C# 2.14 Update: SQL command collection off by default

As part of C# SDK 2.14 release updates, a new breaking change will be released to the public. To adhere to compliance and security standards, Microsoft Application Insights (.NET/.NET Core) SDKs will no longer collect SQL commands in any format, by default.

The change itself, will now align the behaviors of ASP.NET Core and ASP.NET SDKs.

Our earlier behavior looked as follows:

In case of ASP.NET Core customers, the SDK used to collect full SQL command by default.
In case of ASP.NET customers, the SDK used to collect full SQL commands by default only if you were using Microsoft.Data.SqlClient.

Our new behavior for both ASP.NET & ASP.NET Core customers will look as follows:

All customers using System.Data.SqlClient or Microsoft.Data.SqlClient will have to explicitly “opt_in” to collect SQL text. To enable the opt in behavior please refer to the section ‘How do I enable SQL Text collection?’ below. This change first introduced in our 2.14-Beta1 release will be available for general consumption in our stable April 2.14 SDK release.

FAQs

How do I delete any previous data?

Users who wish to delete any previous commands executed and stored in the past 30 days can use the purge command available here: https://docs.microsoft.com/en-us/rest/api/application-insights/components/purge

How do I enable SQL Text collection?

ASP.NET Core

Modify ConfigureServices() with the line below:

services.ConfigureTelemetryModule<DependencyTrackingTelemetryModule>((module, o) => { module. EnableSqlCommandTextInstrumentation = true; });

Doc: https://docs.microsoft.com/en-us/azure/azure-monitor/app/asp-net-core#configuring-or-removing-default-telemetrymodules

ASP.NET

Modify ApplicationInsights.config file to have this line.

<Add Type="Microsoft.ApplicationInsights.DependencyCollector.DependencyTrackingTelemetryModule, Microsoft.AI.DependencyCollector">, 
<EnableSqlCommandTextInstrumentation>true</EnableSqlCommandTextInstrumentation>
</Add>

For ASP.NET customers, the above alone is insufficient to collect SQL text, if using System.Data.SqlClient.

Additional platform-specific steps, documented below, should be followed.

https://docs.microsoft.com/en-us/azure/azure-monitor/app/asp-net-dependencies#advanced-sql-tracking-to-get-full-sql-query

microsoft / ApplicationInsights-Announcements