Sql-server – Lock pages in memory for system accounts

memoryoraclesql server

Yes, well where to start? If you really enjoy installing and fine-tuning Microsoft SQL Server or Oracle RDBMS instances on Microsoft Windows Server, then at some point you will all come across the recommendation to "….lock pages in memory.".

Lock Pages in Memory

Here are the links to the relevant documents for your convenience and the steps described for Oracle RDBMS and Microsot SQL Server.

Microsoft SQL Server 2017

  1. On the Start menu, click Run. In the Open box, type gpedit.msc.

  2. On the Local Group Policy Editor console, expand Computer Configuration, and then expand Windows Settings.

  3. Expand Security Settings, and then expand Local Policies.

  4. Select the User Rights Assignment folder.

    The policies will be displayed in the details pane.

  5. In the pane, double-click Lock pages in memory.

  6. In the Local Security Setting – Lock pages in memory dialog box, click Add User or Group.

  7. In the Select Users, Service Accounts, or Groups dialog box, select the SQL Server Service account.

  8. Restart the SQL Server Service for this setting to take effect.

Oracle RDBMS 18c

  1. From the Start menu, select Control Panel.
    The Control Panel window opens.

  2. Double-click Administrative Tools.
    The Administrative Tools window opens.

  3. Double-click Local Security Policy.
    The Local Security Policy window opens.

  4. In the left pane of the Local Security Policy window, expand Local Policies and select User Rights Assignment.

  5. In the right pane of the Local Security Policy window, double-click Lock pages in memory.
    The Lock pages in memory Properties window opens.

  6. Click Add User or Group.
    The Select Users, Computers, Service Accounts, or Groups dialog box opens.

  7. Enter Oracle Home User name in Enter the object names to select field and click Check Names.

  8. Click OK to close the Select Users, Computers, Service Accounts, or Groups dialog box.
  9. Click OK to close the Lock pages in memory Properties window.

Further reading

The document How to enable the "locked pages" feature in SQL Server 2012 (Microsoft Support) states:

(emphasis mine)

Windows-based applications can use Windows AWE (Address Windowing Extensions) APIs to allocate and to map physical memory into the process address space. Memory that is allocated by using this method is never paged out by the operating system and is locked down until the application explicitly frees it or exits. The application requires the "Lock Pages In Memory" user right (LPIM) to be granted for the application to be able to lock pages in memory.

The SQL Server 64-bit version uses "locked pages" to prevent the process working set (committed memory) from being paged out or trimmed by the operating system. The use of AWE APIs for memory management in 64-bit SQL Server is also frequently referred as "locked pages." You can enable the "locked pages" feature in SQL Server versions 2005, 2008, and 2008 R2 by using a combination of Windows user right, hotfix, and trace flags. The behavior is different, depending on the edition of SQL Server in these versions.

But

Apparently this is not required to be set if the service account is Local System.

Some who attended one of my talks at the recent PASS conference asked me the following question "Do I need to use the Group Policy Editor to assign the Lock Pages in Memory privilege if my SQL Server Service is running under the Local System Account?". The answer to this question is no and here is why. First let me explain, how this works for 64bit systems:

…[long explanation]

So after all of this (but I hope you found the details helpful) back to the original question and my conclusion. The Local System account has the 'lock pages in memory' privilege by default. For user accounts, you must grant the account this privilege explicitly.

Bob Ward, Microsoft

Reference: Do I have to assign the Lock Pages in Memory privilege for Local System? (Microsoft | Develop | CSS SQL Server Engineers)

Questions

  1. Seeing as the Microsoft Server (the LOCAL SYSTEM?) will reclaim memory, if the OS comes under pressure, will SQL Server and/or Oracle (have to) release memory to the system, because the service is running under LOCAL SYSTEM account, even though the Lock Pages In Memory is implicitly set?

If the answer to the 1. question is:
No, the services will not release memory, then my next question is:

  1. Is this because the SQL Server OS / Oracle OS has requested that the pages be kept in memory and the LOCAL SYSTEM will accept this request?

If the answer to the 1. question is:
Yes, the services will release memory, then my next question is:

  1. To explicitly Lock Pages in Memory is it better to run the services with Windows Accounts and grant them the Lock Pages in Memory privilege, so that the memory will be really locked?

Best Answer

[With LPIM] will SQL Server [...] releasememory to the system

Yes. SQL Server listens for a low memory notification from Windows and voluntarilly trims its caches in response. This process, being voluntary and asynchronous, does not guarantee that other processes won't have failed memory allocations. See Memory Management Architecture.

is it better to run the services with Windows Accounts and grant them the Lock Pages in Memory

This behavior does not depend on how the Service acquires the LPIM privilege, and for a host of other reasons you shouldn't use LOCAL SYSTEM as your SQL Server service account.