Blog

One of the sweet things about telecommuting is the ability to pack up the tents and head off to a new location for a while.  Erika’s never seen a real winter, so we’re moving up to my hometown of Whitehall, Michigan.  We’re staying in the Colby State Park – not a real state park, of course, but that’s the family nickname for Grandma & Grandpa Colby’s old house on White Lake.

It’s probably not permanent – we love Houston and warm weather too much to make it permanent.  It’s fun for a while, though.

Expect to see more white and less sun in my photo stream for a while!

Side note – if anybody wants to buy a Vizio 42″ 1080p flat panel with a long warranty, I’ll let it go for $600.  No shipping, local Houston buyers only.  Not really looking forward to putting that thing in storage with the rest of our furniture or moving it up to Michigan.  Update: the TV is sold to Jessica Grieves of Ecor Rouge Photography here in Houston, where it will be displaying beautiful baby pictures during the day and XBox games at night when her husband Jay plays with it.

I had a burst of creativity and suggested to my Twitter peeps that they write short IT horror stories, 140 characters or less, and identify them with #ITBoo.  You can find ’em here on Search.Twitter.com by searching for #ITBoo.

Tulsa Tech Fest is a ginormous cross-discipline tech event that drew over 800 people to two days of fun sessions at OSU-Tulsa.  I learned so much from so many different people that I can’t even begin to lay it all out, but I’m going to throw in the highlights here.

Tulsa developers “get” social media. During one of the keynotes, the speaker asked for a show of hands from everybody on Twitter, and something like 1 in 5 hands went up.  That’s way, way higher of a participation rate than I see when I ask that same question in other cities.  Then, add in the fact that Twitpic and Ping.fm are both born and raised in Tulsa.  Wow.

Ping.fm consists of two guys in Tulsa. Ping.fm is a service that broadcasts your status updates to all of the social networking sites you use – Facebook, Twitter, LinkedIn, MySpace, and so on.  Post your update in one place, and boom, it goes out everywhere.  You can do updates via the web or via email, and if you attach a picture to your email, it handles that too.  Without Ping.fm, I wouldn’t be able to keep up with my friends on so many different social networks.  It works so well and stays up so much more than Twitter that it’s hard to believe it’s done by only two guys.  I met @seamoss and he’s totally down-to-earth.  If I ever started a site that cool, I’d be full of myself.  Heck, I’m full of myself now, and all I have is a blog!  Caught you reading it, though.  Heh.

People still believe virtual servers are smoke and mirrors. I gave a session on VMware and Hyper-V to an audience of people who hadn’t done any work with either platform yet.  About halfway through, I could tell that it wasn’t resonating with the audience, so I stopped and asked, “Okay, wait, how many of you actually believe me that this stuff works?  That say, VMotion works?”  The only raised hands were from the two guys in the audience who’d already done large (200+ host) VMware deployments.  I had to drop out of the slide deck, remote desktop into my lab, and show it in action.  Even then, they still didn’t seem to believe it.  Folks, this stuff is for real, and it’s coming fast.

Mint.com is a free web-based replacement for Quicken. I used to love Quicken, but it’s such a manual pain in the rear.  Mint screen-scrapes your bank’s web site, automatically categorizes your expenses based on the business name, and saves you money by suggesting things like cheaper insurance.  I’m sold.

Chris Bernard is a hell of a presenter. He’s a user experience evangelist for Microsoft, and his design experience carries over to his presentations.  He doesn’t keep turning around and pointing at the slide deck.  He doesn’t go “Uhhh, well, kinda, like, you know.”  He just bangs out his points, and the slides serve to illustrate what he’s talking about in amazing ways.  You can’t get the experience by watching Chris’s keynote on Slideshare, because like a good presenter, he’s not reading bullet points off a screen.  He’s talking about concepts, and supporting images or quotes will pop up behind him, but if you just watch the screen you’re missing the point.  I have a new benchmark to aim for in my presentations.

People love Perfmon. I gave a session on performance tuning, ran right up against my time limit, and people wanted more.  There’s a strong desire to learn more about what specific Perfmon counters mean, and what actions you should take when those counters are high.

Profiler groupings & aggregates can be enabled on the fly. If you get the chance to see Red Gate’s Brad McGehee speak on Profiler, attend, because everybody can learn something.  I eat, breathe and sleep Profiler, and I still didn’t know that you could enable groupings while a profile was running.  He got a lot of oohs and aahs when he showed deadlock graphs too.

Telligent is building cool stuff with social networking inside companies. I use a lot of social networking tools like Twitter to communicate quickly with other SQL Server professionals, and it helps me get my job done faster and have more fun doing it.  Rob Howard of Telligent gave a great keynote on social networking in the enterprise, and everybody was nodding their heads.  The products just made sense.  I’m sure they’re hard to sell to older executives who don’t get the power of things like Twitter, Facebook and LinkedIn yet, but integrated social portals like Telligent’s will help the younger generation get their job done better.

I’m still not seeing an interest in SQL 2008. The vast majority of DBAs I talked to just weren’t interested in putting in the time and effort to do upgrades because the business didn’t see an ROI in it.  They like some of the new features, but they can’t justify the manpower cost.  They also liked a lot of the Enterprise-only features in 2008, and they weren’t sure that management would spring for Enterprise.  Interesting.

Jeremy Marx and David Walker are really nice guys. One of the side effects of using Twitter is that you end up with friends all over the globe who you’ve never actually seen before. I finally got the chance to shake hands with Jeremy & David and talk with ’em for a while, and they’re both great people.  I’ve met more cool people through Twitter in the last few months than I’ve probably met in real life the last 5 years!

I’ll be back next year. I had a great time, and I’m only scratching the surface of everything that happened.  If you’re anywhere near Tulsa, I highly recommend attending Tulsa Tech Fest.  At $2 or 2 cans of food, it’s the best IT conference bargain around.

#TulsaTechFest @msftguy keynote on Live platform – blog to follow

Brian is a great presenter, but my problem with the entire Live platform can be summed up in this one slide.

This slide shows all the different Live services, including Virtual Earth, Search, Hotmail, MSN, SkyDrive, etc. It’s hard to see with my iPhone camera’s emailed photo.

These sites don’t look or feel anything like each other.

Contrast this with Google, where every single product they have looks and feels like it’s part of the same family. It really feels like a platform. Microsoft’s Live stuff is a whole ton of services that are elbowed into the same phone booth using the same name. That doesn’t make it a platform, and it sure isn’t a compelling sales pitch.

Update 9:18 AM – argh.  He’s pushing Windows Live ID, and I have a big problem with corporate ownership of identity.  If Microsoft owns my login ID and controls it across the sites.  Sure, right now it’s free to use for sites up to 1 million logins per month, but that can change at any time, and monopoly on ID is a problem.  I’m not saying Google’s login ownership is any better, but OpenID is better.  Way better.

Update 9:26 AM – ARGH. Now he’s pimping Live’s ability to share your friends with other sites.  Why restrict that to the closed Live system?  Why not pimp the XFN or FOAF open standards?  Dang it!  Where are my open source evangelists?  I love Microsoft – I make a great living off their kick-butt products – but identity ownership gives me the creeps.

Update 9:38 AM – he’s selling the ability to embed Live Messenger in your web site, so visitors can log in to do their instant messaging on your web site.  Uh, what?  Why?  Why would I want to give up screen space on my web site to let users do instant messengers?  He’s showing this “invite a friend” feature and saying it was really easy, but it wasn’t – it involved a multi-step login-and-wait procedure.  Bad user experience, too much screen real estate, and not compelling.  He does a great job of delivering the message, but it’s just a bad message.

Update 9:57 AM – he pitches Silverlight Streaming by Windows Live, and I’m actually interested in that because I want to do some video streaming.  I go to sign up for a free account, and – uh oh….

Earlier, I blogged about the upcoming Kilimanjaro and Gemini releases from Microsoft: self-service BI tools that are delivered inside Excel.  David Stein left a comment which prompted me to write this separate blog entry about self-service BI in general.  Basically, David’s comment was that the quality of data won’t be as good because the end users don’t really know what they’re doing with the data.

He’s right, but it’s the lesser of two evils, and it’s a choice that the organization has to make, and every case is different.

Think back to those movies and TV shows of full service gas stations back in the 1950’s-60’s.  I remember seeing snappily-dressed ladies pulling up to full service pumps where the attendant hustled out, started pumping the gas, and proceeded to pop the hood to check the car’s oil and the tire pressures while the tank filled up.  If it needed oil, he’d grab a few quarts, take care of the engine, and the driver sat comfortably in the car the whole time.

Today, when I pull up to the gas station, I fill the car up, but I gotta be honest: I don’t check the oil level and tire pressure every time.  It’s probably okay, but it might not be, and if it’s not, the only person I’m hurting is myself.

I could go to a full service pump, pay more, and get that taken care of.  I could drive happily knowing that everything in my car was operating at its perfect levels, and that I was avoiding disaster.  But I don’t – I save a few bucks and go to self-service.  Judging by the vanishing number of full-service pumps, I’m not alone.

Plus, it’s not always my car: when I’m rushing to return a rental car before I jet off somewhere else in my glamorous (cough) life as a traveling SQL Server expert, I don’t give a rip whether there’s any oil or if my tires are underinflated.  I wanna throw gas in there and get out as fast as I can to make my flight.

BI faces a similar pressure.  With the advent of self-service BI, our end users will have a choice: do they want perfectly maintained data with no chance of disaster?  Or are they willing to save a few bucks, vet their own data (or not vet it at all) and pump their own reports?  If they choose self-service, they won’t have to sit around waiting for the attendee to come by.

Heck, they can build their own BI reports anytime, anywhere, much like I enjoy driving up to an unmanned pump and filling up my rental car without speaking to a single human being.  (Sorry if that sounds antisocial, but the folks at service stations aren’t always the best conversationalists.)  Sometimes, people just want the best data they can get in the least amount of time so that they can race off to make the next business decision.  Not everything can wait for an ETL process design meeting.

Oh, and by the way, there aren’t a lot of jobs available as full-service gas station attendees….

At the BI Conference in Seattle, Microsoft unveiled some components of project code name Kilimanjaro, a sort of R2 release for SQL Server expected in the first half of 2010.  Here’s a couple of relevant news sources:

• Doug Henschen on Intelligent Enterprise – “Microsoft Will Bow In-Memory Analysis, Appliance-Ready Database in 2010”
• Short Kilimanjaro posts on SQLBlog.com from Marco Russo and from Mosha Pasumansky
• Project Gemini notes from the SQL Server Customer Advisory Team (SQLCAT)
• Information Week story on Kilimanjaro

Here’s the part I really like: Gemini centers around Excel as its user interface.

Let’s face it: our power users live, eat and breathe Excel.  They’re all over it.  They know it forwards and backwards, and they pull tricks with pivot tables that make DBAs scratch their heads.  My bosses have always been able to out-Excel me, and that’s been fine with me.

If Excel is going to be the future interface for self-service BI, with SQL Server as the back end, I for one welcome our new spreadsheet overlords.

Why am I embracing Excel so much?  Because the cloud is coming, open source is coming, and our competitors just keep coming.  The one thing none of them do well is the front end, the power user interface.  None of them have anything even remotely close to a user interface as rich and powerful as Excel.

If my BI team comes in and says, “Give me one good reason we shouldn’t switch our data warehouse over from SQL Server to Oracle/cloud-based MySQL/cheap Postgres/fast-database-du-jour,” I’ve got a new cool answer: our power users love self-service BI with Excel, and nobody else is going to be able to touch that.

Are there beautiful BI front ends out there that put lipstick on Oracle, MySQL and cool new databases?  Sure – but most companies are already licensing Excel on the desktop, and their users know how to use it.  Cheaper, less training, less implementation time – it’s a win all the way around for SQL Server.

And you know what I like the most?  It lets the SQL Server Management Studio team focus on day-to-day DBA task management and stay out of the BI power user business.

Robert X. Cringely is a columnist for PBS – you know, the worldwide authority on hot information technology issues.  You might recognize some of their other experts like Norm Abrams and Big Bird.  Cringely’s just like them, only with less name recognition.

In his latest blog, Cringely explains how cloud computing is going to make databases disappear altogether. Cloud services are going to be so fast that traditional things like SQL Server and Oracle won’t matter anymore.

It’s a really interesting opinion, but you know how it is – there’s two sides to every story.  I’d like to see a larger panel of opinions.  Maybe he could get Rick Steves and Ray Suarez to do a roundtable panel.  Maybe toss in some folks from Masterpiece Theater.

(Note to self: it’s my own fault for reading Cringely’s column in the first place.  He’s like the Enquirer of IT.)

Microsoft License Plate Frame

Picked this up at the Microsoft company store this week in Redmond. Looks great with my SQL license plate!  The only downside is that it blocks out the “Lone Star State” line.

Last week I posted a poll asking DBAs when they would use SQL Server 2008 in production.  Here’s the results after one week:

• In the next 3-6 months. (40%, 8 Votes)
• Not planning it yet. (30%, 6 Votes)
• In the next month or two. (20%, 4 Votes)
• Already done. (10%, 2 Votes)

This week, I had the pleasure of going to a few meetings at Microsoft.  Roger Doherty gave us a presentation talking about why database administrators need to upgrade to SQL Server 2008.  He’s a member of the Developer & Platform Evangelists team, and he’s rightfully excited about all the cool stuff inside SQL 2008.

I played devil’s advocate – and when I say devil, I mean database administrator.

One of the slides was this spiffy graph that showed different approaches to upgrades: when you should do an upgrade-in-place, when you should use the Upgrade Advisor, and so on:

Apps that are simple and have a low strategic importance can just be upgraded in place, whereas on the opposite end of the spectrum, apps that are very complex and have a high strategic importance should have careful planning with code changes to take advantage of the new features.

Okay, I get it, that makes sense.

So how do we as DBAs gather the information to populate this chart?  How do we analyze all of the applications (not just servers, but the individual databases) to determine whether they’re simple or complex, and whether they have a high or low strategic importance?  Roger discussed some of the options in determining app complexity, and basically, we don’t have a good option right now.  The closest thing we have to an automated solution is simply gathering a trace of all queries that hit the database over the course of say, a week, and looking at the queries to see whether they’re using SQL Server’s advanced or deprecated features.  We can pass the profiler data to the Upgrade Advisor, but it won’t give us a measure of how complex the app is – it will only tell us whether the SQL Server upgrade will pass or fail.

During the presentation, I sent out a Twitter message asking my readers how many instances they support per DBA.  The answers I got back ranged around 20-70.  Whaddya know – that’s kinda like the number of instances shown on that slide.

So here’s my problem: that’s a beautiful line graph.  Makes perfect sense.  But now let’s look at how much time it will take to actually upgrade all 20-70 instances that a DBA has to manage:

• Gather a good inventory of servers & databases
• Find out from the app owner whether SQL 2008 is supported (either internally or by the vendor)
• Gather the information to populate the line chart
• Take the actions suggested by the line chart (Upgrade Advisor, plan code changes, etc)
• Arrange for an outage window with the application owners
• Perform the SQL 2008 upgrade
• Test the application post-upgrade

Holy moly.  If each of those took an average of four hours (and I know I’m seriously underestimating that) we’re still talking about 3 days per app.  Say your instances host just one app apiece (a truly laughable concept in the days of consolidation) and we’re talking about 60-210 business days to upgrade 20-70 instances!

Starts to make sense why Microsoft needs guys like Roger – you really do have to bang the drum to get users excited about doing that much work to upgrade.  It’s a tough battle.  I know when I was a DBA a few months ago, I was excited about 2008, but I knew there were few apps I could upgrade right away.  For the rest, the vast majority, I planned to wait until the application owners wanted to drive the upgrade process – so that way they could hassle with the meetings!

A database administrator asked me, “If I’ve been working at a company subject to Sarbanes-Oxley regulations, and I needed to learn what was different about HIPAA regulations, what would be the difference between the two?”

First, in my answer, don’t think about credit card data or customer social security numbers.  That has its own security implications separate from HIPAA or SOX. In our cases, we’re going to assume there’s none of that involved, and later, you’ll see why I kept that out of the conversation.

HIPAA is designed to protect the patient’s confidentiality.

SOX is designed to protect the shareholder’s transparent view into the company.

I’ll keep coming back to those two points because it helps illustrate what we need to protect.

If you’ve been working at a SOX-affected company as a DBA, you implement safeguards to make sure that financial data doesn’t get inserted/updated/deleted without somebody knowing.  Your worst nightmare as a DBA is someone modifying profit & loss data without you being able to catch it, like sliding money around into different accounts.

With HIPAA, on the other hand, your worst nightmare is your database’s contents getting out into the public.  If somebody mucks with health data, sure, that’s a problem, but there’s not much motivation to do it.  The bigger concern is confidential patient data getting into the wrong hands.  In theory, you want tight security on ANY database server, of course, and you don’t want anybody doing unauthorized inserts/updates/deletes.  You still want that at HIPAA-affected companies, but the select auditing is a real pain in the butt, because off-the-shelf 2000/2005 databases aren’t set up for that.

There are some vendors who provide this by doing monitoring on the SQL Server with traces or with behind-the-scenes code analyzing what SQL Server is doing. Other vendors take the approach of a network appliance that sits between your SQL boxes and the rest of the network, and they sniff network traffic going into the SQL box.  Both approaches have their pros and cons, but you get the idea – we’re talking about infrastructure mods, not something DBAs take lightly.  (My employer, Quest Software, has solutions for HIPAA and SOX compliance for databases and Windows, but I’m not up to speed on that software yet.)

But it gets tougher: auditing is just the start.  In a SOX-affected company, you don’t lose that much sleep wondering what would happen if somebody stole your tape backups en route to an offsite location.  Sure, they’d get a copy of your balance sheets, but that stuff is pretty much public sooner or later anyway, because only public companies are really subject to SOX.  If you’re a private company and you’re choosing to abide by SOX regulations, then the tape theft scenario is a problem, but as the DBA, it’s not really technically YOUR problem.  If somebody gets the tape backup, they can restore it and read it, but it’s not like they’re going to set up a fake balance sheet and do something with it.

On the other hand, with HIPAA-affected data, we’re talking about patient health histories.  If somebody gets a tape backup with health insurance data for a million customers, finds out what people are sick with what diseases, there is a HUGE financial risk there.  The patients can sue, or the thief can sell that data to a private company who would do targeted advertisement at those customers.  Imagine getting a phone call from a spammer saying, “We hear you’ve got herpes, and we’ve got a great drug to treat it.”  Ugh.  Lawsuit city.

So not only do you have to protect the data, you have to make schema design decisions in an effort to abstract the customer from the treatment records.

I’ll give you an example: take a survey company that sends surveys to hospital patients.  The hospital would send over a list of patients, but not any information about their treatments whatsoever.  The survey company would email out the surveys, compile the data, and then return the raw survey data back to the hospital for their own processing.  See, the hospital wants to do reporting to find out if people who got a particular treatment were more or less satisfied than patients who got another treatment, but they can’t give that data out to the survey company because that might violate HIPAA. If the hospital wanted to give out that data, they would need to make sure that all of the survey company’s data was as secure as the hospital data, and that’s an auditing mess.

Something else you see in HIPAA-affected databases are app-level encryption – like encrypting a patient’s name/address/SSN/etc in the application, and then storing that encrypted data in SQL Server – but not the key.  That way, even if the DBA gets curious and selects patient data, he won’t be able to grab a list of people with broken arms or whatever.

Now you see why I left out the credit card data.  Sure, that’s private, and it can affect both HIPAA and SOX companies if they store that kind of thing, but it’s unrelated to either.

I’ve made a lot of grand sweeping generalizations in this post, but it’s just to illustrate the basic differences.  I know SOX people are having fits that I’d say they’re not worried about auditing select statements, for example, but it’s just not the top thing on their to-do list when they wake up in the morning.

Finally, this article is accompanied by a picture of a new ThinkGeek item.  I didn’t want to do a separate blog entry about it, but it’s hilarious, and I like pictures in my blog entries.  So there ya go.