Agent Installation

Snare Enterprise Agent for MSSQL is available as a self-contained installation package, and includes a setup wizard and silent install options to allow for easy installation and configuration of all critical components. The installation package includes various support files and the core component SnareMSSQL.exe.

Organisations that wish to remotely deploy pre-configured Snare agents to workstations and servers, without physically moving from system to system, may appreciate the MSI (Microsoft Installer utility) functionality. The Snare Enterprise Agent supports being used as a single smart MSI for all Windows platforms and releases ensuring simplified and error free distribution. Refer to the documentation on the Intersect Alliance website, Snare for Windows Custom MSI.

Prerequisites

The Snare for MSSQL agent has the following requirements:

• For stand alone instances:

º Windows 2000/2003/XP/Vista/2008/Win(7,10)/2008(R2)/2012(R2),2016,2019 32 (where applicable) or 64 bit architecture

º Microsoft SQL Server 2000,2005,2008,2012,2014, 2016 and 2017 are supported for 32 bit (where applicable) 64 bit architecture

• For clustered instances: 

º Windows Server 2003/2008/2008(R2)/2012(R2),2016 and 2019, 32(where applicable) or 64 bit architecture arranged in a failover cluster

º Microsoft SQL Server 2005,2008,2012,2014,2016 and 2017 are supported, 32(where applicable) or 64 bit architecture in either a single or multiple instance deployment, including clustered (Active/Active and Active/Fail over) and stand alone instances.

• The drive where Snare for MSSQL agent is installed requires a minimum of 20MB of free space. Additional free space is required to operate the agent and collect trace files. See Total Trace Size for more information on audit policy space requirements.

Supported Browsers

Platform	Internet Explorer	Edge	Chrome	Firefox	Safari
Windows	Not Supported	For best results, use latest version	For best results, use latest version	For best results, use latest version	N/A
Linux	N/A	For best results, use latest version	For best results, use latest version	For best results, use latest version	N/A
MacOS	N/A	N/A	For best results, use latest version	For best results, use latest version	Accessing the user interface from Safari may result in some issues

Deployment Scenarios

Snare Enterprise Agent for MSSQL has two distinct deployment scenarios:

• Stand alone scenario

This scenario involves a single system running one or more instances of MS SQL Server. The installer will deploy a single service with the capability to monitor all available instances.

• Failover cluster scenario

This scenario involves two or more systems, operating as a Windows failover cluster, running one or more instances of MS SQL Server. The installer will deploy one service per instance, on every available node, and each service will have the capability to continue monitoring its assigned MS SQL instance in the event of a system failure (or any other event which causes the instance to change its operating node).

The installer need only be run on one node with sufficient privileges to distribute the agent to the remaining nodes, that is, administrator privileges on all cluster nodes. Each agent will be installed with its own unique administration port-number starting with 6163 and progressing to 6164,6165 etc. Each agent that is tied to a clustered SQL instance will follow that instance as part of an automatic failover or a manual migration. If you have standalone instances on the same server then the web management port will be the last port in the sequence from the install.

High availability and standalone instances on clusters

Microsoft introduced some new variations of clusters called High Availability instances that can run on Microsoft Clusters. For all intents and purposes these operate like a standalone machine and you will have one Snare MSSQL Agent per machine for these types of instances.

If at any point you install additional SQL clustered instances on the cluster you will need to perform a re installation of the Snare MSSQL agent to ensure that all instances are covered correctly and that each agent has the correct web management port assigned.

About Installer, Nodes, Clusters and Licenses

The Snare MSSQL Agent installer works out during installation:

• how many nodes are in the SQL cluster,
• if they are fail over clusters,
• if the fail over Instances are only on some nodes in a multi-node cluster
• if they are active/active always on clusters
• if a standalone instance is also on one or more of the clusters.

The agent operation in a fail over cluster setup will have the agent bound to a specific SQL Instance only on the applicable nodes of the cluster. So when the SQL cluster instance migrates from one node to another, the SQL agent will follow that SQL instance during any node migration as its bound to the Microsoft SQL Cluster setup during the install.

Where you have Active/Active SQL clusters then the agent operates like a standalone agent where one agent on that host can talk to all local SQL instances.  So for a mixed environment you may have one or more SQL agents installed and running on a host. Where there are standalone agents and fail over cluster agents bound to a specific SQL Instance only the active instances will be running on the applicable nodes.  Each agent will have its own registry settings for each instance on each node and use its own unique web management port which is determined at installation time, these ports can be adjusted via the audit policy in each agent independently after the install if needed.  When you make a change to an agent in a cluster setup it will replicate the configuration registry change to other nodes in the cluster.

Regarding licensing: The Snare MSSQL agent it is a license on a per machine basis so adding extra SQL instances on existing nodes will not require an extra license.  However, adding new SQL cluster server nodes will require extra Snare SQL licenses licenses. If you add a node to a cluster at any time or add another SQL instance then you will need to reinstall the SQL agent so it can propagate all the settings and correctly match each SQL Instance across all nodes.