> For the complete documentation index, see [llms.txt](https://help.security.gallagher.com/knowledge-hub/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.security.gallagher.com/knowledge-hub/products/cc-software/configure/databases-an-overview-of-command-centr.md). # Databases (SQL) {% hint style="info" %} Command Centre stores its data in two SQL Server databases. {% endhint %} *** ### Which SQL instance should the Command Centre databases use? Gallagher's recommendation is to attach the Command Centre databases to their **own SQL instance** (named `Gallagher` by convention, for example `SQLServerName\Gallagher`). It is possible to mix the Command Centre databases in with other databases in a single shared SQL instance, but this is neither recommended nor supported. Gallagher does not expect any other databases to be attached to the instance hosting Command Centre. *** ## Authentication and service accounts Which account does Command Centre use to connect to SQL, and how has that changed by version? ### CCFTSA account (legacy) `CCFTSA` was the SQL account the FT Command Centre service used to connect to the database. * The login name is `ccftsa`; its password is encrypted based on the site. * Gallagher stopped using `ccftsa` for sites with DB admin enabled in **7.30**. * **Pre-7.30:** Command Centre connects to the Gallagher instance using SQL authentication and the `CCFTSA` account. * **7.30 and later:** connects to the SQL instance using the Windows account the FT Command Centre service is configured to log on as. * **7.70+:** uses Windows authentication only. ### What rights does the Command Centre service account need? When installing or upgrading Command Centre on a server, the Windows user account should have **local admin** rights to the server and **sysadmin** rights to the SQL server. This lets the Command Centre service be granted elevated rights during install or upgrade, then have them removed afterward so the account holds only the minimum required to operate, which gives higher overall security. ### How to change the Command Centre service account? The Command Centre service account needs rights to both `CCFTCentral` and `CCFTEvent`. Give it **`db_owner`**. Procedure in SQL Server Management Studio (SSMS): 1. Go to the **Security** folder, expand it, right-click **Logins** (you can first check whether the login already exists by expanding Logins), then click **New Login**. ![SSMS New Login dialog under Security > Logins](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-82d9ca488cc141a1e270b2afd9536e82b9a6c911%2FSECHUB-CCS-SQL-OVERVIEW-ssms-new-login.png?alt=media) 2. In the new window, go to **User Mappings**. ![SSMS Login Properties User Mappings tab](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-826f670052ae1bc9243dd96a2b78e14028109201%2FSECHUB-CCS-SQL-OVERVIEW-ssms-user-mappings.png?alt=media) 3. Individually add `db_owner` to both `CCFTCentral` and `CCFTEvent`. At the end, select each database to confirm the privilege was added correctly. ![SSMS User Mappings showing db\_owner granted on both CCFTCentral and CCFTEvent](https://328339335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bM8WhlBE9BYizPWJaPN%2Fuploads%2Fgit-blob-beee037c34c0f3209b89b040a40427922ae3be5c%2FSECHUB-CCS-SQL-OVERVIEW-ssms-db-owner.png?alt=media) *** ### Testing a SQL connection with SQLCMD How do you test a SQL connection, and what are the limits of a remote SQL server? `SQLCMD` is useful for diagnosing corrupt databases and checking connections: ``` SQLCMD -S .\gallagher Use ccftcentral -- or: Use ccftevent to check the event database Select * from singlevalues Go ``` An error message shows if there is a connection or database problem. *** ### Remote and shared SQL: support position and limitations From **7.70**, having `CCFTCentral` and `CCFTEvent` on a shared server is supported but not recommended. When the SQL server is remote, the following do not work: * Templates. * Backups initiated from the Command Centre Workstation. * Restoring a database from within Command Centre. * The `AttachDB`, `DetachDB`, and `BackupDB` utilities (they do not support SQL Server running on a separate computer). * Some customizations can have issues (rare). * The service account used by the FT Command Centre service needs local SQL admin rights (for example, sysadmin) to modify SQL Server memory in File Server > Properties. ### DBADMIN agreement (7.60 and below) > **Note:** The following is the content of the `DBADMIN=1` agreement for 7.60 and below. For Command Centre v7.70 or earlier: 1. The customer agrees not to modify any data or schemas in the Gallagher Command Centre databases by any method other than via the Gallagher Command Centre application. 2. The customer should provide appropriate measures to ensure adequate levels of data security. 3. The customer should manage database backups, both scheduled and manual, and monitor and maintain database transaction log files. 4. The customer accepts full responsibility for any data loss or corruption associated with unauthorized modification of data or schemas within the Gallagher system. 5. Gallagher Group Ltd can no longer guarantee the integrity of the event data. If the event data is required for legal purposes, Gallagher will be unable to verify that the data has not been altered by an unauthorized method or software outside the Gallagher Command Centre application. 6. Adding indexes is not recommended. Maintaining existing indexes is fine. ### Pointing Command Centre at a remote SQL server (registry) Change the registry string on the Command Centre server to point to the new SQL server and instance name, for example `SQLServerName\Gallagher`. When installed locally, the Command Centre service account has a dependency on the SQL server: Command Centre will not start if the local SQL service is not running, even when the registry points to a remote SQL. An uninstall/re-install removes the dependency if a remote SQL is specified during install. Registry keys to edit: * **32-bit OS:** * `HKEY_LOCAL_MACHINE\SOFTWARE\Cardax\Command Centre key\DatabaseServerMachine` * `HKEY_LOCAL_MACHINE\SOFTWARE\Cardax\Command Centre key\EventDatabaseServer` * **64-bit OS:** * `HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Cardax\Command Centre FT\DatabaseServerMachine` * `HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Cardax\Command Centre FT\EventDatabaseService` *** 🔗 **Related** * [Databases - Structure](/knowledge-hub/products/cc-software/configure/databases-an-overview-of-command-centr/databases-structure.md). What `CCFTCentral` and `CCFTEvent` contain and where they live. * [Databases - Encryption](/knowledge-hub/products/cc-software/configure/databases-an-overview-of-command-centr/databases-encryption.md). Which fields are encrypted in the database. * [Databases - SQL Collation](/knowledge-hub/products/cc-software/configure/databases-an-overview-of-command-centr/databases-sql-collation.md). Why the collation must not be changed. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://help.security.gallagher.com/knowledge-hub/products/cc-software/configure/databases-an-overview-of-command-centr.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.