Overview & first run

This folder contains the runbooks for operators deploying and maintaining SQL Server Health Monitor. They assume you already have the installer / Docker image and just want to know how to do thing X without reading the source.

Diese Dokumentation gibt es auch auf Deutsch, im Ordner docs/de/. Both language sets are published as a website by tools/HelpSiteBuilder; use the language switch in its header.

Topic When you need it
Deployment First install on Windows, Linux, or Docker
Backup & restore Set up backups, restore after a host failure
Upgrade Apply a new version of the app
License Install or rotate the commercial license
SSO Configure OpenID Connect single sign-on (Entra ID, Okta, …)
Change tracking & licensing Extra grants for the change timeline; pricing the edition advisor
MSIX & Store Packaging the standalone NovaSQL Query Analyser for sideload or the Microsoft Store
Troubleshooting Common error patterns and what to do

First-run checklist

Before going live:

  1. HTTPS cert — by default a self-signed cert is generated. Replace with a CA-issued cert for production. See deployment.
  2. Encryption key — the application encrypts connection strings and notification secrets with a built-in key unless you set your own Encryption:Key. If you set one, back it up with the database: it is the only artifact that cannot be recreated. See backup-and-restore.
  3. Initial admin — first run redirects to /Account/Setup to create the admin account. Pick a strong password; rotate it; enable 2FA via /Account/Security.
  4. License file — drop license.lic next to the binary (or set the path in appsettings.json:Licensing:LicenseFilePath). See license.
  5. Notification channels — wire at least email under /Settings/Notifications so alerts actually reach humans.

Architecture in three sentences

ASP.NET Core 9 Razor Pages app + EF Core. The app has its own SQL Server database for metadata (server inventory, history, alerts, audit log) and connects out to the monitored SQL Server instances over normal TDS — no agent installed on the monitored boxes. Sensitive fields (connection strings and notification channel secrets) are encrypted at rest with AES-256-GCM under a fixed key, so the ciphertext survives updates, service-account changes and a move to another host.

Asking for help

When opening a support ticket, include:

  • Version (visible in the footer / /Settings/License)
  • Relevant log excerpt (the entry just before the failure plus any stack)
  • Output of /health/detailed
  • Whether the issue is reproducible and how