Most of this is already in place if you monitor SQL Server today. There are three groups: what Enterprise Manager needs, what the SQL Server side needs, and one monitoring login with a short list of read-only grants.
In this page: Supported versions and platforms · Enterprise Manager and agents · The agent’s locale · Network and connectivity · The monitoring login · TLS · What you do not need · Checklist
Supported versions and platforms
Section titled “Supported versions and platforms”| Component | Supported |
|---|---|
| Oracle Enterprise Manager | Cloud Control 13.5, 24ai (24.1) |
| Microsoft SQL Server | 2016, 2017, 2019, 2022, 2025 |
| Management Agent | Linux x86-64, Windows x86-64 |
| SQL Server host | Windows or Linux |
Every declared SQL Server version has been collected against on a live instance under Enterprise Manager 24ai. The Enterprise Manager 13.5 edition has been verified for import, deployment, collection and console rendering, but has been exercised against SQL Server 2022 only, where the 24ai edition covers every version in the table; treat 24ai as the reference platform on that point. The full boundaries list is in What’s new. On SQL Server 2016 and 2017 two metric families return less detail than they do on 2019 and later, both for the same reason: the view that classifies a latched page by type arrived in 2019. TempDB contention collects, but its allocation-page and metadata-page waiter counts read zero and the advice cell is blank. Cluster nodes collects node names, but status, status description and current owner are blank. Read a zero or a blank in either as “not classifiable on this version”, not as “nothing to report”. Everything else is identical across versions.
Enterprise Manager and agents
Section titled “Enterprise Manager and agents”You need a working Enterprise Manager environment — management server and repository — and a Management Agent that can reach the instance over TCP.
The agent does not have to run on the SQL Server host. Remote monitoring from a Linux agent to a SQL Server on Windows is a supported and common arrangement, and it is how much of this plug-in was certified. Local agents work equally well.
Enterprise Manager will only accept a plug-in built for its own release, so use the build that matches: the 24.1.1.0.0 artifact for 24ai, the 13.5.1.0.0 artifact for 13.5. See Install and upgrade.
The agent’s locale
Section titled “The agent’s locale”The Management Agent that monitors SQL Server must run with a UTF-8 locale. The plug-in hands collected text to the agent in the agent’s own character set, and an agent started under a locale such as POSIX or C turns every non-ASCII character in a database name, a login, a host name, SQL text or a file path into ?. Numbers and ASCII text are unaffected, so the symptom is easy to miss until a name with an accent or a non-Latin script reaches a page or an alert.
On Linux, set LANG=C.UTF-8 (or any *.UTF-8 locale installed on the host) in the environment the agent is started from, and restart the agent from that shell. Alternatively add -Dfile.encoding=UTF-8 to agentJavaDefines in the agent’s emd.properties. To check a running agent, read its process environment: tr '\0' '\n' < /proc/<agent pid>/environ | grep LANG. On a Windows agent the default code page is used; set the agent service’s locale to one that covers the characters your estate uses, or leave it where it is for an ASCII-only estate.
An agent that already monitors other targets under a non-UTF-8 locale is not broken by the change; only what the agent reports for text values changes.
Network and connectivity
Section titled “Network and connectivity”The agent host needs TCP access to the instance, by default on port 1433. Named instances on non-default ports work; you give the port when you add the target.
For an availability group, point the target at the listener rather than a replica if you want the target to follow the primary.
The monitoring login
Section titled “The monitoring login”The plug-in connects as a read-only monitoring login. It never needs sysadmin, db_owner or CONTROL SERVER.
| Grant | Scope | What it covers |
|---|---|---|
VIEW SERVER STATE | Server | The dynamic management views: host, CPU, memory, availability groups, clustering, waits, sessions |
VIEW ANY DATABASE | Server | Listing every database on the instance |
VIEW ANY DEFINITION | Server | Database file metadata; metadata only, no read of data, no execute |
CONNECT ANY DATABASE | Server | Reaching each database for the file-group and free-space sweep |
db_datareader in msdb | msdb | Backup and job history |
SQLAgentReaderRole in msdb | msdb | SQL Server Agent job and schedule definitions |
Every grant is read-only metadata visibility. None confers the ability to write data, execute code, or alter definitions.
Create the login once per instance as a sysadmin, then give the plug-in only that login. A runnable setup script is available through your support channel.
The plug-in connects with encryption by default. Two modes are available and the difference matters:
required(the default) - the connection is encrypted, but the server’s certificate is not validated. Works with a self-signed certificate and needs nothing on the agent.verify- the certificate is validated against a truststore you supply. This is the stronger setting and needs the certificate chain in a truststore the agent can read.
A third value, disabled, turns encryption off for instances that do not offer it.
Choose per target when you add it. TLS connections covers both, including what to do when validation fails.
What you do not need
Section titled “What you do not need”- A JDBC driver install. The Microsoft JDBC driver ships inside the plug-in’s collection JAR. There is nothing to download, place on the agent, or keep in step with a database upgrade.
xp_cmdshell. The plug-in’s backup and restore jobs use native T-SQL. It never asks you to enable it — and it flags instances where it is enabled as a compliance finding.- An agent on the database host, unless you want one.
- A separate plug-in per SQL Server version. One plug-in and one target type cover 2016 through 2025.
Checklist
Section titled “Checklist”- Enterprise Manager 13.5 or 24ai, with a reachable Management Agent
- The agent running under a UTF-8 locale
- The plug-in build that matches your Enterprise Manager release
- TCP access from the agent host to the instance, default port 1433
- A monitoring login on each instance with the grants above
- For certificate validation, the chain in a truststore the agent can read
- The instance’s port and, for a named instance, its instance name
Related
Section titled “Related”- Install and upgrade - the next step once the checklist passes
- Credentials - creating the monitoring login and granting it
- TLS connections - if the instance requires encrypted connections
- Targets and properties - adding the first target
- Getting started - the whole path, start to finish