HADR"
          ]
        },
        "implementation": {
          "query": "SELECT [name] AS endpoint_name, is_encryption_enabled, encryption_algorithm, encryption_algorithm_desc FROM sys.database_mirroring_endpoints"
        }
      }
    ],
    "AGListener": [
      {
        "type": "SQL",
        "target": {
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer",
          "version": "[11.0,)"
        },
        "runFor": {
          "feature": [
            "HADR"
          ]
        },
        "implementation": {
          "query": "SELECT ag.group_id, agl.listener_id, dns_name, ip_address, ip_subnet_mask, network_subnet_ip, is_dhcp FROM sys.availability_groups AS ag INNER JOIN sys.availability_group_listeners AS agl ON ag.group_id = agl.group_id INNER JOIN sys.availability_group_listener_ip_addresses AS aglip ON aglip.listener_id = agl.listener_id"
        }
      }
    ],
    "AuditSpecs": [
      {
        "type": "SQL",
        "target": {
          "type": "Server",
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer, ManagedInstance",
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "SELECT server_specification_id AS spec_id ,[name] AS spec_name ,audit_guid AS server_audit_guid FROM sys.server_audit_specifications"
        }
      },
      {
        "type": "SQL",
        "target": {
          "type": "Database",
          "platform": "Windows",
          "engineEdition": "Enterprise",
          "version": "[11.0, 13.0.4001)"
        },
        "implementation": {
          "useDatabase": true,
          "query": "SELECT database_specification_id AS spec_id ,[name] AS spec_name ,audit_guid AS server_audit_guid FROM sys.database_audit_specifications"
        }
      },
      {
        "type": "SQL",
        "target": {
          "type": "Database",
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer, ManagedInstance",
          "version": "[13.0.4001,)"
        },
        "implementation": {
          "useDatabase": true,
          "query": "SELECT database_specification_id AS spec_id ,[name] AS spec_name ,audit_guid AS server_audit_guid FROM sys.database_audit_specifications"
        }
      }
    ],
    "AzDiskMetadata": [
      {
        "type": "CLR",
        "name": "AzDiskMetadata",
        "target": {
          "platform": "Windows",
          "engineEdition": "SqlServer",
          "version": "[11.0,)",
          "machinetype": "AzureVm"
        },
        "implementation": {
          "class": "Microsoft.SqlServer.Management.Assessment.Probes.AzDiskMetadataProbe"
        }
      }
    ],
    "AzStorage": [
      {
        "type": "CLR",
        "name": "AzStorage",
        "target": {
          "platform": "Windows",
          "engineEdition": "SqlServer",
          "version": "[11.0,)",
          "machinetype": "AzureVm"
        },
        "implementation": {
          "class": "Microsoft.SqlServer.Management.Assessment.Probes.AzStorageProbe"
        }
      }
    ],
    "BackupTables": [
      {
        "type": "SQL",
        "target": {
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer",
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "SELECT N'msdb..backupfile' AS table_name, COUNT(*) AS row_count FROM msdb..backupfile WITH (NOLOCK) UNION SELECT N'msdb..backupmediafamily', COUNT(*) FROM msdb..backupmediafamily WITH (NOLOCK) UNION SELECT N'msdb..backupmediaset', COUNT(*) FROM msdb..backupmediaset WITH (NOLOCK) UNION SELECT N'msdb..backupset', COUNT(*) FROM msdb..backupset WITH (NOLOCK) UNION SELECT N'msdb..restorefile', COUNT(*) FROM msdb..restorefile WITH (NOLOCK) UNION SELECT N'msdb..restorefilegroup', COUNT(*) FROM msdb..restorefilegroup WITH (NOLOCK) UNION SELECT N'msdb..restorehistory', COUNT(*) FROM msdb..restorehistory WITH (NOLOCK)"
        }
      }
    ],
    "BasicPerformance": [
      {
        "type": "Performance",
        "target": {
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer, ManagedInstance",
          "version": "[11.0,)"
        },
        "implementation": {
          "NumberOfSamples": 2,
          "Interval": 15,
          "Counters": {
            "Access Methods": {
              "Forwarded Records/sec": "forwarded_records_sec",
              "FreeSpace Scans/sec": "freespace_scans_sec",
              "Full Scans/sec": "full_scans_sec",
              "Index Searches/sec": "index_searches_sec",
              "Page Splits/sec": "page_splits_sec",
              "Scan Point Revalidations/sec": "scan_point_revalidations_sec",
              "Workfiles Created/sec": "workfiles_created_sec",
              "Worktables Created/sec": "worktables_created_sec",
              "Worktables From Cache Base": "worktables_from_cache_base",
              "Worktables From Cache Ratio": "worktables_from_cache_ratio"
            },
            "Buffer Manager": {
              "Buffer cache hit ratio": "buffer_cache_hit_ratio",
              "Buffer cache hit ratio base": "buffer_cache_hit_ratio_base",
              "Lazy writes": "lazy_writes",
              "Page life expectancy": "page_life_expectancy",
              "Page lookups/sec": "page_lookups_sec"
            },
            "Cursor Manager by Type": {
              "Cursor Requests/sec": "cursor_requests_sec"
            },
            "Database Replica": {
              "Log Send Queue": "log_send_queue",
              "Mirrored Write Transactions/sec": "mirrored_write_transactions_sec",
              "Recovery Queue": "recovery_queue",
              "Transaction Delay": "transaction_delay"
            },
            "Latches": {
              "Total Latch Wait Time (ms)": "total_latch_wait_time_ms",
              "Latch Waits/sec": "latch_waits_sec"
            },
            "Locks": {
              "Lock Wait Time (ms)": "lock_wait_time_ms",
              "Number of Deadlocks/sec": "number_of_deadlocks_sec",
              "Lock Requests/sec": "lock_requests_sec"
            },
            "Memory Manager": {
              "Free Memory (KB)": "free_memory_kb",
              "Memory Grants Pending": "memory_grants_pending"
            },
            "SQL Statistics": {
              "Batch Requests/sec": "batch_request_sec",
              "SQL Compilations/sec": "sql_compilations_sec",
              "SQL Re-Compilations/sec": "sql_recompilations_sec"
            },
            "Wait Statistics": {
              "Log write waits": "log_write_waits",
              "Network IO waits": "network_io_waits",
              "Non-Page latch waits": "non_page_latch_waits",
              "Page IO latch waits": "page_io_latch_waits",
              "Page latch waits": "page_latch_waits",
              "Wait for the worker": "wait_for_the_worker"
            }
          }
        }
      }
    ],
    "ComputerSystem": [
      {
        "type": "WMI",
        "target": {
          "platform": "Windows",
          "engineEdition": "SqlServer",
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "SELECT DomainRole FROM Win32_ComputerSystem"
        }
      }
    ],
    "DatabaseBackupsMedia": [
      {
        "type": "SQL",
        "target": {
          "type": "Database",
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer",
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "SELECT b.[database_name] ,b.[name] AS backup_name ,b.[type] AS backup_type ,b.recovery_model ,m.[name] AS mediaset_name ,f.logical_device_name ,f.physical_device_name ,f.device_type FROM msdb..backupset b INNER JOIN msdb..backupmediaset m ON b.media_set_id = m.media_set_id INNER JOIN msdb..backupmediafamily f ON m.media_set_id = f.media_set_id WHERE b.[type] = ISNULL(NULL, b.[type]) AND b.[database_name] = @TargetName"
        }
      }
    ],
    "DatabaseMirroring": [
      {
        "type": "SQL",
        "target": {
          "platform": "Windows",
          "engineEdition": "SqlServer",
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "SELECT db.database_id ,db.[name] AS [database_name] ,mirroring_state ,mirroring_role FROM sys.databases AS db INNER JOIN sys.database_mirroring AS dbm ON dbm.database_id = db.database_id WHERE mirroring_state IS NOT NULL"
        }
      }
    ],
    "DatabasesAggregates": [
      {
        "type": "SQL",
        "target": {
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer",
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "SELECT MIN(compatibility_level) as min_compatibility_level, MAX(compatibility_level) as max_compatibility_level FROM sys.databases WITH (NOLOCK)"
        }
      }
    ],
    "DatabaseSharedVolumes": [
      {
        "type": "SQL",
        "target": {
          "type": "Server",
          "platform": "Windows",
          "engineEdition": "SqlServer",
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "WITH master_volumes AS ( SELECT DISTINCT mf.database_id ,dbs.[name] AS [database_name] ,CASE WHEN dbs.[name] IN ( 'master' ,'model' ,'msdb' ,'tempdb' ) THEN 1 ELSE dbs.is_distributor END AS is_system_database ,volume_id ,volume_mount_point FROM sys.master_files AS mf WITH (NOLOCK) INNER JOIN sys.databases AS dbs WITH (NOLOCK) ON mf.database_id = dbs.database_id CROSS APPLY sys.dm_os_volume_stats(mf.database_id, mf.file_id) WHERE ISNULL(volume_id, '') <> '' ) SELECT dbs.* FROM master_volumes AS dbs WITH (NOLOCK) INNER JOIN master_volumes AS db WITH (NOLOCK) ON db.volume_id = dbs.volume_id AND db.database_id = @dbId AND db.database_id <> dbs.database_id AND dbs.is_system_database = ISNULL(@is_system_database, dbs.is_system_database)"
        }
      },
      {
        "type": "SQL",
        "target": {
          "type": "Database",
          "platform": "Windows",
          "engineEdition": "SqlServer",
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "WITH master_volumes AS ( SELECT DISTINCT mf.database_id ,dbs.[name] AS [database_name] ,CASE WHEN dbs.[name] IN ( 'master' ,'model' ,'msdb' ,'tempdb' ) THEN 1 ELSE dbs.is_distributor END AS is_system_database ,volume_id ,volume_mount_point FROM sys.master_files AS mf WITH (NOLOCK) INNER JOIN sys.databases AS dbs WITH (NOLOCK) ON mf.database_id = dbs.database_id CROSS APPLY sys.dm_os_volume_stats(mf.database_id, mf.file_id) WHERE ISNULL(volume_id, '') <> '' ) SELECT dbs.* FROM master_volumes AS dbs WITH (NOLOCK) INNER JOIN master_volumes AS db WITH (NOLOCK) ON db.volume_id = dbs.volume_id AND db.[database_name] = @TargetName AND db.database_id <> dbs.database_id AND dbs.is_system_database = ISNULL(@is_system_database, dbs.is_system_database)"
        }
      }
    ],
    "DatabasesState": [
      {
        "type": "SQL",
        "target": {
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer, ManagedInstance",
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "SELECT db.name as DbName, db.source_database_id, db.[state] AS DbState, db.state_desc AS DbStateDesc, db.recovery_model, db.is_in_standby FROM [sys].[databases] (NOLOCK) AS db"
        }
      }
    ],
    "DbFilesDefaultLocation": [
      {
        "type": "Registry",
        "target": {
          "engineEdition": "SqlServer",
          "platform": "Windows",
          "version": "[11.0,)"
        },
        "implementation": {
          "instance": true,
          "query": {
            "HKEY_LOCAL_MACHINE": {
              "Software\\Microsoft\\MSSQLServer\\MSSQLServer": [
                "DefaultData",
                "DefaultLog",
                "BackupDirectory"
              ]
            }
          },
          "transform": [
            {
              "type": "noData"
            },
            {
              "type": "defaultValue",
              "map": {
                "DefaultData": "",
                "DefaultLog": "",
                "BackupDirectory": ""
              }
            }
          ]
        }
      }
    ],
    "DifferenceConfigRunValues": [
      {
        "type": "SQL",
        "target": {
          "engineEdition": "SqlServer, ManagedInstance",
          "platform": [
            "Windows",
            "Linux"
          ],
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "SELECT [name] AS unsaved_option FROM ( SELECT [name] ,CASE WHEN configuration_id = 1543 AND [value] = 0 AND value_in_use <> 0 THEN CASE WHEN CAST(SERVERPROPERTY('Edition') AS NVARCHAR(128)) LIKE '%(64-bit)' THEN 16 ELSE 8 END WHEN configuration_id = 1544 AND [value] = 0 AND value_in_use <> 0 THEN 2147483647 ELSE [value] END AS configured_value ,value_in_use FROM sys.configurations ) AS i WHERE configured_value <> value_in_use"
        }
      }
    ],
    "ErrorLog": [
      {
        "type": "SQL",
        "target": {
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer, ManagedInstance",
          "version": "[11.0,)"
        },
        "requires": {
          "object permission on sys.xp_enumerrorlogs": [
            "EXECUTE"
          ],
          "object permission on sys.xp_readerrorlog": [
            "EXECUTE"
          ]
        },
        "implementation": {
          "timeout": 90,
          "query": "DECLARE @filter NVARCHAR(2048) ,@pattern NVARCHAR(2048) SELECT @pattern = REPLACE(LEFT([text], CHARINDEX(fc, [text]) + LEN(fc)), fc, '%') ,@filter = LEFT([text], CHARINDEX('%', [text]) - 1) FROM ( SELECT CASE WHEN CHARINDEX('%d', [text]) > 0 THEN '%d' ELSE '%1!' END AS fc ,[text] FROM sys.messages WHERE message_id = 18052 AND language_id = ( SELECT msglangid FROM sys.syslanguages WHERE [name] = ISNULL(@language, @@LANGUAGE) COLLATE DATABASE_DEFAULT ) ) AS i DECLARE @errorlogs TABLE ( num INT ,[date] DATETIME ,[size] INT ) INSERT INTO @errorlogs EXEC xp_enumerrorlogs DELETE FROM @errorlogs WHERE [size] > @max_log_size_mb * 1048576 OR [date] < DATEADD(day, - @history_days, GETDATE()) DECLARE @content TABLE ( [date] DATETIME ,spid VARCHAR(50) ,[message] NVARCHAR(4000) ) DECLARE @results TABLE ( errorId INT ,[date] DATETIME ) DECLARE @i INT = - 1 WHILE EXISTS ( SELECT 1 FROM @errorlogs WHERE num > @i ) BEGIN SET @i = ( SELECT TOP 1 num FROM @errorlogs WHERE num > @i ORDER BY num ) INSERT INTO @content EXEC sys.xp_readerrorlog @i ,1 ,@filter INSERT INTO @results SELECT LEFT(l, CHARINDEX(RIGHT(@pattern, 1), l) - 1) ,[date] FROM ( SELECT LTRIM(RIGHT(RTRIM([message]), LEN(RTRIM([message])) - LEN(@filter))) AS l ,[date] FROM @content AS c WHERE c.[message] LIKE (@pattern + '%') COLLATE DATABASE_DEFAULT ) AS i DELETE FROM @content END SELECT errorId ,COUNT(errorId) AS error_count ,MAX([date]) AS last_occurrence FROM @results GROUP BY errorId"
        }
      }
    ],
    "GetAzVmId": [
      {
        "type": "WMI",
        "target": {
          "engineEdition": "SqlServer",
          "platform": "Windows",
          "version": "[11.0,)",
          "machineType": "AzureVm"
        },
        "implementation": {
          "query": "SELECT UUID FROM Win32_ComputerSystemProduct",
          "transform": {
            "type": "rename",
            "map": {
              "vmId": "Output.UUID"
            }
          }
        }
      }
    ],
    "GetAzVmResourceId": [
      {
        "type": "AzGraph",
        "target": {
          "engineEdition": "SqlServer",
          "platform": "Windows",
          "version": "[11.0,)",
          "machineType": "AzureVm"
        },
        "implementation": {
          "query": "Resources\r\n    | where type =~ 'Microsoft.Compute/virtualMachines'\r\n    | where properties.vmId =~ @vmId\r\n    | project resourceId = id\r\n    | take 1"
        }
      }
    ],
    "OsLoadedModules": [
      {
        "type": "SQL",
        "target": {
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer",
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "SELECT [name] AS [module] ,company ,file_version ,product_version FROM sys.dm_os_loaded_modules",
          "transform": {
            "type": "parse",
            "map": {
              "module": "/^(?:.*\\\\)?(?<file_name>.+)$/ix"
            }
          }
        }
      }
    ],
    "ResPoolInfo": [
      {
        "type": "SQL",
        "target": {
          "version": "[12.0,)",
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer"
        },
        "implementation": {
          "query": "SELECT min_memory_percent AS [pool_min_memory], max_memory_percent AS [pool_max_memory], pool_id, ISNULL(rpd.[pool_database_count], 0) AS [pool_database_count], rp.[name] as pool_name FROM sys.dm_resource_governor_resource_pools as rp LEFT JOIN ( SELECT resource_pool_id, COUNT(*) AS [pool_database_count] FROM sys.databases (NOLOCK) WHERE resource_pool_id IS NOT NULL GROUP BY resource_pool_id ) as rpd ON rp.pool_id = rpd.resource_pool_id"
        }
      }
    ],
    "ServerAudits": [
      {
        "type": "SQL",
        "target": {
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer, ManagedInstance",
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "SELECT audit_id ,audit_guid ,[name] AS audit_name FROM sys.server_audits"
        }
      }
    ],
    "ServerDatabasesProperties": [
      {
        "type": "SQL",
        "target": {
          "engineEdition": "SqlServer, ManagedInstance",
          "platform": [
            "Windows",
            "Linux"
          ],
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "DECLARE @ColumnStoreTables TABLE(ID INT PRIMARY KEY, DatabaseName NVARCHAR(128), ColumnStoreIndexCount INT) DECLARE @Id INT, @IndexCount INT, @Sql NVARCHAR(255), @MaxId INT INSERT INTO @ColumnStoreTables SELECT ROW_NUMBER() OVER(ORDER BY database_id), [name], 0 FROM sys.databases WHERE HAS_DBACCESS([name]) = 1 SET @Id = 1 SELECT @MaxId = MAX(ID) FROM @ColumnStoreTables WHILE @Id <= @MaxId BEGIN SELECT @Sql = 'USE ' + QUOTENAME(DatabaseName) + ' SELECT @cnt = COUNT(*) FROM sys.indexes WHERE [type] IN (5, 6)' FROM @ColumnStoreTables WHERE ID = @Id BEGIN TRY EXEC sp_executesql @Sql, N'@cnt INT OUTPUT', @IndexCount OUTPUT UPDATE @ColumnStoreTables SET ColumnStoreIndexCount = @IndexCount WHERE ID = @Id END TRY BEGIN CATCH UPDATE @ColumnStoreTables SET ColumnStoreIndexCount = NULL WHERE ID = @Id END CATCH SET @Id = @Id + 1 END SELECT DatabaseName, ColumnStoreIndexCount FROM @ColumnStoreTables WHERE ColumnStoreIndexCount IS NOT NULL"
        }
      }
    ],
    "ServerProperties": [
      {
        "type": "SQL",
        "target": {
          "platform": [
            "Windows",
            "Linux"
          ],
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "SELECT SERVERPROPERTY('IsClustered') AS is_clustered_server ,SERVERPROPERTY('IsIntegratedSecurityOnly') AS is_integrated_security_only ,SERVERPROPERTY('ErrorLogFileName') AS error_log_file_path ,SERVERPROPERTY('Edition') AS [edition] ,CASE WHEN CAST(SERVERPROPERTY('Edition') AS NVARCHAR(128)) LIKE '%(64-bit)' THEN 64 ELSE 32 END AS [architecture]"
        }
      }
    ],
    "ServiceInfo": [
      {
        "type": "WMI",
        "target": {
          "engineEdition": "SqlServer",
          "platform": "Windows",
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "SELECT Name, State FROM Win32_Service WHERE Name = $ServiceName"
        }
      }
    ],
    "SpaceUsage": [
      {
        "type": "SQL",
        "target": {
          "type": "Database",
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer, ManagedInstance",
          "version": "[11.0,)"
        },
        "implementation": {
          "useDatabase": true,
          "query": "SELECT o.[type], o.[type_desc], SUM(total_pages) AS TotalPages, SUM( CASE data_compression_desc WHEN 'NONE' THEN 0 ELSE total_pages END ) AS CompressedPages FROM sys.allocation_units AS au WITH (NOLOCK) INNER JOIN sys.[partitions] AS p WITH (NOLOCK) ON p.[partition_id] = au.container_id INNER JOIN sys.objects AS o WITH (NOLOCK) ON o.[object_id] = p.[object_id] WHERE o.[type] = @type GROUP BY o.[type], o.[type_desc]"
        }
      }
    ],
    "StartupProcs": [
      {
        "type": "SQL",
        "target": {
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer, ManagedInstance",
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "SELECT S.[name] AS [schema_name], P.[name] AS sp_name FROM [master].sys.procedures AS P WITH (NOLOCK) INNER JOIN [master].sys.schemas AS S WITH (NOLOCK) ON P.[schema_id] = S.[schema_id] WHERE is_ms_shipped = 0 AND is_auto_executed = 1"
        }
      }
    ],
    "SysAdminDefaultDatabase": [
      {
        "type": "SQL",
        "target": {
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer, ManagedInstance",
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "SELECT sp.principal_id, sp.default_database_name FROM [sys].[server_principals] AS sp WITH (NOLOCK) INNER JOIN [sys].[server_role_members] AS srm WITH (NOLOCK) ON sp.principal_id = srm.member_principal_id WHERE sp.is_disabled = 0 AND srm.role_principal_id = 3 AND sp.default_database_name != 'master' COLLATE DATABASE_DEFAULT"
        }
      }
    ],
    "SysFullTextLanguages": [
      {
        "type": "SQL",
        "target": {
          "engineEdition": "SqlServer, ManagedInstance",
          "platform": [
            "Windows",
            "Linux"
          ],
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "SELECT [lcid], [name] FROM sys.fulltext_languages WITH(NOLOCK)"
        }
      }
    ],
    "SysOpenTranSessions": [
      {
        "type": "SQL",
        "target": {
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer, ManagedInstance",
          "version": "[11.0,)"
        },
        "implementation": {
          "query": "SELECT session_id ,[status] ,open_transaction_count ,database_id ,cpu_time ,memory_usage FROM sys.dm_exec_sessions WITH (NOLOCK) WHERE is_user_process = ISNULL(@user_session, is_user_process) AND [status] = ISNULL(@status, [status]) AND session_id <> @@spid AND DATEDIFF(MINUTE, ISNULL(last_request_end_time, GETDATE()), GETDATE()) >= @last_request_end_min AND open_transaction_count > 0"
        }
      }
    ],
    "TablesInformation": [
      {
        "type": "SQL",
        "target": {
          "type": "Database",
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer, ManagedInstance",
          "version": "[11.0,)"
        },
        "implementation": {
          "useDatabase": true,
          "query": "SELECT QUOTENAME(SCHEMA_NAME(so.schema_id)) AS SchemaName, QUOTENAME(so.name) AS TableName, COUNT(*) ColumnCount, idx.IndexCount, idx.FilteredIndexCount FROM sys.objects so (NOLOCK) INNER JOIN sys.columns cols (NOLOCK) ON cols.object_id = so.object_id INNER JOIN ( SELECT si.object_id, CASE MIN(si.index_id) WHEN 0 THEN COUNT(si.index_id) - 1 ELSE COUNT(si.index_id) END AS IndexCount, COUNT(si.filter_definition) AS FilteredIndexCount FROM sys.indexes si (NOLOCK) WHERE si.is_hypothetical = 0 GROUP BY si.object_id ) idx ON idx.object_id = so.object_id LEFT JOIN ( SELECT major_id FROM sys.extended_properties (NOLOCK) WHERE [name] = N'microsoft_database_tools_support' ) X ON X.major_id = so.object_id WHERE so.type in ('U','V') AND so.is_ms_shipped = 0 AND X.major_id IS NULL GROUP BY so.schema_id, so.name, idx.IndexCount, idx.FilteredIndexCount"
        }
      }
    ],
    "TopUncompressedTables": [
      {
        "type": "SQL",
        "target": {
          "type": "Database",
          "platform": [
            "Windows",
            "Linux"
          ],
          "engineEdition": "SqlServer, ManagedInstance",
          "version": "[11.0,)"
        },
        "implementation": {
          "useDatabase": true,
          "query": "SELECT TOP (CAST(@topN AS INT)) QUOTENAME(OBJECT_SCHEMA_NAME(t.[object_id])) + '.' + QUOTENAME(t.Name) + CASE WHEN i.name IS NULL THEN '' ELSE '.' + QUOTENAME(i.name) END AS ObjectName, CASE WHEN p.index_id > 0 THEN 1 ELSE 0 END AS ObjectType, SUM(a.total_pages) as TotalIndexPages, SUM( CASE p.data_compression_desc WHEN 'NONE' THEN a.total_pages ELSE 0 END ) as TotalIndexUnCompressedPages FROM sys.[tables] AS t WITH (NOLOCK) INNER JOIN sys.[indexes] AS i WITH (NOLOCK) ON t.[object_id] = i.[object_id] INNER JOIN sys.[partitions] AS p WITH (NOLOCK) ON p.[object_id] = i.[object_id] AND i.[index_id] = p.[index_id] INNER JOIN sys.[allocation_units] AS a WITH (NOLOCK) ON p.[partition_id] = a.[container_id] WHERE t.is_ms_shipped = 0 GROUP BY t.name, t.[object_id], i.name, p.index_id ORDER BY TotalIndexUnCompressedPages DESC"
        }
      }
    ]
  }
}