Fortify Software Security Center高可用数据库配置及MSSQL Always On可用性组适配咨询

Hey there! Let's break down your questions about setting up high availability for Fortify SSC with MSSQL, especially when using Always On Availability Groups.

关于Fortify SSC自身高可用数据库配置的说明 #

First off, let's clarify one thing right away: Fortify SSC doesn't have a built-in native high availability database configuration feature. Instead, it relies entirely on database-level HA solutions (like MSSQL Always On Availability Groups) to ensure database redundancy and failover capability. So your plan to leverage MSSQL Always On is exactly the recommended approach here.

适配MSSQL Always On可用性组的具体配置步骤 #

If you've already set up your MSSQL Always On Availability Group and added the ssc_db database to it, here's what you need to adjust in Fortify SSC:

• Update the SSC database connection URL
  Locate the ssc.properties file (usually in the conf directory of your Fortify SSC installation). Find the line starting with db.url and replace the single server address with your Always On listener name. The updated URL should look like this:

  db.url=jdbc:sqlserver://<YOUR_AG_LISTENER_NAME>:<PORT>;databaseName=ssc_db;multiSubnetFailover=true;
  

  The multiSubnetFailover=true parameter is critical—it tells the JDBC driver to handle cross-subnet failovers efficiently, which is common in most Always On setups.

• Confirm database authentication consistency
  Make sure the database user specified in db.username has identical permissions across all replicas in the Availability Group. It's strongly recommended to use SQL Server authentication instead of Windows authentication here, as Windows auth can introduce cross-node permission issues during failovers.

• Tune connection pool settings (optional but recommended)
  To help SSC handle failovers smoothly, adjust these connection pool parameters in ssc.properties:

  • db.maxConnections: Increase this value if you have a high-traffic SSC instance, to avoid connection shortages right after a failover.
  • db.connectionTimeout: Shorten this (e.g., to 30000 milliseconds) so the driver doesn't wait too long for a failed connection before attempting to reconnect.

• Test failover functionality
  Manually trigger a failover in your MSSQL Always On group to switch to a secondary replica, then verify Fortify SSC automatically reconnects to the new primary without service interruptions. You can check this by accessing the SSC UI, running a scan import, or reviewing SSC logs for connection errors.

额外注意事项 #

• Ensure all replicas in your Always On group have identical MSSQL versions, collation settings, and database permissions—mismatches can cause unexpected failover failures.
• Even with Always On enabled, don't skip regular database backups. Availability Groups handle redundancy, but backups are still your critical safety net for disaster recovery.
• If you're running a clustered Fortify SSC deployment (multiple SSC nodes), make sure all nodes use the same updated ssc.properties configuration to maintain consistency across the cluster.

备注：内容来源于stack exchange，提问作者Shahab Ali