benchdog vault
Azure Key Vault commands.
benchdog vault
benchdog vault [command] [options]
--rules <rules>- Rules file to use. Defaults to benchdog.json in the current folder, when it exists.
benchdog vault list
List every vault you can see across all your subscriptions.
benchdog vault list [options]
--rules <rules>- Rules file to use. Defaults to benchdog.json in the current folder, when it exists.
benchdog vault names
List the secret names in one vault. Values are never read.
benchdog vault names <vault> [options]
<vault>- Vault name or URI, for example bq-appvault-sa-dev or https://bq-appvault-sa-dev.vault.azure.net/
--include-certificates- Include certificate-backed secrets, which Key Vault creates for certificates. Hidden by default.
--rules <rules>- Rules file to use. Defaults to benchdog.json in the current folder, when it exists.
benchdog vault get
Show one secret value on purpose. Use --copy to keep it off the screen.
benchdog vault get <vault> <secret> [options]
<vault>- Vault name or URI.
<secret>- Secret name.
--copy- Put the value on the clipboard instead of printing it. On Windows it is kept out of clipboard history.
--rules <rules>- Rules file to use. Defaults to benchdog.json in the current folder, when it exists.
benchdog vault history
Show a secret's versions, newest first. Values are never printed.
benchdog vault history <vault> <secret> [options]
<vault>- Vault name or URI.
<secret>- Secret name.
--values- Show which versions share a value, as letters. Values are never printed. Needs Get permission.
--who- Show who made each change, from the vault's audit logs in Log Analytics, where they are enabled.
--rules <rules>- Rules file to use. Defaults to benchdog.json in the current folder, when it exists.
benchdog vault set
Set a secret value in one or more vaults. The value is typed at a hidden prompt.
benchdog vault set <secret> [options]
<secret>- Secret name.
--vaults <vaults> (REQUIRED)- Comma separated vault names or URIs, for example bq-appvault-sa-dev,bq-appvault-sa
--value-stdin- Read the value from standard input instead of a hidden prompt, for scripts. Needs --yes.
--yes- Skip the confirm prompt, for scripts.
--rules <rules>- Rules file to use. Defaults to benchdog.json in the current folder, when it exists.
benchdog vault copy
Copy a secret from one vault to others. The value is never shown.
benchdog vault copy <secret> [options]
<secret>- Secret name.
--from <from> (REQUIRED)- Vault name or URI to copy from.
--to <to> (REQUIRED)- Comma separated vault names or URIs to copy to.
--yes- Skip the confirm prompt, for scripts.
--rules <rules>- Rules file to use. Defaults to benchdog.json in the current folder, when it exists.
benchdog vault rollback
Put back an earlier version of a secret as a new version. The value is never shown.
benchdog vault rollback <vault> <secret> <version> [options]
<vault>- Vault name or URI.
<secret>- Secret name.
<version>- Version id to put back, as shown by benchdog vault history.
--yes- Skip the confirm prompt, for scripts.
--rules <rules>- Rules file to use. Defaults to benchdog.json in the current folder, when it exists.
benchdog vault delete
Delete a secret from one or more vaults. You confirm by typing the secret name.
benchdog vault delete <secret> [options]
<secret>- Secret name.
--vaults <vaults> (REQUIRED)- Comma separated vault names or URIs to delete from.
--yes- Skip the confirm prompt, for scripts.
--rules <rules>- Rules file to use. Defaults to benchdog.json in the current folder, when it exists.
benchdog vault deleted
List the soft deleted secrets in one vault, with the date each is removed for good.
benchdog vault deleted <vault> [options]
<vault>- Vault name or URI.
--rules <rules>- Rules file to use. Defaults to benchdog.json in the current folder, when it exists.
benchdog vault recover
Recover a soft deleted secret, with all its versions, in one or more vaults.
benchdog vault recover <secret> [options]
<secret>- Secret name.
--vaults <vaults> (REQUIRED)- Comma separated vault names or URIs to recover in.
--yes- Skip the confirm prompt, for scripts.
--rules <rules>- Rules file to use. Defaults to benchdog.json in the current folder, when it exists.
benchdog vault diff
Compare secrets across vaults: names by default, values with --values.
benchdog vault diff <vaults>... [options]
<vaults>- Two or more vault names or URIs to compare.
--values- Also compare values. The same letter means the same value. Values are never printed. Needs Get permission on secrets.
--all- Show every secret, not only the ones with drift.
--fail-on-drift- Return exit code 3 when any drift is found, for CI pipelines.
--include-certificates- Include certificate-backed secrets, which Key Vault creates for certificates. Hidden by default.
--rules <rules>- Rules file to use. Defaults to benchdog.json in the current folder, when it exists.
benchdog vault check
Check vaults against the rules file. Values are never printed. Exit code 4 on any problem.
benchdog vault check <vaults>... [options]
<vaults>- One or more vault names or URIs to check.
--include-certificates- Include certificate-backed secrets, which Key Vault creates for certificates. Hidden by default.
--rules <rules>- Rules file to use. Defaults to benchdog.json in the current folder, when it exists.
benchdog sql
SQL Server and Azure SQL commands.
benchdog sql
benchdog sql [command] [options]
benchdog sql databases
List every Azure SQL database you can see, or with --server, the databases on one server.
benchdog sql databases [options]
--server <server>- Server host name, for example myserver.database.windows.net, or sqlhost\instance on your network.
--windows- Sign in with your Windows account instead of Entra, for SQL Server on your network.
--trust-server-certificate- Accept the server's certificate without checking it. Only for servers on your own network with a self-signed certificate.
--sql-login <sql-login>- Sign in with this SQL login, such as sa, for servers that only allow SQL logins. Benchdog asks for the password and never shows or logs it.
--remember-password- Remember the SQL login's password in the system's secure store, so later runs do not ask. Never in a file.
benchdog sql test
Connect to one database and show who you are signed in as.
benchdog sql test [options]
--server <server> (REQUIRED)- Server host name, for example myserver.database.windows.net, or sqlhost\instance on your network.
--database <database> (REQUIRED)- Database name.
--windows- Sign in with your Windows account instead of Entra, for SQL Server on your network.
--trust-server-certificate- Accept the server's certificate without checking it. Only for servers on your own network with a self-signed certificate.
--sql-login <sql-login>- Sign in with this SQL login, such as sa, for servers that only allow SQL logins. Benchdog asks for the password and never shows or logs it.
--remember-password- Remember the SQL login's password in the system's secure store, so later runs do not ask. Never in a file.
benchdog sql schema
Show a database's structure, or one object in full. Only the structure is read, never table data.
benchdog sql schema [options]
--server <server> (REQUIRED)- Server host name, for example myserver.database.windows.net, or sqlhost\instance on your network.
--database <database> (REQUIRED)- Database name.
--object, --table <object>- Show one table, view, procedure, function or trigger in full, for example dbo.Customer.
--windows- Sign in with your Windows account instead of Entra, for SQL Server on your network.
--trust-server-certificate- Accept the server's certificate without checking it. Only for servers on your own network with a self-signed certificate.
--sql-login <sql-login>- Sign in with this SQL login, such as sa, for servers that only allow SQL logins. Benchdog asks for the password and never shows or logs it.
--remember-password- Remember the SQL login's password in the system's secure store, so later runs do not ask. Never in a file.
benchdog sql describe
Show, set or remove a description, or another extended property, on the database or anything in it. Changes ask for a yes first.
benchdog sql describe [options]
--server <server> (REQUIRED)- Server host name, for example myserver.database.windows.net, or sqlhost\instance on your network.
--database <database> (REQUIRED)- Database name.
--object <object>- A table, view, procedure, function, trigger, type, sequence or synonym, for example dbo.Customer.
--column <column>- A column of the table, view or table function given with --object.
--parameter <parameter>- A parameter of the procedure or function given with --object, for example @CustomerId.
--schema <schema>- A schema, for example sales.
--principal <principal>- A database user or role.
--whole-database- Describe the database itself.
--property <property>- The extended property to show or change. Defaults to MS_Description, the description SSMS shows. [default: MS_Description]
--text <text>- The new text. Without --text or --remove, the current text is shown and nothing changes.
--remove- Remove the property.
--yes- Skip the confirm prompt, for scripts.
--windows- Sign in with your Windows account instead of Entra, for SQL Server on your network.
--trust-server-certificate- Accept the server's certificate without checking it. Only for servers on your own network with a self-signed certificate.
--sql-login <sql-login>- Sign in with this SQL login, such as sa, for servers that only allow SQL logins. Benchdog asks for the password and never shows or logs it.
--remember-password- Remember the SQL login's password in the system's secure store, so later runs do not ask. Never in a file.
benchdog sql doc
Document databases as HTML or Markdown pages, or one Word or PDF file, in a folder. Only the structure is read, never table data.
benchdog sql doc [options]
--project <project>- A SQL Documenter project file, such as sales.sqldoc.json, with the databases, formats and choices. Use it instead of --server and --database.
--server <server>- Server host name, for example myserver.database.windows.net, or sqlhost\instance on your network.
--database <database>- Database name. Give it more than once for several databases on the server in one document.
--out <out>- The folder to write to. It must be new, empty, or one SQL Documenter wrote before. A project file names its own.
--format <format>- html (the default), markdown, word or pdf. Give it more than once for several.
--title <title>- The document's title. Defaults to the database name.
--author <author>- Who wrote the document, on the cover and in the file's properties.
--copyright <copyright>- A copyright line for every page's footer.
--logo <logo>- A PNG or JPEG logo for the cover and the HTML header.
--css <css>- A CSS file added after the HTML stylesheet, to restyle it.
--name <name>- The Word or PDF file's name, without its extension. Defaults to the database name.
--include <include>- Only document objects with this name, such as sales.* (* and ? are wildcards). Give it more than once for several.
--exclude <exclude>- Leave out objects with this name, such as dbo._* (* and ? are wildcards). Give it more than once for several.
--exclude-kind <kind>- Leave out a kind of object: tables, views, procedures, functions, triggers, types, sequences, synonyms, users, roles, schemas.
--exclude-section <section>- Leave out a section on every page: scripts, permissions, dependencies, extended-properties, indexes, constraints, triggers, files, options, space, protection, diagrams. Put a kind first, such as tables:scripts, to leave it out of that kind's pages only.
--server-page- Add a page for each server: its version, edition, collation, main settings and the databases documented on it.
--windows- Sign in with your Windows account instead of Entra, for SQL Server on your network.
--trust-server-certificate- Accept the server's certificate without checking it. Only for servers on your own network with a self-signed certificate.
--sql-login <sql-login>- Sign in with this SQL login, such as sa, for servers that only allow SQL logins. Benchdog asks for the password and never shows or logs it.
--remember-password- Remember the SQL login's password in the system's secure store, so later runs do not ask. Never in a file.
benchdog sql run
Benchdog SQL Multi Runner: run one script, split on GO, against many databases, a few at a time. A script that may change data asks first.
benchdog sql run [<script>] [options]
<script>- The SQL script to run, such as fix.sql. Left out, the --project file's script runs.
--project <project>- A SQL Multi Runner project file, such as shops.multirunner.json, with the databases, the script and how it runs. Use it instead of --server and --database.
--save-project <save-project>- Save the databases, the script and how it runs to a project file first, to run again with --project. It never holds a password.
--server <server>- The server whose databases to run the script on.
--database <database>- A database to run the script on. Give it more than once for several.
--all-databases- Run the script on every database on the server you can see.
--stop-on-error- Start no more databases once one has failed.
--transaction- Run each database's script in one transaction, rolled back when a batch fails, so a database gets all of it or none.
--timeout <seconds>- How long one batch may run, in seconds. 0 waits.
--at-a-time <count>- How many databases run at a time, from 1 to 32. 4 by default.
--max-rows <count>- The most rows of each result set kept for --csv. 1,000 by default.
--csv <folder>- Write the result sets to CSV files in this folder, the same result from every database in one file.
--yes- Skip the confirm prompt, for scripts.
--windows- Sign in with your Windows account instead of Entra, for SQL Server on your network.
--trust-server-certificate- Accept the server's certificate without checking it. Only for servers on your own network with a self-signed certificate.
--sql-login <sql-login>- Sign in with this SQL login, such as sa, for servers that only allow SQL logins. Benchdog asks for the password and never shows or logs it.
--remember-password- Remember the SQL login's password in the system's secure store, so later runs do not ask. Never in a file.
benchdog sql search
Benchdog SQL Search: find text in the names, column names and code of the objects in databases on a server. Only the catalog is read, never table data.
benchdog sql search [<text>] [options]
<text>- The text to find, such as Customer, or Cust*Id with --wildcards. Left out, the --project file's text is found.
--project <project>- A SQL Search project file, such as shops.sqlsearch.json, with the databases and the search. Use it instead of --server and --database; the other options add to it.
--save-project <save-project>- Save the databases and the search to a project file first, to search again with --project. It never holds a password.
--server <server>- The server whose databases to search.
--database <database>- A database to search. Give it more than once for several.
--all-databases- Search every database on the server you can see.
--kind <kind>- Only search this kind of object: table, view, procedure, function, trigger, synonym, sequence or type. Give it more than once for several.
--no-names- Do not look in object names.
--no-columns- Do not look in the column names of tables and views.
--no-code- Do not look in the code of views, procedures, functions and triggers.
--match-case- Upper and lower case must match.
--whole-word- Only find the text as a whole word, not part of a longer one.
--wildcards- * stands for any run of characters on one line, and ? for any one character.
--max <max>- The most matches to show. 2,000 by default.
--windows- Sign in with your Windows account instead of Entra, for SQL Server on your network.
--trust-server-certificate- Accept the server's certificate without checking it. Only for servers on your own network with a self-signed certificate.
--sql-login <sql-login>- Sign in with this SQL login, such as sa, for servers that only allow SQL logins. Benchdog asks for the password and never shows or logs it.
--remember-password- Remember the SQL login's password in the system's secure store, so later runs do not ask. Never in a file.
benchdog sql forget-password
Forget a SQL login's password that Benchdog remembered in the system's secure store.
benchdog sql forget-password [options]
--server <server> (REQUIRED)- The server the login is on.
--sql-login <sql-login> (REQUIRED)- The SQL login, such as sa.
benchdog data
Benchdog SQL Data Comparer, SQL Data Filler and SQL Data Scrambler: compare and sync the rows of two databases, fill a database with test data, or scramble the personal data in a copy.
benchdog data
benchdog data [command] [options]
benchdog data compare
Compare the rows of two databases, then optionally write a sync script or sync the target. Comparing only reads.
benchdog data compare [options]
--project <project>- A SQL Data Comparer project file, such as sales.datacompare.json, with the source, target, tables, keys and row filters. Use it instead of the source and target options.
--save-project <save-project>- Save this comparison's source, target, tables, keys and row filters to a project file first, to run again with --project. It never holds a password.
--source-server <source-server>- The server of the database to copy rows from.
--source-database <source-database>- The database to copy rows from.
--target-server <target-server>- The server of the database to change. Defaults to the source server.
--target-database <target-database>- The database to change to match the source.
--include <include>- Only compare tables with this name, such as sales.* (* and ? are wildcards). Give it more than once for several.
--exclude <exclude>- Leave out tables with this name, such as dbo._* (* and ? are wildcards). Give it more than once for several.
--key <table=columns>- Match a table's rows by these columns, as table=column,column, for a table with no primary key. Give it more than once for several tables.
--where <table=condition>- Compare only a table's rows that meet a condition, as table=condition, such as dbo.Order=Placed >= '2024-01-01'.
--rows <rows>- Show up to this many differing rows of each table. [default: 0]
--script <script>- Write a sync script to this file, to review and run yourself.
--run- Change the target to match the source now, in one transaction, after you type its name to confirm.
--fire-triggers- Let the target's triggers fire while the sync changes rows. By default they are turned off while their tables change.
--backup- With --run, back the target up first, as a copy-only backup in the server's default backup folder. Nothing changes if the backup fails. Not for Azure SQL, which keeps its own backups.
--keep-script <keep-script>- With --run, keep the script in this file, written as the sync runs, so it is exactly what ran.
--yes- Skip the confirm prompt, for scripts.
--windows- Sign in with your Windows account instead of Entra, for SQL Server on your network.
--trust-server-certificate- Accept the server's certificate without checking it. Only for servers on your own network with a self-signed certificate.
--sql-login <sql-login>- Sign in with this SQL login, such as sa, for servers that only allow SQL logins. Benchdog asks for the password and never shows or logs it.
--target-sql-login <target-sql-login>- Sign in to the target with this SQL login, when it differs from --sql-login.
--remember-password- Remember the SQL login's password in the system's secure store, so later runs do not ask. Never in a file.
benchdog data fill
Benchdog SQL Data Filler: fill a database's tables with realistic test data. Shows the plan; --preview, --script and --fill show, write or add the rows.
benchdog data fill [options]
--project <project>- A SQL Data Filler project file, such as shop.datafiller.json, with the database, tables, rows and chosen columns. Use it instead of --server and --database.
--save-project <save-project>- Save this fill's database, tables, rows and settings to a project file first, to run again with --project. It never holds a password.
--server <server>- The server of the database to fill.
--database <database>- The database to fill.
--table <name[=rows]>- A table to fill, such as dbo.Customer, or dbo.Customer=500 for its rows. Give it more than once for several.
--all- Fill every table in the database.
--rows <rows>- The rows each table gets when it is given without a count. [default: 1000]
--seed <seed>- The number every random choice starts from. The same seed makes the same rows.
--locale <locale>- The language names, addresses and phone numbers are made in, such as en, en_GB, de or fr.
--empty-first- Delete the tables' rows before filling them.
--fire-triggers- Let the tables' triggers fire as rows go in.
--no-check-constraints- Do not check rows against check constraints and foreign keys as they go in. Faster, but SQL Server no longer trusts them.
--columns- Show how each column is filled.
--preview <table>- Show the first rows a fill would add to this table, without writing anything.
--preview-rows <preview-rows>- How many rows --preview shows. [default: 20]
--script <script>- Write the fill as a script to this file, to review and run yourself.
--fill- Add the rows now, in one transaction, after you type the database's name to confirm.
--backup- With --fill, back the database up first, as a copy-only backup in the server's default backup folder. Not for Azure SQL, which keeps its own backups.
--yes- Skip the confirm prompt, for scripts.
--windows- Sign in with your Windows account instead of Entra, for SQL Server on your network.
--trust-server-certificate- Accept the server's certificate without checking it. Only for servers on your own network with a self-signed certificate.
--sql-login <sql-login>- Sign in with this SQL login, such as sa, for servers that only allow SQL logins. Benchdog asks for the password and never shows or logs it.
--remember-password- Remember the SQL login's password in the system's secure store, so later runs do not ask. Never in a file.
benchdog data scramble
Benchdog SQL Data Scrambler: scramble the personal data in a test or dev copy of a live database. Shows the plan; --preview and --scramble show or change the rows.
benchdog data scramble [options]
--project <project>- A SQL Data Scrambler project file, such as shop.datascrambler.json, with the database, tables and chosen columns. Use it instead of --server and --database.
--save-project <save-project>- Save this scramble's database, tables and settings to a project file first, to run again with --project. It never holds a password.
--server <server>- The server of the copy to scramble.
--database <database>- The copy to scramble. Never the live database.
--table <name>- A table to scramble, such as dbo.Customer, with the columns that look personal chosen for it. Give it more than once for several.
--suggested- Scramble every table that looks personal.
--column <table.column=rule[:setting]>- How a column changes, as table.column=rule, such as dbo.Person.Email=fake:email, dbo.Person.Notes=fixed:Hidden, dbo.Person.Card=mask:4, dbo.Person.Salary=noise:5, dbo.Person.Born=dateShift:90 or dbo.Person.Phone=null. Ticks its table too.
--seed <seed>- The number every scrambled value is worked out from. The same seed turns the same value into the same result each run. Without it, each run is new, so nobody can check a guess against the copy.
--locale <locale>- The language fake names, addresses and phone numbers are made in, such as en, en_GB, de or fr.
--batch-size <batch-size>- The rows read at a time. Defaults to 5,000.
--fire-triggers- Let the tables' triggers fire as rows change. By default they are turned off while their tables change.
--columns- Show how each column changes, and why.
--preview <table>- Show the first rows of this table before and after, without writing anything.
--preview-rows <preview-rows>- How many rows --preview shows. [default: 20]
--scramble- Scramble the copy in place now, one table at a time, after you type the database's name to confirm.
--backup- With --scramble, back the database up first, as a copy-only backup in the server's default backup folder. Not for Azure SQL, which keeps its own backups.
--yes- Skip the confirm prompt, for scripts.
--windows- Sign in with your Windows account instead of Entra, for SQL Server on your network.
--trust-server-certificate- Accept the server's certificate without checking it. Only for servers on your own network with a self-signed certificate.
--sql-login <sql-login>- Sign in with this SQL login, such as sa, for servers that only allow SQL logins. Benchdog asks for the password and never shows or logs it.
--remember-password- Remember the SQL login's password in the system's secure store, so later runs do not ask. Never in a file.
benchdog monitor
Benchdog SQL Monitor: watch SQL Server, Azure SQL and Amazon RDS, keep the history, and say when something needs a look. At a terminal, what a command needs and was not given is asked for.
benchdog monitor
benchdog monitor [command] [options]
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.
benchdog monitor collect
Check every server in the project on its schedule and keep each check in the history store, until stopped with Ctrl+C.
benchdog monitor collect [options]
--project <project> (REQUIRED)- The SQL Monitor project file, such as production.monitor.json, with the servers, the history store and the schedule.
--once- Check every server once, keep the checks, and stop.
--service <service>- Run as the installed service of this name, with the SQL login passwords saved for it. Its installed command line gives it.
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.
benchdog monitor check
Check one server's health now: CPU, memory, waits, blocking, deadlocks, long queries, disk, log space, backups, failed jobs and availability groups.
benchdog monitor check [options]
--project <project>- A SQL Monitor project file, such as production.monitor.json. Name a server in it with --name.
--name <name>- The server in the project, by its name. Not needed when the project has one.
--server <server>- The server to look at, when there is no --project, such as sqlhost or myserver.database.windows.net.
--database <database>- The database to connect to. master by default; Azure SQL Database names its own.
--sign-in <sign-in>- How to sign in: entra (the default), windows, managedIdentity or sql.
--user <user>- The SQL login, for --sign-in sql. Its password is asked for, or taken from the secure store.
--client-id <client-id>- A user-assigned managed identity's client id, for --sign-in managedIdentity.
--trust-server-certificate- Trust the server's certificate without checking it, for a server on your own network whose certificate is self-signed.
--remember-password- Remember the SQL login's password in the system's secure store, so later runs do not ask. Never in a file.
--fail-on <fail-on>- Exit with 3 when the server's worst area is this or worse: warning or critical.
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.
benchdog monitor top
Show one server's top queries: from the plan cache, from a database's Query Store with what they waited on, or from the history store over a time.
benchdog monitor top [options]
--project <project>- A SQL Monitor project file, such as production.monitor.json. Name a server in it with --name.
--name <name>- The server in the project, by its name. Not needed when the project has one.
--server <server>- The server to look at, when there is no --project, such as sqlhost or myserver.database.windows.net.
--database <database>- The database to connect to. master by default; Azure SQL Database names its own.
--sign-in <sign-in>- How to sign in: entra (the default), windows, managedIdentity or sql.
--user <user>- The SQL login, for --sign-in sql. Its password is asked for, or taken from the secure store.
--client-id <client-id>- A user-assigned managed identity's client id, for --sign-in managedIdentity.
--trust-server-certificate- Trust the server's certificate without checking it, for a server on your own network whose certificate is self-signed.
--remember-password- Remember the SQL login's password in the system's secure store, so later runs do not ask. Never in a file.
--by <by>- Rank by cpu (the default), duration, reads, writes or executions.
--count <count>- How many queries. 20 by default.
--query-store <database>- Read this database's Query Store instead of the plan cache.
--history- Read what the collector kept in the project's history store instead.
--hours <hours>- The hours back to read, for --query-store and --history. 24 by default.
--per-run- Rank by what each run took, and show it, rather than the totals.
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.
benchdog monitor plan
Show one query's plan: each operator with its share of the cost, its warnings, and the indexes the optimiser says are missing.
benchdog monitor plan [options]
--project <project>- A SQL Monitor project file, such as production.monitor.json. Name a server in it with --name.
--name <name>- The server in the project, by its name. Not needed when the project has one.
--server <server>- The server to look at, when there is no --project, such as sqlhost or myserver.database.windows.net.
--database <database>- The database to connect to. master by default; Azure SQL Database names its own.
--sign-in <sign-in>- How to sign in: entra (the default), windows, managedIdentity or sql.
--user <user>- The SQL login, for --sign-in sql. Its password is asked for, or taken from the secure store.
--client-id <client-id>- A user-assigned managed identity's client id, for --sign-in managedIdentity.
--trust-server-certificate- Trust the server's certificate without checking it, for a server on your own network whose certificate is self-signed.
--remember-password- Remember the SQL login's password in the system's secure store, so later runs do not ask. Never in a file.
--query-hash <hash> (REQUIRED)- The query's hash, as monitor top gives it, such as 0x1A2B3C4D5E6F7A8B.
--query-store <database>- Read the plan from this database's Query Store instead of the plan cache.
--save <file>- Save the plan's XML to this file, such as query.sqlplan, to open in SQL Server Management Studio.
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.
benchdog monitor inventory
Show one server's inventory: its release and patches, settings, databases and powerful logins, with what best practice says to look at.
benchdog monitor inventory [options]
--project <project>- A SQL Monitor project file, such as production.monitor.json. Name a server in it with --name.
--name <name>- The server in the project, by its name. Not needed when the project has one.
--server <server>- The server to look at, when there is no --project, such as sqlhost or myserver.database.windows.net.
--database <database>- The database to connect to. master by default; Azure SQL Database names its own.
--sign-in <sign-in>- How to sign in: entra (the default), windows, managedIdentity or sql.
--user <user>- The SQL login, for --sign-in sql. Its password is asked for, or taken from the secure store.
--client-id <client-id>- A user-assigned managed identity's client id, for --sign-in managedIdentity.
--trust-server-certificate- Trust the server's certificate without checking it, for a server on your own network whose certificate is self-signed.
--remember-password- Remember the SQL login's password in the system's secure store, so later runs do not ask. Never in a file.
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.
benchdog monitor history
Show the checks the history store keeps: each server's latest, or one server's over the last hours.
benchdog monitor history [options]
--project <project> (REQUIRED)- The SQL Monitor project file with the history store.
--name <name>- One server's checks, by its name in the project. Every server's latest when left out.
--hours <hours>- The hours back to read. 24 by default.
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.
benchdog monitor alerts
Show the alerts the history store keeps: every one still open, and those that fired in the last hours.
benchdog monitor alerts [options]
--project <project> (REQUIRED)- The SQL Monitor project file with the history store.
--hours <hours>- The hours back to read, besides every alert still open. 24 by default.
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.
benchdog monitor versions
Show each server's release and update against the latest for its release, and how many are behind. From the history store, or read from each server now when the project has none.
benchdog monitor versions [options]
--project <project> (REQUIRED)- The SQL Monitor project file.
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.
benchdog monitor project
Make a SQL Monitor project file, add and remove its servers, and check each can be reached.
benchdog monitor project [command] [options]
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.
benchdog monitor project new
Make a SQL Monitor project file watching one server, with a history store when one is given. Add more with project add. At a terminal, the server and store left out are asked for.
benchdog monitor project new [options]
--project <project>- The project file to make, such as production.monitor.json. Asked for at a terminal when left out.
--name <name>- The name to show for the server. The server itself when left out.
--group <group>- The group the overview shows the server in, such as Production. None when left out.
--server <server>- The server to look at, when there is no --project, such as sqlhost or myserver.database.windows.net.
--database <database>- The database to connect to. master by default; Azure SQL Database names its own.
--sign-in <sign-in>- How to sign in: entra (the default), windows, managedIdentity or sql.
--user <user>- The SQL login, for --sign-in sql. Its password is asked for, or taken from the secure store.
--client-id <client-id>- A user-assigned managed identity's client id, for --sign-in managedIdentity.
--trust-server-certificate- Trust the server's certificate without checking it, for a server on your own network whose certificate is self-signed.
--store-server <store-server>- The server of the history store. No store, so checks are not kept, when left out.
--store-database <store-database>- The history store's database, such as BenchdogMonitor. It must be there already.
--store-sign-in <store-sign-in>- How the store is signed in to: entra (the default), windows, managedIdentity or sql.
--store-user <store-user>- The store's SQL login, for --store-sign-in sql.
--store-trust-server-certificate- Trust the store's server certificate without checking it, for a server on your own network whose certificate is self-signed.
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.
benchdog monitor project add
Add a server to a SQL Monitor project file. At a terminal, the server left out is asked for.
benchdog monitor project add [options]
--project <project>- The project file to add the server to. Asked for at a terminal when left out.
--name <name>- The name to show for the server. The server itself when left out.
--group <group>- The group the overview shows the server in, such as Production. None when left out.
--server <server>- The server to look at, when there is no --project, such as sqlhost or myserver.database.windows.net.
--database <database>- The database to connect to. master by default; Azure SQL Database names its own.
--sign-in <sign-in>- How to sign in: entra (the default), windows, managedIdentity or sql.
--user <user>- The SQL login, for --sign-in sql. Its password is asked for, or taken from the secure store.
--client-id <client-id>- A user-assigned managed identity's client id, for --sign-in managedIdentity.
--trust-server-certificate- Trust the server's certificate without checking it, for a server on your own network whose certificate is self-signed.
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.
benchdog monitor project remove
Remove a server from a SQL Monitor project file. Its history stays in the store.
benchdog monitor project remove [options]
--project <project>- The project file to remove the server from. Asked for at a terminal when left out.
--name <name>- The server to remove, by its name in the project. Asked for at a terminal when left out.
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.
benchdog monitor project check
Check a SQL Monitor project file: sign in to every server and the history store as the collector would, and look for each alert channel's secret. Exits with 1 when anything needs a look.
benchdog monitor project check [options]
--project <project>- The project file to check. Asked for at a terminal when left out.
--service <service>- Check with the passwords and secrets saved for the installed service of this name. Needs an administrator, or sudo.
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.
benchdog monitor password
Keep a SQL login's password in the system's secure store, and nowhere else, for the collector to sign in with. It is asked for, hidden, or read from the first line of piped input. At a terminal, the login left out is picked from the project files here.
benchdog monitor password [options]
--server <server>- The server the login is on, as the project file names it. Asked for at a terminal when left out.
--user <user>- The SQL login, as the project file names it. Asked for at a terminal when left out.
--forget- Forget the password instead.
--service <service>- Keep it for the installed service of this name, such as benchdog-monitor, in the system's store for services. Needs an administrator, or sudo.
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.
benchdog monitor secret
Keep an alert channel's secret, the SMTP password or the Teams or Slack webhook address, in the system's secure store, and nowhere else. It is asked for, hidden, or read from the first line of piped input.
benchdog monitor secret [options]
--project <project>- The SQL Monitor project file that has the channel. Asked for at a terminal when left out.
--channel <channel>- The alert channel, by its name in the project file. Asked for at a terminal when left out.
--forget- Forget the secret instead.
--service <service>- Keep it for the installed service of this name, such as benchdog-monitor, in the system's store for services. Needs an administrator, or sudo.
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.
benchdog monitor alert
SQL Monitor's alerts: send a test to the channels.
benchdog monitor alert [command] [options]
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.
benchdog monitor alert test
Send a test message to each alert channel in the project, to show alerts will reach it. Exits with 1 when any could not be sent.
benchdog monitor alert test [options]
--project <project> (REQUIRED)- The SQL Monitor project file with the channels.
--channel <channel>- Only this channel, by its name. Every channel when left out.
--service <service>- Use the secrets saved for the installed service of this name. Needs an administrator, or sudo.
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.
benchdog monitor service
Install the collector as a Windows service, a systemd service on Linux or a launchd daemon on a Mac, remove it, or see how it is.
benchdog monitor service [command] [options]
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.
benchdog monitor service install
Install the collector as a service that starts with the system, and start it. Installing again updates the program and project, keeping the saved passwords. Needs an administrator, or sudo.
benchdog monitor service install [options]
--project <project>- The SQL Monitor project file the service runs, such as production.monitor.json. It is copied in, so install again after changing it. Asked for at a terminal when left out.
--name <name>- The service's name: letters, digits and dashes. Give each its own to run more than one. Defaults to benchdog-monitor. [default: benchdog-monitor]
--account <account>- The account the service runs as. Windows: NT SERVICE\<name> (the default), a group managed service account such as CONTOSO\sqlmonitor$, or NT AUTHORITY\NetworkService. Linux: a user of its own that systemd makes (the default), or an existing user. A Mac: root.
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.
benchdog monitor service uninstall
Stop the service and remove it, with its program, project, log and saved passwords. The history store is kept. Needs an administrator, or sudo.
benchdog monitor service uninstall [options]
--name <name>- The service's name: letters, digits and dashes. Give each its own to run more than one. Defaults to benchdog-monitor. [default: benchdog-monitor]
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.
benchdog monitor service status
Say whether the service is installed and running. Exits with 0 only when it is running.
benchdog monitor service status [options]
--name <name>- The service's name: letters, digits and dashes. Give each its own to run more than one. Defaults to benchdog-monitor. [default: benchdog-monitor]
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.
benchdog scheduler
Benchdog SQL Scheduler: run backups, scripts and the other Benchdog tools on a schedule, on SQL Server, SQL Server Express and Azure SQL, and keep the history. At a terminal, what a command needs and was not given is asked for.
benchdog scheduler
benchdog scheduler [command] [options]
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.
benchdog scheduler run
Run every enabled job in the project when its schedule comes round, keeping each run in the history store, until stopped with Ctrl+C.
benchdog scheduler run [options]
--project <project> (REQUIRED)- The SQL Scheduler project file, such as production.scheduler.json, with the servers, the jobs and the history store.
--monitor <monitor>- A SQL Monitor project file to run the collector for as well, so one process, or one service, does both.
--job <job>- Run this job now, whatever its schedule says, show what it did, and stop. Exits with 0 only when it succeeded.
--service <service>- Run as the installed service of this name, with the SQL login passwords saved for it. Its installed command line gives it.
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.
benchdog scheduler jobs
List the project's jobs: each schedule in plain words, when it is next due, and how its last run went.
benchdog scheduler jobs [options]
--project <project> (REQUIRED)- The SQL Scheduler project file.
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.
benchdog scheduler history
Show the runs the history store keeps, the newest first, or one run in full.
benchdog scheduler history [options]
--project <project> (REQUIRED)- The SQL Scheduler project file with the history store.
--job <job>- Only this job's runs. Every job's when left out.
--hours <hours>- The hours back to read. 168, a week, by default.
--run <run>- One run by its id, with each step and what it wrote.
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.
benchdog scheduler next
Show when a project's jobs next run, or try a schedule before putting it in a project.
benchdog scheduler next [options]
--project <project>- The SQL Scheduler project file whose jobs to show.
--job <job>- Only this job of the project.
--cron <cron>- A cron expression to try, such as "0 2 * * *", instead of a project.
--every <every>- A schedule to try, as a project file's "every": day, week, month, or so many minutes or hours.
--at <at>- The time of day for --every, such as 02:00, or several with commas.
--days <days>- The days for --every: weekdays, weekends, or days with commas such as mon,wed,fri.
--between <between>- The hours for --every so many minutes or hours, such as 08:00-18:00.
--day <day>- The day of the month for --every month: 1 to 31, or last.
--time-zone <time-zone>- The time zone a schedule typed in is for, such as Europe/London. This computer's when left out.
--count <count>- How many runs to show. 5 by default. [default: 5]
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.
benchdog scheduler project
SQL Scheduler project files: check one.
benchdog scheduler project [command] [options]
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.
benchdog scheduler project check
Check a SQL Scheduler project file: sign in to every server and the history store as the scheduler would, look for every script and project its steps use, and for each alert channel's secret. Exits with 1 when anything needs a look.
benchdog scheduler project check [options]
--project <project> (REQUIRED)- The project file to check.
--service <service>- Check with the passwords and secrets saved for the installed service of this name. Needs an administrator, or sudo.
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.
benchdog scheduler password
Keep a SQL login's password in the system's secure store, and nowhere else, for a job to sign in with. It is asked for, hidden, or read from the first line of piped input. At a terminal, the login left out is picked from the project files here.
benchdog scheduler password [options]
--server <server>- The server the login is on, as the project file names it. Asked for at a terminal when left out.
--user <user>- The SQL login, as the project file names it. Asked for at a terminal when left out.
--forget- Forget the password instead.
--service <service>- Keep it for the installed service of this name, such as benchdog-scheduler, in the system's store for services. Needs an administrator, or sudo.
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.
benchdog scheduler secret
Keep an alert channel's secret, the SMTP password or the Teams or Slack webhook address, in the system's secure store, and nowhere else. It is asked for, hidden, or read from the first line of piped input.
benchdog scheduler secret [options]
--project <project> (REQUIRED)- The SQL Scheduler project file that has the channel.
--channel <channel> (REQUIRED)- The alert channel, by its name in the project file.
--forget- Forget the secret instead.
--service <service>- Keep it for the installed service of this name, such as benchdog-scheduler, in the system's store for services. Needs an administrator, or sudo.
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.
benchdog scheduler alert
SQL Scheduler's alerts: send a test to the channels.
benchdog scheduler alert [command] [options]
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.
benchdog scheduler alert test
Send a test message to each alert channel in the project, to show alerts will reach it. Exits with 1 when any could not be sent.
benchdog scheduler alert test [options]
--project <project> (REQUIRED)- The SQL Scheduler project file with the channels.
--channel <channel>- Only this channel, by its name. Every channel when left out.
--service <service>- Use the secrets saved for the installed service of this name. Needs an administrator, or sudo.
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.
benchdog scheduler service
Install the scheduler as a Windows service, a systemd service on Linux or a launchd daemon on a Mac, remove it, or see how it is.
benchdog scheduler service [command] [options]
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.
benchdog scheduler service install
Install the scheduler as a service that starts with the system, and start it. Installing again updates the program and files, keeping the saved passwords. Needs an administrator, or sudo.
benchdog scheduler service install [options]
--project <project> (REQUIRED)- The SQL Scheduler project file the service runs, such as production.scheduler.json. It is copied in with the scripts and projects its steps use, so install again after changing any of them.
--monitor <monitor>- A SQL Monitor project file beside it, for the same service to run the collector too.
--name <name>- The service's name: letters, digits and dashes. Give each its own to run more than one. Defaults to benchdog-scheduler. [default: benchdog-scheduler]
--account <account>- The account the service runs as. Windows: NT SERVICE\<name> (the default), a group managed service account such as CONTOSO\sqljobs$, or NT AUTHORITY\NetworkService. Linux: a user of its own that systemd makes (the default), or an existing user. A Mac: root.
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.
benchdog scheduler service uninstall
Stop the service and remove it, with its program, files, log and saved passwords. The history store is kept. Needs an administrator, or sudo.
benchdog scheduler service uninstall [options]
--name <name>- The service's name: letters, digits and dashes. Give each its own to run more than one. Defaults to benchdog-scheduler. [default: benchdog-scheduler]
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.
benchdog scheduler service status
Say whether the service is installed and running. Exits with 0 only when it is running.
benchdog scheduler service status [options]
--name <name>- The service's name: letters, digits and dashes. Give each its own to run more than one. Defaults to benchdog-scheduler. [default: benchdog-scheduler]
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.
benchdog assistant
Benchdog AI Assistant: ask about your databases and vaults with your own Anthropic or OpenAI key. The key is kept in the system's secure store and only ever goes to the provider you pick.
benchdog assistant
benchdog assistant [command] [options]
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.
benchdog assistant setup
Pick the provider and model and save the key. Settings go in assistant.json in the Benchdog folder; the key goes in the system's secure store only.
benchdog assistant setup [options]
--provider <provider>- The provider: anthropic or openai.
--endpoint <endpoint>- The provider's address, for a proxy or a gateway of your own. Left out, the provider's own address is used. Must start with https://.
--model <model>- The model, such as claude-opus-5-5. Left out, Anthropic uses that; OpenAI needs one named.
--key-stdin- Read the key from standard input, for a script. At a terminal it is asked for without echo instead.
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.
benchdog assistant status
Show the provider, model and endpoint, whether the key is saved, and where the settings live.
benchdog assistant status [options]
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.
benchdog assistant test
Ask the provider one small question, to show the settings and the key work.
benchdog assistant test [options]
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.
benchdog assistant models
List the models the provider offers this key, newest first. --provider names which, else the one set up.
benchdog assistant models [options]
--provider <provider>- The provider: anthropic or openai.
--endpoint <endpoint>- The provider's address, for a proxy or a gateway of your own. Left out, the saved endpoint or the provider's own address is used.
--key-stdin- Read the key from standard input, to list before saving it. Left out, the saved key is used.
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.
benchdog assistant forget
Remove the saved key from the system's secure store. --provider names which, else the one set up.
benchdog assistant forget [options]
--provider <provider>- The provider: anthropic or openai.
--settings- Remove the settings file as well, so the assistant is set up again from the start.
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.
benchdog assistant ask
Ask the assistant a question. Give --server and --database for it to see that database's structure.
benchdog assistant ask <question> [options]
<question>- What to ask, in quotes.
--server <server>- Server host name, for example myserver.database.windows.net, or sqlhost\instance on your network.
--database <database>- A database whose structure the assistant is given, with --server. Only the structure is read, never table data.
--selection <selection>- The object the question is about, such as dbo.Customer, so it is described first and in full.
--windows- Sign in with your Windows account instead of Entra, for SQL Server on your network.
--trust-server-certificate- Accept the server's certificate without checking it. Only for servers on your own network with a self-signed certificate.
--sql-login <sql-login>- Sign in with this SQL login, such as sa, for servers that only allow SQL logins. Benchdog asks for the password and never shows or logs it.
--remember-password- Remember the SQL login's password in the system's secure store, so later runs do not ask. Never in a file.
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.
benchdog licence
Your Benchdog licences: see where each tool stands, add or remove a licence, start a trial, or get your licence with your email. Only trial, get and check call benchdog.dev.
benchdog licence
benchdog licence [command] [options]
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.
benchdog licence status
Show where each tool stands: licensed, in a trial, not covered by this version, or not licensed.
benchdog licence status [options]
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.
benchdog licence list
List the licences held on this machine, with whose they are and what they cover.
benchdog licence list [options]
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.
benchdog licence add
Add a licence from its file or its text. It is checked before it is kept, and a licence issued later with the same id takes over.
benchdog licence add [<licence>] [options]
<licence>- A benchdog.licence file, or the licence text itself. Left out, or -, it is read from standard input, or asked for at a terminal.
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.
benchdog licence remove
Remove a licence from this machine. Its holder can add it again, or get it again with their email.
benchdog licence remove <id> [options]
<id>- The licence's id, as benchdog licence list shows it, such as L-7F3K9Q2M.
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.
benchdog licence trial
Start your free trial of every tool for thirty days. A code is emailed to you to confirm the address, and the trial licence is added here and emailed to you. One trial per email address.
benchdog licence trial [options]
--email <email>- The email address the licence or trial is for. Asked for at a terminal when left out.
--code <code>- The six digit code emailed to you. Left out, a code is emailed, and asked for at a terminal.
--name <name>- Your name, as it goes on the licence and shows in every tool. Asked for at a terminal when left out.
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.
benchdog licence get
Get the licences held for your email: your paid licence and your trial. A code is emailed to you to confirm the address.
benchdog licence get [options]
--email <email>- The email address the licence or trial is for. Asked for at a terminal when left out.
--code <code>- The six digit code emailed to you. Left out, a code is emailed, and asked for at a terminal.
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.
benchdog licence check
Ask benchdog.dev for anything newer than the licences held, such as your licence issued again after you bought another tool, and add it. Sends the licences held, as proof.
benchdog licence check [options]
--no-prompt- Never ask for what is left out, and fail as a script would. Nothing is asked when the input or output is redirected either.