• /
  • EnglishEspañolFrançais日本語한국어Português
  • EntrarComeçar agora

Windows self-hosted MSSQL monitoring with NRDOT

Preview

We're still working on this feature, but we'd love for you to try it out!

This feature is currently provided as part of a preview pursuant to our pre-release policies.

Set up Microsoft SQL Server monitoring using the NRDOT collector on Windows self-hosted environments including physical servers, virtual machines, and standalone Windows installations.

Based on your SQL Server security configuration, you can choose from three authentication methods to connect the NRDOT Collector to your SQL Server instance:

Prerequisites

Ensure your environment meets our compatibility and prerequisites.

Setup the NRDOT Collector

Install the NRDOT Collector on your Windows system.

  1. Download and install the NRDOT Collector using PowerShell:

    [Net.ServicePointManager]::SecurityProtocol = 'tls12, tls'; $NRDOT_VERSION = (Invoke-RestMethod -Uri "https://api.github.com/repos/newrelic/nrdot-collector-releases/releases/latest").tag_name; $WebClient = New-Object System.Net.WebClient; $WebClient.Headers.Add("User-Agent", "Mozilla/5.0"); $WebClient.DownloadFile("https://github.com/newrelic/nrdot-collector-releases/releases/download/$NRDOT_VERSION/nrdot-collector_${NRDOT_VERSION}_windows_x64.msi", "$env:TEMP\nrdot-collector.msi"); Start-Process msiexec.exe -ArgumentList "/i `"$env:TEMP\nrdot-collector.msi`" /qn /norestart /L*V `"$env:TEMP\nrdot_install.log`"" -Wait; Get-Service nrdot-collector -ErrorAction SilentlyContinue

Configure database user

Run the following script as a root user/sysadmin to create the newrelic monitoring user and grant global read permissions.

To create a newrelic monitoring user, run the following script using SQL Server Management Studio (SSMS):

USE [master];
GO
CREATE LOGIN [newrelic] WITH PASSWORD = '<PASSWORD>';
GO


GRANT VIEW SERVER STATE TO [newrelic];
GRANT VIEW ANY DEFINITION TO [newrelic];
GRANT VIEW ANY DATABASE TO [newrelic];
GO


DECLARE @name SYSNAME;
DECLARE db_cursor CURSOR READ_ONLY FORWARD_ONLY FOR
SELECT [name]
FROM [master].[sys].[databases]
WHERE [name] NOT IN ('master', 'msdb', 'model', 'rdsadmin', 'distribution')
AND [state] = 0;
OPEN db_cursor;
FETCH NEXT FROM db_cursor INTO @name;
WHILE @@FETCH_STATUS = 0
BEGIN
  BEGIN TRY
    EXEC('USE [' + @name + '];
    IF NOT EXISTS (SELECT 1 FROM sys.database_principals WHERE name = ''newrelic'')
    BEGIN
      CREATE USER [newrelic] FOR LOGIN [newrelic];
    END;
    GRANT VIEW DATABASE STATE TO [newrelic];');
  END TRY
  BEGIN CATCH
    PRINT 'Error on ' + @name + ': ' + ERROR_MESSAGE();
  END CATCH
  FETCH NEXT FROM db_cursor INTO @name;
END
CLOSE db_cursor;
DEALLOCATE db_cursor;
GO

Configure NRDOT Collector

Select your configuration type based on your monitoring needs:

Configuration parameters

The following table describes the key configuration parameters for the nrsqlserver receiver:

Parameter

Description

Username

Enter your database username for authentication

Password

Enter your database password for authentication

Server

Enter your SQL Server hostname or IP address

Port

Enter your SQL Server port number. The default value is 1433.

OTLP Endpoint

Enter the New Relic OTLP endpoint (e.g., https://otlp.nr-data.net). For more information, refer to New Relic OTLP endpoints documentation.

License Key

Enter your New Relic license key.

collection_interval

Interval in seconds to collect database metrics. Default: 15s

Dica

Note: If you enable all available metrics, increase the limit_mib value (e.g., 1000) to prevent the memory limiter from dropping data.

Dica

Note: The max_concurrent_queries option controls how many metric queries the receiver executes in parallel against SQL Server during each scrape cycle.

receivers:
  nrsqlserver:
    max_concurrent_queries: 4  # default is 4 if omitted or set to 0

Update Windows Service Registry

Update the Windows Service Registry to use the new mssql-config.yaml file.

Method 1: PowerShell

Run the following command in PowerShell as Administrator:

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\nrdot-collector" -Name "ImagePath" -Value '"C:\Program Files\nrdot-collector\nrdot-collector.exe" --config "C:\Program Files\nrdot-collector\mssql-config.yaml"'

Method 2: Command Prompt (Alternative)

If PowerShell is not available, you can use Command Prompt instead:

  1. Open your Start Menu, type cmd
  2. Right-click Command Prompt and choose Run as administrator
  3. Copy and paste this exact command into the black CMD window and hit Enter:
sc config "nrdot-collector" binPath= "\"C:\Program Files\nrdot-collector\nrdot-collector.exe\" --config \"C:\Program Files\nrdot-collector\mssql-config.yaml\""

Validate NRDOT Collector Configuration

Validate the NRDOT Collector configuration to ensure it's correctly formatted and will work properly.

& "C:\Program Files\nrdot-collector\nrdot-collector.exe" validate --config="C:\Program Files\nrdot-collector\mssql-config.yaml"

Restart NRDOT collector

After updating your configuration, restart the NRDOT Collector service:

bash
$
net stop nrdot-collector
$
net start nrdot-collector

Dica

Always restart the NRDOT collector service after making configuration changes to ensure the new settings take effect.

(Optional) Set up APM-database correlation

To correlate your application performance with database operations, you can set up database service identification. This feature allows you to see exactly which applications are generating specific database workloads. For more information, refer to set up database service identification to get APM-database correlation in New Relic.

Importante

To view database performance data in APM, both entities must be in the same New Relic account. If the entities are in different New Relic accounts, you must have access to both accounts to view the data.

(Optional) Configure secret management

The secret management feature allows you to securely manage sensitive information, such as database credentials. This helps to enhance the security of your monitoring setup by avoiding hardcoding sensitive data in configuration files. For more information, refer to secret management.

Find and use your data

Once your data is being collected, you can access comprehensive SQL Server database monitoring through New Relic's UI.

To find your SQL Server database entity in New Relic:

  1. Go to https://one.newrelic.com > All Capabilities > Databases.
  2. From the Entity type dropdown, select MSSQL instance, then click Apply.
  3. Select your SQL Server database from the list of entities.

Prerequisites

Ensure your environment meets our compatibility and prerequisites.

Additional requirements for Windows Authentication:

  • Windows domain environment with Active Directory
  • SQL Server configured to accept Windows Authentication
  • Domain user account with appropriate SQL Server permissions
  • NRDOT Collector service running under domain account context

Setup the NRDOT Collector

Install the NRDOT Collector on your Windows system.

  1. Download and install the NRDOT Collector using PowerShell:

    [Net.ServicePointManager]::SecurityProtocol = 'tls12, tls'; $NRDOT_VERSION = (Invoke-RestMethod -Uri "https://api.github.com/repos/newrelic/nrdot-collector-releases/releases/latest").tag_name; $WebClient = New-Object System.Net.WebClient; $WebClient.Headers.Add("User-Agent", "Mozilla/5.0"); $WebClient.DownloadFile("https://github.com/newrelic/nrdot-collector-releases/releases/download/$NRDOT_VERSION/nrdot-collector_${NRDOT_VERSION}_windows_x64.msi", "$env:TEMP\nrdot-collector.msi"); Start-Process msiexec.exe -ArgumentList "/i `"$env:TEMP\nrdot-collector.msi`" /qn /norestart /L*V `"$env:TEMP\nrdot_install.log`"" -Wait; Get-Service nrdot-collector -ErrorAction SilentlyContinue

Verify Windows Authentication Setup

Ensure your SQL Server is configured for Windows Authentication and verify connectivity.

  1. Verify the Windows username:

    SELECT SYSTEM_USER;

  2. Run the below command to verify necessary permissions are granted (update <account_name> with the username from step 1):

    DECLARE @TargetUser SYSNAME = '<account_name>'; -- <-- Set your Windows user here
    

    -- 1. Create the checklist of required permissions from your script
    DECLARE @Checklist TABLE (Scope NVARCHAR(50), [Database] SYSNAME, [Permission] NVARCHAR(128));
    

    INSERT INTO @Checklist VALUES
    ('Server', 'ALL', 'VIEW SERVER STATE'),
    ('Server', 'ALL', 'VIEW ANY DEFINITION'),
    ('Server', 'ALL', 'VIEW ANY DATABASE');
    

    INSERT INTO @Checklist
    SELECT 'Database Role', [name], 'db_datareader' FROM sys.databases WHERE [name] NOT IN ('master', 'msdb', 'model', 'rdsadmin', 'distribution') AND [state] = 0
    UNION ALL
    SELECT 'Database Explicit', [name], 'VIEW DATABASE STATE' FROM sys.databases WHERE [name] NOT IN ('master', 'msdb', 'model', 'rdsadmin', 'distribution') AND [state] = 0
    UNION ALL
    SELECT 'Database Explicit', [name], 'VIEW DEFINITION' FROM sys.databases WHERE [name] NOT IN ('master', 'msdb', 'model', 'rdsadmin', 'distribution') AND [state] = 0;
    

    -- 2. Gather existing explicit permissions
    WITH ExplicitPerms AS (
        SELECT 'Server' AS Scope, CAST('ALL' AS NVARCHAR(128)) COLLATE DATABASE_DEFAULT AS [Database], p.permission_name COLLATE DATABASE_DEFAULT AS [Permission]
        FROM sys.server_permissions p JOIN sys.server_principals l ON p.grantee_principal_id = l.principal_id WHERE l.name = @TargetUser
        UNION ALL
        SELECT 'Database Role', d.name COLLATE DATABASE_DEFAULT, r.name COLLATE DATABASE_DEFAULT
        FROM sys.databases d CROSS APPLY (SELECT dp_role.name FROM sys.database_role_members drm JOIN sys.database_principals dp_role ON drm.role_principal_id = dp_role.principal_id JOIN sys.database_principals dp_user ON drm.member_principal_id = dp_user.principal_id JOIN sys.server_principals sp ON dp_user.sid = sp.sid WHERE sp.name = @TargetUser) r WHERE d.state = 0
        UNION ALL
        SELECT 'Database Explicit', d.name COLLATE DATABASE_DEFAULT, p.permission_name COLLATE DATABASE_DEFAULT
        FROM sys.databases d CROSS APPLY (SELECT db_p.permission_name FROM sys.database_permissions db_p JOIN sys.database_principals dp_user ON db_p.grantee_principal_id = dp_user.principal_id JOIN sys.server_principals sp ON dp_user.sid = sp.sid WHERE sp.name = @TargetUser) p WHERE d.state = 0
    )
    -- 3. Output the exact verification matrix
    SELECT
        chk.Scope,
        chk.[Database],
        chk.[Permission] AS [Required Permission],
        CASE
            WHEN exp.[Permission] IS NOT NULL THEN 'GRANTED'
            WHEN IS_SRVROLEMEMBER('sysadmin', @TargetUser) = 1 THEN 'PASSED (via SysAdmin Role)'
            ELSE 'MISSING'
        END AS [Verification Status]
    FROM @Checklist chk
    LEFT JOIN ExplicitPerms exp ON chk.Scope = exp.Scope AND chk.[Database] = exp.[Database] AND chk.[Permission] = exp.[Permission]
    ORDER BY chk.Scope, chk.[Database], chk.[Permission];

  3. If you don't have the necessary permissions, run the following grants (replace <account_name> with your Windows account):

    USE [master];
    GO
    

    -- 1. Grant Instance-level permissions to your Windows Account
    GRANT VIEW SERVER STATE TO [<account_name>];
    GRANT VIEW ANY DEFINITION TO [<account_name>];
    GRANT VIEW ANY DATABASE TO [<account_name>];
    GO
    

    -- 2. Loop through all user databases and grant read/visibility permissions
    DECLARE @name SYSNAME;
    DECLARE @sql NVARCHAR(MAX);
    

    DECLARE db_cursor CURSOR READ_ONLY FORWARD_ONLY FOR
    SELECT [name]
    FROM [master].[sys].[databases]
    WHERE [name] NOT IN ('master', 'msdb', 'model', 'rdsadmin', 'distribution')
      AND [state] = 0; -- Only online databases
    

    OPEN db_cursor;
    FETCH NEXT FROM db_cursor INTO @name;
    

    WHILE @@FETCH_STATUS = 0
    BEGIN
        BEGIN TRY
            PRINT 'Granting permissions on database: ' + @name;
    

            -- Create the database user mapping if it doesn't exist, then grant roles
            SET @sql = '
                USE [' + @name + '];
                IF NOT EXISTS (SELECT 1 FROM sys.database_principals WHERE name = ''<account_name>'')
                BEGIN
                    CREATE USER [<account_name>] FOR LOGIN [<account_name>];
                END;
                GRANT VIEW DATABASE STATE TO [<account_name>];
                GRANT VIEW DEFINITION TO [<account_name>];
                ALTER ROLE db_datareader ADD MEMBER [<account_name>];';
    

            EXEC sp_executesql @sql;
            PRINT 'Success: ' + @name;
        END TRY
        BEGIN CATCH
            PRINT 'Error on ' + @name + ': ' + ERROR_MESSAGE();
        END CATCH
    

        FETCH NEXT FROM db_cursor INTO @name;
    END
    

    CLOSE db_cursor;
    DEALLOCATE db_cursor;
    GO

Importante

Important Notes:

  • Replace all instances of <account_name> with your actual Windows account name (e.g., ComputerName\Username)
  • Run these scripts using SQL Server Management Studio (SSMS) or sqlcmd utility
  • The verification script will show you exactly which permissions are missing

Configure NRDOT Collector

Choose your monitoring configuration based on your needs:

Dica

Note: If you enable all available metrics, increase the limit_mib value (e.g., 1000) to prevent the memory limiter from dropping data.

Dica

Note: The max_concurrent_queries option controls how many metric queries the receiver executes in parallel against SQL Server during each scrape cycle.

receivers:
  nrsqlserver:
    max_concurrent_queries: 4  # default is 4 if omitted or set to 0

Update Windows Service Registry

Update the Windows Service Registry to use the new mssql-config.yaml file.

Method 1: PowerShell

Run the following command in PowerShell as Administrator:

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\nrdot-collector" -Name "ImagePath" -Value '"C:\Program Files\nrdot-collector\nrdot-collector.exe" --config "C:\Program Files\nrdot-collector\mssql-config.yaml"'

Method 2: Command Prompt (Alternative)

If PowerShell is not available, you can use Command Prompt instead:

  1. Open your Start Menu, type cmd
  2. Right-click Command Prompt and choose Run as administrator
  3. Copy and paste this exact command into the black CMD window and hit Enter:
sc config "nrdot-collector" binPath= "\"C:\Program Files\nrdot-collector\nrdot-collector.exe\" --config \"C:\Program Files\nrdot-collector\mssql-config.yaml\""

Validate NRDOT Collector Configuration

Validate the NRDOT Collector configuration to ensure it's correctly formatted and will work properly.

& "C:\Program Files\nrdot-collector\nrdot-collector.exe" validate --config="C:\Program Files\nrdot-collector\mssql-config.yaml"

Restart NRDOT collector

After updating your configuration, restart the NRDOT Collector service:

bash
$
net stop nrdot-collector
$
net start nrdot-collector

Dica

Always restart the NRDOT collector service after making configuration changes to ensure the new settings take effect.

(Optional) Set up APM-database correlation

To correlate your application performance with database operations, you can set up database service identification. This feature allows you to see exactly which applications are generating specific database workloads. For more information, refer to set up database service identification to get APM-database correlation in New Relic.

Importante

To view database performance data in APM, both entities must be in the same New Relic account. If the entities are in different New Relic accounts, you must have access to both accounts to view the data.

(Optional) Configure secret management

The secret management feature allows you to securely manage sensitive information, such as database credentials. This helps to enhance the security of your monitoring setup by avoiding hardcoding sensitive data in configuration files. For more information, refer to secret management.

Find and use your data

Once your data is being collected, you can access comprehensive SQL Server database monitoring through New Relic's UI.

To find your SQL Server database entity in New Relic:

  1. Go to https://one.newrelic.com > All Capabilities > Databases.
  2. From the Entity type dropdown, select MSSQL instance, then click Apply.
  3. Select your SQL Server database from the list of entities.

Prerequisites

Ensure your environment meets our compatibility and prerequisites.

Additional requirements for gMSA (Group Managed Service Account):

  • Active Directory environment with gMSA support
  • gMSA account created and configured for SQL Server access
  • Windows host must be domain-joined and authorized to use the gMSA account

Setup the NRDOT Collector

Install the NRDOT Collector on your Windows system.

  1. Download and install the NRDOT Collector using PowerShell:

    [Net.ServicePointManager]::SecurityProtocol = 'tls12, tls'; $NRDOT_VERSION = (Invoke-RestMethod -Uri "https://api.github.com/repos/newrelic/nrdot-collector-releases/releases/latest").tag_name; $WebClient = New-Object System.Net.WebClient; $WebClient.Headers.Add("User-Agent", "Mozilla/5.0"); $WebClient.DownloadFile("https://github.com/newrelic/nrdot-collector-releases/releases/download/$NRDOT_VERSION/nrdot-collector_${NRDOT_VERSION}_windows_x64.msi", "$env:TEMP\nrdot-collector.msi"); Start-Process msiexec.exe -ArgumentList "/i `"$env:TEMP\nrdot-collector.msi`" /qn /norestart /L*V `"$env:TEMP\nrdot_install.log`"" -Wait; Get-Service nrdot-collector -ErrorAction SilentlyContinue

Enable your Microsoft SQL Server

Open SSMS, log in via Windows Authentication, open a New Query, and execute the following database administration script:

USE master;
GO


-- Provision an engine login identity for the gMSA
CREATE LOGIN [<DOMAIN>\<gMSA_NAME>$] FROM WINDOWS;
GO


-- Grant monitoring permissions
GRANT VIEW SERVER STATE TO [<DOMAIN>\<gMSA_NAME>$];
GRANT VIEW ANY DEFINITION TO [<DOMAIN>\<gMSA_NAME>$];
GRANT VIEW ANY DATABASE TO [<DOMAIN>\<gMSA_NAME>$];
GO


-- Grant access to all databases (required for query monitoring and tempdb metrics)
DECLARE @name SYSNAME;
DECLARE db_cursor CURSOR READ_ONLY FORWARD_ONLY FOR
SELECT [name] FROM [master].[sys].[databases]
WHERE [name] NOT IN ('master','msdb','model','rdsadmin','distribution')
AND [state] = 0;
OPEN db_cursor;
FETCH NEXT FROM db_cursor INTO @name;
WHILE @@FETCH_STATUS = 0
BEGIN
  BEGIN TRY
    EXEC('USE [' + @name + '];
    IF NOT EXISTS (SELECT 1 FROM sys.database_principals WHERE name = ''<DOMAIN>\<gMSA_NAME>$'')
    BEGIN
      CREATE USER [<DOMAIN>\<gMSA_NAME>$] FOR LOGIN [<DOMAIN>\<gMSA_NAME>$];
    END;
    GRANT VIEW DATABASE STATE TO [<DOMAIN>\<gMSA_NAME>$];');
  END TRY
  BEGIN CATCH
    PRINT 'Error on ' + @name + ': ' + ERROR_MESSAGE();
  END CATCH
  FETCH NEXT FROM db_cursor INTO @name;
END
CLOSE db_cursor;
DEALLOCATE db_cursor;
GO

Importante

Replace [<DOMAIN>\<gMSA_NAME>$] with your actual gMSA account name. The $ at the end is required for gMSA accounts.

Configure NRDOT Collector Service to Run as gMSA

After installing the NRDOT Collector, configure the service to run as your gMSA account using PowerShell:

# Stop the NRDOT Collector service
Stop-Service nrdot-collector


# Configure service to use gMSA account
# Use cmd /c to avoid PowerShell treating $ as a variable
cmd /c 'sc config nrdot-collector obj= "DOMAIN\gMSA-Account$" password= ""'


# Verify the configuration
Get-WmiObject Win32_Service -Filter "Name='nrdot-collector'" | Select Name, StartName


# start the NRDOT Collector service
Start-Service nrdot-collector

Importante

Replace DOMAIN\gMSA-Account$ with your actual gMSA account name. Note the $ at the end is required for gMSA accounts. No password is needed as gMSA handles authentication automatically.

Configure NRDOT Collector

Choose your monitoring configuration based on your needs:

Dica

Note: If you enable all available metrics, increase the limit_mib value (e.g., 1000) to prevent the memory limiter from dropping data.

Dica

Note: The max_concurrent_queries option controls how many metric queries the receiver executes in parallel against SQL Server during each scrape cycle.

receivers:
  nrsqlserver:
    max_concurrent_queries: 4  # default is 4 if omitted or set to 0

Update Windows Service Registry

Update the Windows Service Registry to use the new mssql-config.yaml file.

Method 1: PowerShell

Run the following command in PowerShell as Administrator:

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\nrdot-collector" -Name "ImagePath" -Value '"C:\Program Files\nrdot-collector\nrdot-collector.exe" --config "C:\Program Files\nrdot-collector\mssql-config.yaml"'

Method 2: Command Prompt (Alternative)

If PowerShell is not available, you can use Command Prompt instead:

  1. Open your Start Menu, type cmd
  2. Right-click Command Prompt and choose Run as administrator
  3. Copy and paste this exact command into the black CMD window and hit Enter:
sc config "nrdot-collector" binPath= "\"C:\Program Files\nrdot-collector\nrdot-collector.exe\" --config \"C:\Program Files\nrdot-collector\mssql-config.yaml\""

Validate NRDOT Collector Configuration

Validate the NRDOT Collector configuration to ensure it's correctly formatted and will work properly.

& "C:\Program Files\nrdot-collector\nrdot-collector.exe" validate --config="C:\Program Files\nrdot-collector\mssql-config.yaml"

Restart NRDOT collector

After updating your configuration, restart the NRDOT Collector service:

bash
$
net stop nrdot-collector
$
net start nrdot-collector

Dica

Always restart the NRDOT collector service after making configuration changes to ensure the new settings take effect.

(Optional) Set up APM-database correlation

To correlate your application performance with database operations, you can set up database service identification. This feature allows you to see exactly which applications are generating specific database workloads. For more information, refer to set up database service identification to get APM-database correlation in New Relic.

Importante

To view database performance data in APM, both entities must be in the same New Relic account. If the entities are in different New Relic accounts, you must have access to both accounts to view the data.

(Optional) Configure secret management

The secret management feature allows you to securely manage sensitive information, such as database credentials. This helps to enhance the security of your monitoring setup by avoiding hardcoding sensitive data in configuration files. For more information, refer to secret management.

Find and use your data

Once your data is being collected, you can access comprehensive SQL Server database monitoring through New Relic's UI.

To find your SQL Server database entity in New Relic:

  1. Go to https://one.newrelic.com > All Capabilities > Databases.
  2. From the Entity type dropdown, select MSSQL instance, then click Apply.
  3. Select your SQL Server database from the list of entities.

Next steps

After setting up Windows self-hosted monitoring:

Copyright © 2026 New Relic Inc.
CarreirasTermos de serviçoPolítica do DMCAAviso de privacidadeWebsite TermsAviso de patenteUK Slavery Act

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.