January 9, 2012 at 9:27 am
[SOLVED]
Hi All,
I am facing really strange issue. I am working with a customer for who, we have created a SSIS package as part of some data exchange process.
What this SSIS package does is, it runs using SQL Agent Scheduler at some interval and it looks into some specific folder and parses any file in that folder. Once parsing is done, that file is moved to Archive folder or if file can't be parsed then will be moved to corrupted files folder.
Now, this SSIS package is stored in FILE SYSTEM. And it is using configuration file and we have modified paths of these folders to network folders. On our client site, both these SSIS package and config file are located at SAN. DBA working for this client side has created a SQL Agent task to run this SSIS package which uses this configuration file.
Question is, when I run this task to test, it get completed successfully (I mean job doesn't get fail). But if I look at task execution history, I see messages like,
Code: 0xC002F304 Source: Move File to Archive File System Task Description: An error occurred with the following error message: "Access to the path is denied.". End Error Error: 2012-01-09 09:51:34.48
This SQL Agent is using a proxy account, and DBA confirmed that this proxy account has FULL CONTROL to all of these folders.
If this is helpful to know then, SQL Server instance which runs this SSIS package, all 3 folders, and SSIS package(with config file) are located on 3 different servers. SQL Server DB runs in a compatibility level of 90 (SQL Server 2005).
Any help or suggestion is appreciated.
Thanks,
Jack
January 9, 2012 at 9:45 am
Can you get the package to run outside of the agent job?
Jason...AKA CirqueDeSQLeil
_______________________________________________
I have given a name to my pain...MCM SQL Server, MVP
SQL RNNR
Posting Performance Based Questions - Gail Shaw[/url]
Learn Extended Events
January 9, 2012 at 9:46 am
I could be wrong, but I *think* that SSIS has its own login which needs the access, since it is the one handling the moving of the files.
January 9, 2012 at 9:56 am
SSIS runs in the context it is started in. ie: the proxy account. You said the usre has full access on the folders, but did you check the share? Are they on the same share? Remember there are share permissions and folder permissions, and file permissions. And any one of those could be a problem.
CEWII
January 9, 2012 at 11:46 am
Thank you guys for super quick responses, I guess I am not the only one free at work 😛 ... just kidding.
@jason, I don't have access to DB server but I can ask client DBA to try it for me. Thing is, this package works just fine in our staging environment (with configuration file) but it unfortunately staging doesn't reflect actual corporate network environment with all sort of crazy permissions.
@Elliott, yes when job is being executed with Proxy account SQL Agent will use that proxy account to execute that job (that's the reason we use proxy account at first place, right ??). And yes I checked that proxy user for access to network share drives. Actually that proxy user is assigned FULL ACCESS to that share. However, Do I need to give permission to all subfolders as well ?? I thought that if I set permission to root folder all sub folders will too follow that permission, don't they ??
Any other suggestion ??
Thanks,
Jack
January 9, 2012 at 11:50 am
Permissions don't always cascade to child folders. Check the subfolders and confirm permissions exist there.
Even though it works in your stage environment, it is not a guarantee that it will work at the client site. Something is definitely configured different between the two.
Also, check to see if a firewall or router exists between the servers and shares. There may be routing rules at play or a firewall rule preventing access.
Jason...AKA CirqueDeSQLeil
_______________________________________________
I have given a name to my pain...MCM SQL Server, MVP
SQL RNNR
Posting Performance Based Questions - Gail Shaw[/url]
Learn Extended Events
January 9, 2012 at 12:44 pm
jck.locke (1/9/2012)
@Elliott, yes when job is being executed with Proxy account SQL Agent will use that proxy account to execute that job (that's the reason we use proxy account at first place, right ??). And yes I checked that proxy user for access to network share drives. Actually that proxy user is assigned FULL ACCESS to that share. However, Do I need to give permission to all subfolders as well ?? I thought that if I set permission to root folder all sub folders will too follow that permission, don't they ??
You need to review the underlying permissions, as Jason said, they don't ALWAYS cascade. If the proxy user has full access to the share then the folders are the next layer to review..
CEWII
January 9, 2012 at 1:31 pm
SQLRNNR (1/9/2012) Permissions don't always cascade to child folders. Check the subfolders and confirm permissions exist there.
Elliott Whitlow (1/9/2012) You need to review the underlying permissions, as Jason said, they don't ALWAYS cascade. If the proxy user has full access to the share then the folders are the next layer to review..
I checked upto bottom of chain and that proxy account has FULL permission to all of those folders.
SQLRNNR (1/9/2012) Also, check to see if a firewall or router exists between the servers and shares. There may be routing rules at play or a firewall rule preventing access.
I think a firewall exists between Server and share because both of them are different server. But I also have other utilities and a web apps which are residing on same server as share and can communicate with database server which I am using to run SQL Agent task. And as far as I know, there are no routing rules in place.
What is puzzling me is, say if something is totally screwed up and package can't access network resources, then why my task doesn't fail with error ?? In my case, my task gets successfully completed. I will find error only when I see task execution history.
Thanks,
Jack
January 10, 2012 at 4:46 am
Hey,
can you please check your Package Owner and Execution Owner both are same? Both of them should have permission
on your all folders.
Thanks,
Nimesh
January 10, 2012 at 7:12 am
Nimesh_Parikh (1/10/2012)
can you please check your Package Owner and Execution Owner both are same? Both of them should have permission on your all folders.
I have not deployed my package in SQL Server, I am using file system. In this case, will there be Package Owner or Execution Owner ?? If so then where I can find/change it
January 10, 2012 at 8:37 am
jck.locke (1/10/2012)
Nimesh_Parikh (1/10/2012)
can you please check your Package Owner and Execution Owner both are same? Both of them should have permission on your all folders.I have not deployed my package in SQL Server, I am using file system. In this case, will there be Package Owner or Execution Owner ?? If so then where I can find/change it
I think he is confused with DTS..
CEWII
January 10, 2012 at 12:35 pm
That is really quite odd.. If the permissions at the folder and share levels are good all I can think of is file permissions and thats a stretch. but a file doesn't automagically take the permissions of the folder its in in all cases. If that isn't it I'm at a loss to explain..
CEWII
January 11, 2012 at 8:47 am
Elliott Whitlow (1/10/2012)
That is really quite odd.. If the permissions at the folder and share levels are good all I can think of is file permissions and thats a stretch. but a file doesn't automagically take the permissions of the folder its in in all cases. If that isn't it I'm at a loss to explain..CEWII
I know, this error doesn't make any sense (and that is the reason why I posted it here for help :-D).
January 11, 2012 at 10:03 am
Has the on-site dba been able to successfully run the package from BIDS?
Jason...AKA CirqueDeSQLeil
_______________________________________________
I have given a name to my pain...MCM SQL Server, MVP
SQL RNNR
Posting Performance Based Questions - Gail Shaw[/url]
Learn Extended Events
January 16, 2012 at 7:34 am
Finallyyyy . it's working !!
Apparently due to some strange extra permission issues, even though that proxy user had "FULL" control to the bottom of folder chain it was denying access to child folders.
After refusing many times, finally client security team agreed that issue was with their permissions not with SSIS package itself ...
Never mind, thanks everyone for their time to reply my question.
Jack
Viewing 15 posts - 1 through 15 (of 17 total)
You must be logged in to reply to this topic. Login to reply