title: What grants are needed for the SQL Server Telegraf plugin in Azure SQL Database
body: <p>I'm using the Telegraf input plugin for SQL Server (<a href="https://github.com/influxdata/telegraf/tree/master/plugins/inputs/sqlserver" rel="nofollow noreferrer">https://github.com/influxdata/telegraf/tree/master/plugins/inputs/sqlserver</a>) to gather metrics and report to InfluxDB. It works well for SQL Server, but though it supports Azure SQL Database the documentation is a bit sparse.</p>
  
  <p>The database user should be created like this:</p>
  
  <pre><code>CREATE LOGIN [telegraf] WITH PASSWORD = N'password';
  GRANT VIEW SERVER STATE TO [telegraf];
  GRANT VIEW ANY DEFINITION TO [telegraf];
  </code></pre>
  
  <p>That works on SQL Server, but in Azure it fails:</p>
  
  <blockquote>
    <p>Securable class 'server' not supported in this version of SQL Server.</p>
  </blockquote>
  
  <p>I wonder what I need to grant instead in order to solve this in the best possible way. We have a large number of databases running on the same server in an elastic pool, so if it is possible I would like to use a single user that logs in to the master and collects metrics for all the databases at once (the way it works with SQL Server). If that is impossible I can configure multiple logins and process one database at a time.</p>
  
  <p>Perhaps I can grant <code>VIEW DEFINITION</code> at the database level, but <code>VIEW SERVER STATE</code> does not seem to be supported at all.</p>
  
  <p>So, how should I configure the SQL Database login(s) for Telegraf with the SQL Server plugin to make it work?</p>
  
  <p>EDIT:</p>
  
  <ul>
  <li>Running as the super user for the server works without errors, but only produces metrics for master and tempdb. I need metrics for the many application databases and they are missing. Plus running as the super user is less than ideal.</li>
  <li>Running as the super user for the server but connecting to a specific application database (add database in connection string) crashes with a nil pointer dereference and the log complains about VIEW DATABASE STATE permission denied in database master (the super user has access, but apparently not when connecting to a spefic database).</li>
  <li>Granting VIEW DATABASE and VIEW DEFINITION to telegraf in an application database and connecting directly to that database as telegraf crashes with a nil pointer dereference and the log says the connection was closed.</li>
  </ul>
  
  <p>EDIT 2:</p>
  
  <p>Created bug report <a href="https://github.com/influxdata/telegraf/issues/4222" rel="nofollow noreferrer">https://github.com/influxdata/telegraf/issues/4222</a>.</p>
  
  <p>EDIT 3:</p>
  
  <p>As of the latest release the plugin works if the server admin account is used, so the issue has been solved. There is still no way to run with a less privileged account in Azure DB.</p>