tracer-cloud--opensre/docs/azure-sql.mdx

---
title: "Azure SQL"
description: "Connect Azure SQL so OpenSRE can diagnose database issues and query performance during investigations"
---

When a database alert fires, you need answers fast. OpenSRE connects to your Azure SQL instances to quickly diagnose what's going wrong — checking server health, finding those slow queries that are bogging things down, monitoring resource usage, and analyzing query execution plans to pinpoint bottlenecks.

## What you'll need

Before getting started, make sure you have:

- An Azure SQL Database instance up and running
- Network connectivity from your OpenSRE environment to your Azure SQL server
- Database credentials ready (username and password)
- Your server hostname handy

## Getting connected

### The easy way: Interactive setup

If you prefer guided steps, just run:

```bash
opensre integrations setup
```

Pick **Azure SQL** from the menu and follow the prompts.

### The flexible way: Environment variables

Add these to your `.env` file:

```bash
AZURE_SQL_SERVER=myserver.database.windows.net
AZURE_SQL_DATABASE=mydb
AZURE_SQL_USERNAME=sqladmin
AZURE_SQL_PASSWORD=your_password
AZURE_SQL_ENCRYPT=true
```

| Variable | Default | Description |
| --- | --- | --- |
| `AZURE_SQL_SERVER` | — | **Required.** Azure SQL server hostname |
| `AZURE_SQL_DATABASE` | — | **Required.** Database name |
| `AZURE_SQL_USERNAME` | — | **Required.** SQL authentication username |
| `AZURE_SQL_PASSWORD` | — | **Required.** SQL authentication password |
| `AZURE_SQL_ENCRYPT` | `true` | Encrypt your connection for security |
| `AZURE_SQL_PORT` | `1433` | SQL Server port |
| `AZURE_SQL_DRIVER` | `ODBC Driver 18 for SQL Server` | ODBC driver name |

### The permanent way: Integration store

You can also save your connection details to `~/.opensre/integrations.json`:

```json
{
  "version": 1,
  "integrations": [
    {
      "id": "azure-sql-prod",
      "service": "azure_sql",
      "status": "active",
      "credentials": {
        "server": "myserver.database.windows.net",
        "database": "mydb",
        "username": "sqladmin",
        "password": "your_password",
        "encrypt": true
      }
    }
  ]
}
```

## Finding your connection details

Your Azure SQL server hostname looks like `myserver.database.windows.net`. You can find it:

1. Open the Azure Portal
2. Navigate to your SQL Database resource
3. Look for **Server name** in the overview panel
4. Copy it and add `.database.windows.net` if needed

## Network access: Firewall setup

Azure SQL uses firewall rules to control who can connect. Make sure OpenSRE can reach your server:

1. In Azure Portal, go to your SQL server → **Security** → **Firewalls and virtual networks**
2. Add your OpenSRE environment's IP address
3. Or check **Allow Azure services and resources to access this server** if running in Azure

<Tip>
If you're not sure of your IP, start with a permissive rule temporarily, get OpenSRE working, then lock it down.
</Tip>

## Investigation tools

When OpenSRE investigates an Azure SQL-related alert, these diagnostic tools are available:

### Server status

Retrieves service tier, resource utilization, connection counts, and database size. Useful for spotting DTU or vCore throttling.

### Current queries

Lists active sessions and running queries to identify lock contention or long-running operations.

### Slow queries

Surfaces top resource-consuming queries from Query Store or DMVs to pinpoint performance regressions.

### Wait stats

Reports cumulative wait types to identify I/O, lock, or CPU bottlenecks.

### Resource stats

Returns CPU, memory, and I/O utilization metrics for the target database.

## Test the connection

Ready to verify everything works?

```bash
opensre integrations verify azure_sql
```

Expected output:

```
Service: azure_sql
Status: passed
Detail: Connected to Azure SQL Database ...
```

## Troubleshooting

| Symptom | Fix |
| --- | --- |
| **Connection timeout** | Add your OpenSRE IP to the Azure SQL firewall rules. |
| **Login failed** | Confirm `AZURE_SQL_USERNAME` and `AZURE_SQL_PASSWORD`. Check that SQL authentication is enabled on the server. |
| **SSL/certificate error** | Keep `AZURE_SQL_ENCRYPT=true`. Install the correct ODBC driver (`ODBC Driver 18 for SQL Server`). |
| **Permission denied on DMVs** | Grant `VIEW SERVER STATE` and `VIEW DATABASE STATE` to the OpenSRE user. |

## Security best practices

- Use a **dedicated read-only SQL user** for OpenSRE — avoid admin credentials.
- Keep **encryption enabled** (`AZURE_SQL_ENCRYPT=true`) in production.
- Restrict firewall rules to the OpenSRE environment's egress IP.
- Store credentials in `.env` or the integration store, never in source code.