Janis Griffin Senior DBA Geekin’ Out on Extended Events -Deconstructing the system_health event to solve SQL Server performance Janis Griffin Senior DBA

Who Am I Senior DBA for Confio Software Current – 25+ Years DBA JanisGriffin@confio.com @DoBoutAnything Current – 25+ Years DBA Primarily SQL Server, Sybase, Oracle Former – Database Design & Implementation Specialize in Performance Tuning Review Database Performance for Customers and Prospects Interest in System Health Events

Agenda Extended Events Overview System_Health - Event Session & Targets Viewing Info via SSMS Review what’s collected? All Event details SP_SERVER_DIAGNOSTICS How to query XML data type Examples & Usages Appendix – Error Descriptions / More Code

Extended Events Overview Lightweight event-handling mechanism Captures event information like SQL Profiler / SQL Trace More information plus you can now configure When events are triggered they can be sent to a target for further analysis Introduced in SQL Server 2008 Very complex to code and read (parse xml) Much Improved in 2012 with many more Events SSMS has Extended Event Interface Deprecation Announcement SQL Trace is No More won’t be in Versions > 2012 select instance_name, cntr_value from sys.dm_os_performance_counters where object_name like '%deprecate%' and instance_name like '%trace%'

System_Health Session Included by default with SQL Server 2012 Session starts when database engine starts No noticeable performance effects Collects system data to troubleshoot issues Uses the ring buffer & event file targets Microsoft recommends you leave it running If session dropped, recreate by script: u_tables.sql C:\Program Files\Microsoft SQL Server\MSSQL11.<instanceid>\MSSQL\Install

System_Health (SH) Targets Query to view the session data from different targets: SELECT CAST(xst.target_data as xml) target_session_data FROM sys.dm_xe_session_targets xst JOIN sys.dm_xe_sessions xs ON (xs.address = xst.event_session_address) WHERE xs.name = 'system_health' View data for specific targets in SSMS Extended Events UI Ring buffer info is in XML format

Viewing Info via SSMS View the ring_buffer data in xml format Select the ring_buffer target Data will appear in the xml editor Options to view event_file target, (.XEL file): Use File -> Open in SSMS. Drag and Drop the file into SSMS. Double click the .XEL file. Default location – SQL Server log directory In SSMS > Extended Events session > select ‘View Target Data’. fn_xe_file_target_read_file To view more than one .XEL file: Merge Extended Event Files from File -> Open menu.

Viewing SH via SSMS UI

Viewing SH via Function SELECT object_name,count(*) FROM sys.fn_xe_file_target_read_file ('C:\Program Files\Microsoft SQL Server\MSSQL11.SPEEDTY\MSSQL\Log\system_health*.xel',null,null,null) group by object_name

Merging SH Files

What’s Collected? System Data Collected: Sql_text & session_id for sessions that encounter: Memory-related errors -17803, 701, 802, 8645, 8651, 8657 and 8902 Or that have encountered errors with a severity >= 20 Non-yielding scheduler issues ( i.e. error 17883 in sql server log) Deadlocks Callstack, sql_text, & session_id for sessions waiting on: on resources for > 15 seconds. on locks for > 30 seconds. for a long time for preemptive waits Duration varies by wait type. Preemptive wait is when SQL Server is waiting for external API calls Callstack & session_id for CLR and virtual allocation failures System component results from sp_server_diagnostics System Health, Memory, Connectivity & Security errors using: Their respective ring buffers - e.g. connectivity_ring_buffer_recorded.

What’s Collected in detail? System_Health Session – Events

Detailed Events scheduler_monitor_system_health_ring_buffer_recorded wait_info What the heck is a ‘callstack’? Review Jonathan Kehayias’s reference: http://www.sqlskills.com/blogs/jonathan/an-xevent-a-day-24-of-31-what-is-the-callstack/ security_error_ring_buffer_recorded

Detailed Events “(cont.)” error_reported Only shows errors with severity >= 20 Consider changing for Development environments to check that code! memory_broker_ring_buffer_recorded Shows Memory allocations between various components

Detailed Events “(cont.)” connectivity_ring_buffer_recorded xml_deadlock_report

Even More Information sp_server_diagnostics_component_result Originally used for Cluster / Always On Functionality Great Info Regardless! Can be run manually sp_server_diagnostics 5 Interval has to be 5 seconds or more Captures diagnostic data & health information to detect potential failures. The procedure runs in repeat mode and sends results periodically. It can be invoked from either a regular or a DAC (dedicated admin) connection.

SP_SERVER_DIAGNOSTICS How to run the sp_server_diagnostics package Default is 0 – run once May want to set up as a job that continuously runs States: Unknown, clean, warning, error

SP_SERVER_DIAGNOSTICS SYSTEM Section <RingBufferTarget truncated="1" processingTime="98772" ... Etc… <event name="sp_server_diagnostics_component_result" package="sqlserver" timestamp="2013-10-25T02:41:47.499Z"> <data name="component"> <type name="sp_server_diagnostics_component" package="sqlserver"></type> <value>0</value> <text><![CDATA[SYSTEM]]></text> </data> <data name="state"> <type name="sp_server_diagnostics_state" package="sqlserver"></type> <value>1</value> <text><![CDATA[CLEAN]]></text> <data name="data"> <type name="xml" package="package0"></type> <value> <system spinlockBackoffs="0" sickSpinlockType="none" sickSpinlockTypeAfterAv="none" latchWarnings="0" isAccessViolationOccurred="0" writeAccessViolationCount="0" totalDumpRequests="0" intervalDumpRequests="0" nonYieldingTasksReported="0" pageFaults="158" systemCpuUtilization="18" sqlCpuUtilization="3" BadPagesDetected="0" BadPagesFixed="0" LastBadPageAddress="0x0" /> </value> </event>

System XML Query DECLARE @x XML = (select CAST(xet.target_data as xml) from sys.dm_xe_session_targets xet join sys.dm_xe_sessions xe on (xe.address = xet.event_session_address) where xe.name = 'system_health' and xet.target_name='ring_buffer') SELECT t.e.value('@name', 'varchar(50)') AS EventName ,t.e.value('@timestamp', 'datetime') AS DateAndTime ,t.e.value('(data/text)[1]','varchar(255)') as Component ,t.e.value('(data/value/system/@systemCpuUtilization)[1]','int') as [System CPU Utilizaton] ,t.e.value('(data/value/system/@sqlCpuUtilization)[1]','bigint') as [SQL Cpu Utilization] ,t.e.value('(data/value/system/@latchWarnings)[1]','bigint') as [Latch Warnings] ,t.e.value('(data/value/system/@isAccessViolationOccurred)[1]','bigint') as [Access Violations] ,t.e.value('(data/value/system/@nonYieldingTasksReported)[1]','bigint') as [Non Yields Reported] ,t.e.value('(data/value/system/@BadPagesDetected)[1]','bigint') as [Bad Pages Detected] ,t.e.value('(data/value/system/@BadPagesFixed)[1]','bigint') as [Bad Pages Fixed] FROM @x.nodes('//RingBufferTarget/event') AS t(e) WHERE t.e.value('@name', 'varchar(50)') = ’sp_server_diagnostics_component_result' AND t.e.value('(data/text)[1]','varchar(255)') = 'SYSTEM'

SP_SERVER_DIAGNOSTICS RESOURCE Section <text><![CDATA[CLEAN]]></text> <resource lastNotification="RESOURCE_MEMPHYSICAL_HIGH" outOfMemoryExceptions="0" isAnyPoolOutOfMemory="0" processOutOfMemoryPeriod="0"> <memoryReport name="Process/System Counts" unit="Value"> <entry description="Available Physical Memory" value="396804096" /> <entry description="Available Virtual Memory" value="8784766943232" /> <entry description="Available Paging File" value="811667456" /> <entry description="Working Set" value="310599680" /> <entry description="Percent of Committed Memory in WS" value="73" /> <entry description="Page Faults" value="12491970" /> <entry description="System physical memory high" value="1" /> <entry description="System physical memory low" value="0" /> <entry description="Process physical memory low" value="0" /> <entry description="Process virtual memory low" value="0" /> </memoryReport> <memoryReport name="Memory Manager" unit="KB"> <entry description="VM Reserved" value="10555800" /> <entry description="VM Committed" value="410592" /> <entry description="Locked Pages Allocated" value="0" /> <entry description="Large Pages Allocated" value="0" /> <entry description="Emergency Memory" value="1024" /> <entry description="Emergency Memory In Use" value="16" /> <entry description="Target Committed" value="606656" /> <entry description="Current Committed" value="410592" /> <entry description="Pages Allocated" value="207536" /> <entry description="Pages Reserved" value="1024" /> <entry description="Pages Free" value="125120" /> <entry description="Pages In Use" value="241216" /> <entry description="Page Alloc Potential" value="839616" /> <entry description="NUMA Growth Phase" value="0" /> <entry description="Last OOM Factor" value="0" /> <entry description="Last OS Error" value="0" /> </memoryReport> </resource>

Resource XML Query SELECT DECLARE @x XML = (select CAST(xet.target_data as xml) from sys.dm_xe_session_targets xet join sys.dm_xe_sessions xe on (xe.address = xet.event_session_address) where xe.name = 'system_health' and xet.target_name='ring_buffer') SELECT t.e.value('@name', 'varchar(50)') AS EventName ,t.e.value('@timestamp', 'datetime') AS DateAndTime ,t.e.value('(data/text)[1]','varchar(255)') as Component ,t.e.value('(data/value/resource/@lastNotification)[1]','varchar(255)') as [Last Notification] ,t.e.value('(data/value/resource/@outOfMemoryExceptions)[1]','bigint') as [OOM Exceptions] ,t.e.value('(data/value/resource/memoryReport/entry/@value)[1]','bigint')/(1024*1024*1024) as [AvaiilPhysical Mem(GB)] ,t.e.value('(data/value/resource/memoryReport/entry/@value)[3]','bigint')/(1024*1024*1024) as [Avail Paging File (GB)] ,t.e.value('(data/value/resource/memoryReport/entry/@value)[5]','int') as [Percent of Committed Memory in WS] ,t.e.value('(data/value/resource/memoryReport/entry/@value)[6]','bigint') as [Page Faults] ,t.e.value('(data/value/resource/memoryReport/entry/@value)[12]','bigint')/1024 as [VM Committed (MB)] ,t.e.value('(data/value/resource/memoryReport/entry/@value)[13]','bigint')/(1024*1024) as [Locked Pages Allocated (GB)] ,t.e.value('(data/value/resource/memoryReport/entry/@value)[14]','bigint')/(1024*1024) as [Large Pages Allocated (GB)] ,t.e.value('(data/value/resource/memoryReport/entry/@value)[17]','bigint')/(1024*1024) as [Target Committed (GB)] ,t.e.value('(data/value/resource/memoryReport/entry/@value)[18]','bigint')/(1024*1024) as [Current Committed (GB)] FROM @x.nodes('//RingBufferTarget/event') AS t(e) WHERE t.e.value('@name', 'varchar(50)') = 'sp_server_diagnostics_component_result' AND t.e.value('(data/text)[1]','varchar(255)') = 'RESOURCE'

SP_SERVER_DIAGNOSTICS Query Processing Section <queryProcessing maxWorkers="512" workersCreated="103" workersIdle="67" tasksCompletedWithinInterval="231" pendingTasks="0" oldestPendingTaskWaitingTime="0" hasUnresolvableDeadlockOccurred="0" hasDeadlockedSchedulersOccurred="0" trackingNonYieldingScheduler="0x0"> <topWaits> <nonPreemptive> <byCount> <wait waitType="PAGEIOLATCH_SH" waits="4455824" averageWaitTime="3504734" maxWaitTime="5691" /> <wait waitType="WRITELOG" waits="465276" averageWaitTime="761491" maxWaitTime="4446" /> <wait waitType="IO_COMPLETION" waits="453320" averageWaitTime="800811" maxWaitTime="3369" /> <wait waitType="LCK_M_S" waits="369871" averageWaitTime="1848682167" maxWaitTime="66855311" /> <wait waitType="PAGEIOLATCH_UP" waits="281647" averageWaitTime="107218" maxWaitTime="2779" /> <wait waitType="ASYNC_NETWORK_IO" waits="242675" averageWaitTime="582969" maxWaitTime="4392" /> <wait waitType="SLEEP_BPOOL_FLUSH" waits="204757" averageWaitTime="102009" maxWaitTime="809" /> <wait waitType="HADR_FILESTREAM_IOMGR_IOCOMPLETION" waits="68978" averageWaitTime="102164567" maxWaitTime="66855421" /> <wait waitType="PAGEIOLATCH_EX" waits="68281" averageWaitTime="128510" maxWaitTime="2751" /> <wait waitType="FFT_RECOVERY" waits="45976" averageWaitTime="883294" maxWaitTime="16094" /> </byCount> <byDuration> <wait waitType="CLR_AUTO_EVENT" waits="324" averageWaitTime="201773368" maxWaitTime="74380786" /> <wait waitType="FT_IFTSHC_MUTEX" waits="10637" averageWaitTime="128290690" maxWaitTime="74285676" /> <wait waitType="LCK_M_SCH_S" waits="198" averageWaitTime="62597038" maxWaitTime="1212453" /> <wait waitType="LCK_M_U" waits="29596" averageWaitTime="8643926" maxWaitTime="45376" /> <wait waitType="XE_LIVE_TARGET_TVF" waits="2050" averageWaitTime="6992196" maxWaitTime="14034" /> <wait waitType="LCK_M_IS" waits="33" averageWaitTime="1155178" maxWaitTime="659798" /> </byDuration> </nonPreemptive>

SP_SERVER_DIAGNOSTICS Query Processing Section – “cont.” <preemptive> <byCount> <wait waitType="PREEMPTIVE_OS_GENERICOPS" waits="811791" averageWaitTime="106905" maxWaitTime="1349" /> <wait waitType="PREEMPTIVE_OS_FILEOPS" waits="432272" averageWaitTime="596381" maxWaitTime="15461" /> <wait waitType="PREEMPTIVE_XE_CALLBACKEXECUTE" waits="398977" averageWaitTime="1082" maxWaitTime="12" /> <wait waitType="PREEMPTIVE_OS_CREATEFILE" waits="373487" averageWaitTime="221855" maxWaitTime="15461" /> <wait waitType="PREEMPTIVE_OS_WAITFORSINGLEOBJECT" waits="239927" averageWaitTime="575229" maxWaitTime="4392" /> <wait waitType="PREEMPTIVE_OS_GETFILEATTRIBUTES" waits="229899" averageWaitTime="55036" maxWaitTime="1998" /> <wait waitType="PREEMPTIVE_FILESIZEGET" waits="183914" averageWaitTime="15479" maxWaitTime="46" /> <wait waitType="PREEMPTIVE_OS_AUTHORIZATIONOPS" waits="96115" averageWaitTime="998" maxWaitTime="62" /> <wait waitType="PREEMPTIVE_OS_FLUSHFILEBUFFERS" waits="91945" averageWaitTime="114737" maxWaitTime="5071" /> <wait waitType="PREEMPTIVE_OS_REPORTEVENT" waits="47370" averageWaitTime="66892718" maxWaitTime="66855014" /> </byCount> <byDuration> <wait waitType="PREEMPTIVE_XE_DISPATCHER" waits="6" averageWaitTime="94378021" maxWaitTime="75867655" /> <wait waitType="PREEMPTIVE_XE_GETTARGETSTATE" waits="10015" averageWaitTime="732191" maxWaitTime="1531" /> <wait waitType="PREEMPTIVE_OS_WRITEFILE" waits="2368" averageWaitTime="225333" maxWaitTime="4521" /> </byDuration> </preemptive>

Query Processing XML Query DECLARE @x XML = (select CAST(xet.target_data as xml) from sys.dm_xe_session_targets xet join sys.dm_xe_sessions xe on (xe.address = xet.event_session_address) where xe.name = 'system_health' and xet.target_name='ring_buffer') SELECT t.e.value('@name', 'varchar(50)') AS EventName ,t.e.value('@timestamp', 'datetime') AS DateAndTime ,t.e.value('(data/text)[1]','varchar(255)') as Component ,t.e.value('(data/value/queryProcessing/@maxWorkers)[1]','bigint') as [Max Workers] ,t.e.value('(data/value/queryProcessing/@workersCreated)[1]','bigint') as [Workers Created] ,t.e.value('(data/value/queryProcessing/@workersIdle)[1]','bigint') as [Idle Workers] ,t.e.value('(data/value/queryProcessing/@pendingTasks)[1]','bigint') as [Pending Tasks] ,t.e.value('(data/value/queryProcessing/@hasUnresolvableDeadlockOccurred)[1]','int') as [Unresolvable Deadlock] ,t.e.value('(data/value/queryProcessing/@hasDeadlockedSchedulersOccurred)[1]','int') as [Deadlocked Schedulers] FROM @x.nodes('//RingBufferTarget/event') AS t(e) WHERE t.e.value('@name', 'varchar(50)') = 'sp_server_diagnostics_component_result' AND t.e.value('(data/text)[1]','varchar(255)') = 'QUERY_PROCESSING'

SP_SERVER_DIAGNOSTICS IO_SUBSYSTEM Section <event name="sp_server_diagnostics_component_result" package="sqlserver" timestamp=“snipped” <data name="component"> <type name="sp_server_diagnostics_component" package="sqlserver"></type> <value>3</value> <text><![CDATA[IO_SUBSYSTEM]]></text> </data> <data name="state"> <type name="sp_server_diagnostics_state" package="sqlserver"></type> <value>1</value> <text><![CDATA[CLEAN]]></text> <data name="data"> <type name="xml" package="package0"></type> <value> <ioSubsystem ioLatchTimeouts="0" intervalLongIos="0" totalLongIos="0"> <longestPendingRequests></longestPendingRequests> </ioSubsystem> </value> </event>

IO_Subsystem XML DECLARE @x XML = (select CAST(xet.target_data as xml) from sys.dm_xe_session_targets xet join sys.dm_xe_sessions xe on (xe.address = xet.event_session_address) where xe.name = 'system_health' and xet.target_name='ring_buffer') SELECT t.e.value('@name', 'varchar(50)') AS EventName ,t.e.value('@timestamp', 'datetime') AS DateAndTime ,t.e.value('(data/text)[1]','varchar(255)') as Component ,t.e.value('(data/value/ioSubsystem/@ioLatchTimeouts)[1]','int') as [ioLatchTimeout] ,t.e.value('(data/value/ioSubsystem/@intervalLongIos)[1]','int') as [intervalLongIos] ,t.e.value('(data/value/ioSubsystem/@totalLongIos)[1]','int') as [totalLongIos] ,t.e.value('(data/value/ioSubsystem/@longestPendingRequests)[1]','int') as [longestPendingRequests] FROM @x.nodes('//RingBufferTarget/event') AS t(e) WHERE t.e.value('@name', 'varchar(50)') = 'sp_server_diagnostics_component_result' AND t.e.value('(data/text)[1]','varchar(255)') = 'IO_SUBSYSTEM'

XML Queries System Resource Query Processing IO Subsystem

Cool ‘free’ view Check out Extended Events ‘system health’ Dashboards for SQL Server 2012 http://blogs.msdn.com/b/sql_pfe_blog/archive/2013/04/15/sql-2012-system-health-reporting-dashboard-visualizing-sp-server-diagnostics-results.aspx

Add SH metrics to Ignite

Add SH metrics to Ignite

Alerts in Ignite

Alerts in Ignite Historical view of all alerts for 1 year

How to Alert in Ignite

XE Wait types in Ignite XE_LIVE_TARGET_TVF – Watch Live Data XE_BUFFERMGR_ALLPROCESSED_EVENT -Happens when Extended Events session buffers are flushed to targets. This wait Happens on a background thread.

Summary System_health session - use to trouble shoot issues Can view easily in SSMS or query XML to alert & record history over time. Show security & connectivity errors, system health & memory broker info Deadlocks & many errors are captured Consider changing error severity levels for deve/test instances Consider changing file target size to capture more history Can set up sp_server diagnostics for more info Remember Trace has been deprecated Sql Server Profile for Trace Capture Replaces Sql Trace Stored procedures, functions and catalog views

About Confio Wait-Based Performance Tools Ignite8 / IgniteVM Ignite for SQL Server, Oracle, DB2, Sybase Helps show which SQL to tune Based in Colorado, worldwide customers Free trial at www.confio.com http://www.ignitefree.com – Free Current View

Q & A APPENDIX

Errors Collected Memory-related errors 17803, 701, 802, 8645, 8651, 8657 and 8902 Non-yielding scheduler issues - error 17883

Errors Collected Memory-related errors – “Cont.” 17803, 701, 802, 8645, 8651, 8657 and 8902 Non-yielding scheduler issues - error 17883

System Health Severity Levels Severity level 10 messages are informational  indicate problems caused by mistakes in the information you have entered. Severity levels from 11 through 16 are generated by the user can be corrected by the user. Severity levels from 17 through 25 indicate software or hardware errors. when a level 17, 18, or 19 error occurs, you can continue working might not be able to execute a particular statement. Severity levels from 20 through 25 indicate system problems. fatal errors, which means that the process is no longer running. process freezes before it stops client connection closes, and the client might not be able to reconnect. Severity Level 20: SQL Server Fatal Error in Current Process Severity Level 21: SQL Server Fatal Error in Database (dbid) Processes Severity Level 22: SQL Server Fatal Error Table Integrity Suspect Severity Level 23: SQL Server Fatal Error: Database Integrity Suspect Severity Level 24: Hardware Error Severity Level 25: Some type of system error

Scheduler_monitor Query DECLARE @x XML = (select CAST(xet.target_data as xml) from sys.dm_xe_session_targets xet join sys.dm_xe_sessions xe on (xe.address = xet.event_session_address) where xe.name = 'system_health' and xet.target_name='ring_buffer') SELECT t.e.value('@name', 'varchar(50)') AS EventName ,t.e.value('@timestamp', 'datetime') AS DateAndTime ,t.e.value('(data[@name="process_utilization"]/value)[1]', 'int') AS process_utilization ,t.e.value('(data[@name="system_idle"]/value)[1]', 'int') as system_idle ,t.e.value('(data[@name="page_faults"]/value)[1]', 'float') as page_faults ,t.e.value('(data[@name="working_set_delta"]/value)[1]', 'float') as working_set_delta ,t.e.value('(data[@name="memory_utilization"]/value)[1]', 'int') as memory_utilization FROM @x.nodes('//RingBufferTarget/event') AS t(e) WHERE t.e.value('@name', 'varchar(50)') = 'scheduler_monitor_system_health_ring_buffer_record'

Wait_info Query DECLARE @x XML = (select CAST(xet.target_data as xml) from sys.dm_xe_session_targets xet join sys.dm_xe_sessions xe on (xe.address = xet.event_session_address) where xe.name = 'system_health' and xet.target_name='ring_buffer') SELECT t.e.value('@name', 'varchar(50)') AS EventName ,t.e.value('@timestamp', 'datetime') AS DateAndTime ,t.e.value('(data[@name="duration"]/value)[1]', 'int') AS Duration ,t.e.value('(action[@name="session_id"]/value)[1]','int') AS Session_id ,t.e.value('(data[@name="wait_type"]/text)[1]', 'varchar(max)') AS wait_type ,t.e.value('(data[@name="wait_type"]/value)[1]', 'varchar(max)') AS wait_type_no ,t.e.value('(data[@name="message"]/value)[1]', 'varchar(max)') AS ErrMsg ,t.e.value('(action[@name="sql_text"]/value)[1]', 'varchar(max)') AS sql_text FROM @x.nodes('//RingBufferTarget/event') AS t(e) WHERE t.e.value('@name', 'varchar(50)') = 'wait_info' ORDER BY Duration desc

Error_reported Query DECLARE @x XML = (select CAST(xet.target_data as xml) from sys.dm_xe_session_targets xet join sys.dm_xe_sessions xe on (xe.address = xet.event_session_address) where xe.name = 'system_health' and xet.target_name='ring_buffer') SELECT t.e.value('@name', 'varchar(50)') AS EventName ,t.e.value('@timestamp', 'datetime') AS DateAndTime ,t.e.value('(data[@name="error"]/value)[1]', 'int') AS ErrNo ,t.e.value('(data[@name="severity"]/value)[1]', 'int') AS Severity ,t.e.value('(data[@name="message"]/value)[1]', 'varchar(max)') AS ErrMsg ,t.e.value('(action[@name="sql_text"]/value)[1]', 'varchar(max)') AS sql_text FROM @x.nodes('//RingBufferTarget/event') AS t(e) WHERE t.e.value('@name', 'varchar(50)') = 'error_reported' '

Security Error Query DECLARE @x XML = (select CAST(xet.target_data as xml) from sys.dm_xe_session_targets xet join sys.dm_xe_sessions xe on (xe.address = xet.event_session_address) where xe.name = 'system_health' and xet.target_name='ring_buffer') select t.e.value('@name', 'varchar(50)') AS EventName ,t.e.value('@timestamp', 'datetime') AS DateAndTime ,t.e.value('(data[@name="calling_api_name"]/value)[1]', 'varchar(max)') AS calling_api_name ,t.e.value('(data[@name="error_code"]/value)[1]', 'int') AS error_code ,t.e.value('(data[@name="session_id"]/value)[1]', 'int') AS session_i FROM @x.nodes('//RingBufferTarget/event') AS t(e) WHERE t.e.value('@name', 'varchar(50)') = 'security_error_ring_buffer_recorded'

Connectivity Error Query DECLARE @x XML = (select CAST(xet.target_data as xml) from sys.dm_xe_session_targets xet join sys.dm_xe_sessions xe on (xe.address = xet.event_session_address) where xe.name = 'system_health' and xet.target_name='ring_buffer') select t.e.value('@name', 'varchar(50)') AS EventName ,t.e.value('@timestamp', 'datetime') AS DateAndTime ,t.e.value('(data[@name="type"]/text)[1]', 'varchar(max)') AS type ,t.e.value('(data[@name="tds_flags"]/text)[1]', 'varchar(max)') AS tds_flags ,t.e.value('(data[@name="session_id"]/value)[1]', 'int') AS session_id ,t.e.value('(data[@name="source"]/type)[1]', 'varchar(max)') AS source_type ,t.e.value('(data[@name="source"]/text)[1]', 'varchar(max)') AS source_text ,t.e.value('(data[@name="local_host"]/value)[1]', 'varchar(max)') AS local_host ,t.e.value('(data[@name="remote_host"]/value)[1]', 'varchar(max)') AS remote_host ,t.e.value('(data[@name="tds_input_buffer_bytes"]/value)[1]', 'int') AS tds_input_buffer_bytes FROM @x.nodes('//RingBufferTarget/event') AS t(e) WHERE t.e.value('@name', 'varchar(50)') = 'connectivity_ring_buffer_recorded'

Xml_dead_lock Query DECLARE @XMLData xml SELECT TOP 1 @XMLData = CAST(target_data AS xml) FROM sys.dm_xe_session_targets xst JOIN sys.dm_xe_sessions xs ON xs.address = xst.event_session_address WHERE xs.name = 'system_health' and xst.target_name = 'ring_buffer' SELECT COUNT(1) AS cnt @XMLData.nodes('//event[@name="xml_deadlock_report"]') AS X (Col)