The importance of SQL Server Updates

Hello! Welcome to a new post in the best Data blog. In today’s post we will talk about the importance of keeping SQL Server updates up to date.

Nowadays, one of the biggest recommendations is to keep our systems and applications updated, with the aim of eliminating bugs, vulnerabilities or obtaining new improvements and features.

It must also be clear that we are in constant evolution, that is, malware is also updated or new ones are created with the purpose of being able to take advantage of new vulnerabilities in our systems.

We have to be aware that all programs are not 100% safe, there may be errors within the code, which the manufacturer has not yet detected. This vulnerability is as well known as Zero-day.

Zero-Days

Zero-days are vulnerabilities that are present, but are not known to the vendor, which allows an attacker to exploit this vulnerability at will until it is detected and an update is later deployed to fix it.

Issues solutions

On the other hand, we must also take into account that possibly while using our systems, we may find errors that do not allow us to work correctly, be they minimal problems or serious problems that affect our performance and give us headaches.

For this reason, normally the manufacturer realizes these errors that affect us and creates a new update in order to solve that specific problem or several at the same time.

So the question would be, what are we waiting for to update our SQL Server?

Although updates are always recommended, certain aspects must be taken into account so that instead of solving several problems, it does not produce more.

Don’t just update the SQL Server, update the OS as well, as there may be dependencies or required features. There may also be compatibility issues.
Check the notes of the update that you are going to install, to check what incidents there are and how they can affect you. You can also rely on web pages that provide you with additional or more specific information about each Update, for example: https://sqlperformance.com/latest-builds/sql-server-2019
In case it is not an emergency or a critical security patch, try to update with patches that are 2 to 3 months old, that is, so that you have information about incidents from the community and are more forewarned. VERY IMPORTANT! .
Whenever possible, follow a correct change deployment flow: DEV → PRE → PRO
Before deploying the update, take a Virtual Machine Snapshot, because a bad update can leave you unable to bring up the SQL Server service.
In the case of a replication environment such as ALways On or mirroring, the nodes must always be identical, that is, the actions must be carried out on all the nodes. In this case always update the secondary nodes first, then failover and update the primary, and finally failback.
Follow the following flow for SQL Server:

Apply the latest service pack. This point only has to be done for SQL Server 2016 and previous versions
Apply the Cumulative Update (CU) that we have chosen. As the name suggests, this update is cumulative, so there is no need to install previous CUs.
Apply subsequent Security Updates to the CU. These are not cumulative, so you have to install them one by one.
Check the correct functioning of the instance and applications.
Delete Snapshot

8.If we wanted to update S.0:

Take Snapshot of virtual machine.
Use Windows Update to download and apply updates.
Check the correct functioning of the instance and applications.
Delete Snapshot

Finally, let’s never forget to have a plan for any type of change and this is no exception.

Change Planning

To have a good management regarding the change we will take into account the following steps:

1º Create a change management plan: It is necessary to create a change management plan that includes the necessary steps for the implementation of the change, as well as a detailed description of the roles and responsibilities of the people involved in the process.

For this it is essential to know the following points:

Define the change objective: Before creating a change management plan, it is important to clearly define the change objective. Why is the change being implemented? What do you hope to achieve with the change?

Identify the steps needed to implement the change: Once the objective of the change has been defined, it is necessary to identify the steps needed to implement the change. These may include identification of necessary resources, identification of impacts on other systems and processes, assignment of roles and responsibilities, etc.

Set a timeline: It is important to set a timeline for the change process. The timeline should include clear deadlines for each of the steps needed to implement the change.

Define roles and responsibilities: It is important to clearly define the roles and responsibilities of the people involved in the change process. This includes identifying who will be responsible for leading the change process, who will be responsible for communicating the change to stakeholders, who will be responsible for testing and verification, etc.

Establish an approval process: A formal approval process should be established for the proposed change. This may include review of the change by a change committee or change manager.

Document the plan: Once all the steps needed to implement the change have been identified and a timeline, roles and responsibilities, and approval process have been established, it is important document the plan. The plan should include all the details necessary to carry out the change process effectively.

2º Evaluation after its implementation: The evaluation of the change after its implementation is a crucial step in the change management process. This evaluation is intended to verify that the change has been implemented satisfactorily and has not created additional problems.

To carry out the change assessment, the following steps should be followed:

Verify the operation of the change: it must be verified that the change is being executed correctly and that it is meeting the established objectives and communicate it to all parties.

Assess the impact of the change: Assess the impact the change has had on IT services, end users and the business in general. If the impact has been negative, steps must be taken to correct it.

Identify and Resolve Problems: Any problems that have arisen as a result of the change should be identified and steps taken to resolve them. This may include implementing additional changes or reverting the original change if necessary.