Set up the Openflow Connector for SQL Server¶
Note
This connector is subject to the Snowflake Connector Terms.
This topic describes how to set up the Openflow Connector for SQL Server.
For information on the incremental load process, see Incremental replication.
Prerequisites¶
Before setting up the connector, ensure that you have completed the following prerequisites:
-
Ensure that you have reviewed About Openflow Connector for SQL Server.
-
Ensure that you have reviewed Supported SQL Server versions.
-
Ensure that you have set up your runtime deployment. For more information, see the following topics:
-
If you use Openflow - Snowflake Deployments, ensure that you have reviewed configuring required domains and have granted access to the required domains for the SQL Server connector.
Set up your SQL Server instance¶
Before setting up the connector, perform the following tasks in your SQL Server environment:
Note
You must perform these tasks as a database administrator.
-
Enable change tracking on the databases and tables that you plan to replicate, as shown in the following SQL Server example:
Note
Run the
ALTER DATABASEcommand only once per database to enable change tracking on that database. Run theALTER TABLEcommand for every table that you plan to replicate in that database.Important
Keep the column tracking feature off by setting
TRACK_COLUMNS_UPDATED = OFF(the default) when you enable change tracking on a table. The connector doesn’t use column-level change information, so enablingTRACK_COLUMNS_UPDATED = ONadds unnecessary storage and per-DML overhead on the source without providing any benefit to replication.Each table must have change tracking enabled before the connector can replicate it. Enable change tracking on every table you want to replicate before you start replication.
Important
Set
CHANGE_RETENTIONto a window that’s long enough to keep change data available for data continuity. SQL Server removes tracked changes once they’re older than the retention period, so if the connector can’t read changes before they expire, it can’t replicate them incrementally and the affected tables require a full reload.A longer retention window, such as 5 days, gives you time to detect and react to problems, such as a paused connector, a network outage, or a failed replication cycle, and to mitigate them without reloading entire tables. Choose a value that covers the longest interruption you expect to recover from, balanced against the additional storage that retained change data consumes in SQL Server.
-
Create a login for the SQL Server instance:
This login is used to create users for the databases you plan to replicate.
-
Create a user for each database you are replicating by running the following SQL Server command in each database:
-
Grant the SELECT and VIEW CHANGE TRACKING permissions to the user for each database that you are replicating:
Run these commands in each database for every table that you plan to replicate. These permissions must be granted to the user of each database that you created in a previous step.
-
(Optional) Grant the VIEW DEFINITION privilege on the User Defined Data Types (UDDT).
If your tables contain columns that use User Defined Data Types (UDDT), and the UDDT is owned by a different user than the connector user, you must grant the VIEW DEFINITION permission to the connector user as shown in the following SQL Server example:
Without this permission, columns using UDDT are silently excluded from replication.
-
(Optional) Configure SSL connection.
If you use an SSL connection to connect to SQL Server, create the root certificate for your database server. This is required when configuring the connector.
Set up your Snowflake environment¶
As an Openflow administrator, perform the following tasks for this connector. With the
default SNOWFLAKE_MANAGED authentication strategy, the runtime’s execute-as role is the identity
the connector uses to access Snowflake, so you grant these privileges to that role rather than
creating a separate service user.
-
Create a database to store the replicated data, and grant the execute-as role USAGE and CREATE SCHEMA on it. The connector creates destination schemas automatically. Snowflake recommends a dedicated destination database per connector, to avoid collisions with other data sources including other connectors.
Keep this destination database separate from the database that holds your Openflow infrastructure objects, such as the runtime, the connector, and any secrets. A connector creates destination objects based on the source schema and table names, so those names aren’t under your control and can change as the source changes.
-
Designate a warehouse for the connector to use, and grant the execute-as role USAGE and OPERATE on it. Start with the
XSMALLwarehouse size, then experiment with size depending on the number of tables being replicated, and the amount of data transferred. Large table numbers typically scale better with multi-cluster warehouses, rather than the warehouse size. -
Snowflake deployments only: Make sure this connector’s source host and port are permitted by a network rule that your runtime’s external access integration (EAI) allows.
The EAI itself belongs to the runtime, not to this connector. You create it once, attach it to the runtime, and grant the execute-as role
USAGEon it. For those steps, see Creating network rules and external access integrations. What is specific to this connector is getting its source host into a rule that EAI references.The rule takes the source’s host and port as a single value, such as
db.example.com:<port>. That’s the host and port from the connector’s connection URL, without thejdbc:scheme, the driver name, or the database path.BYOC deployments handle outbound connectivity in the cloud environment and don’t use EAIs or network rules.
For additional setup when you use key-pair authentication with BYOC:
Key-pair authentication is available only for BYOC deployments, and is not required for the
default SNOWFLAKE_MANAGED authentication strategy. Skip this section unless you set the
connector’s Snowflake Authentication Strategy parameter to KEY_PAIR.
-
Create a Snowflake user with the type as SERVICE, create a role for it, and grant that role the same destination database and warehouse privileges you granted the execute-as role:
-
Create a pair of secure keys (public and private). Store the private key for the user in a file to supply to the connector’s configuration. Assign the public key to the Snowflake service user:
For more information, see pair of keys.
When using KEY_PAIR, you must also set the connector’s Snowflake Account Identifier and
Snowflake Connection Strategy parameters. Both are left blank or ignored under
SNOWFLAKE_MANAGED.
Install the connector¶
To install the connector, do the following as a data engineer:
-
Navigate to the Connector library tab in Openflow.
-
On the Openflow connectors page, find the connector and select Install.
-
In the Select runtime dialog, select your runtime from the Available runtimes drop-down list and click Install.
Note
Before you install the connector, ensure that you have created a database and schema in Snowflake for the connector to store ingested data.
-
Authenticate to the deployment with your Snowflake account credentials and select Allow when prompted to allow the runtime application to access your Snowflake account. The connector installation process takes a few minutes to complete.
-
Authenticate to the runtime with your Snowflake account credentials.
The Openflow canvas appears with the connector process group added to it.
Runtime sizing¶
For sizing guidance, including node type tiers and how to resize after creation, see Runtime sizing and packing for CDC connectors.
For migration instructions, see Reinstall the connector.
Configure the connector¶
To configure the connector, do the following as a data engineer:
-
Right-click on the imported process group and select Parameters.
-
Populate the required parameter values.
For more information on the required parameter values, see the following sections:
- SQLServer Source Parameters: Used to establish a connection with SQL Server.
- SQLServer Destination Parameters: Used to establish a connection with Snowflake.
- SQLServer Ingestion Parameters: Used to specify the tables to replicate.
Start by setting the parameters of the SQLServer Source Parameters context, then the SQLServer Destination Parameters context. After you complete this, enable the connector. The connector connects to both SQLServer and Snowflake and starts running. However, the connector doesn’t replicate any data until any tables to be replicated are explicitly added to its configuration.
To configure specific tables for replication, edit the SQLServer Ingestion Parameters context. After you apply the changes to the SQLServer Ingestion Parameters context, the configuration is picked up by the connector, and the replication lifecycle starts for every table.
To run multiple CDC connector instances on one runtime, see .
SQLServer Source Parameters¶
| Parameter | Description |
|---|---|
| SQLServer Connection URL | The full JDBC URL used to connect to the source. For a standalone SQL Server instance or Azure SQL Managed Instance, point the URL at the instance. The connector discovers the databases to replicate from that instance.
For Always On Availability Groups, see Always On Availability Groups. For Azure SQL Database, point the URL at a specific database using the
|
| SQLServer JDBC Driver | Select the Reference asset checkbox to upload the SQL Server JDBC driver. |
| SQLServer Username | The username for the connector. |
| SQLServer Password | The password for the connector. |
| SQLServer Query Interval | The minimum time interval that must elapse before scheduling the next query for table changes. This controls the frequency of database polling during incremental replication to prevent excessive querying. Default: |
Note
To connect with Windows authentication using NTLMv2, configure the SQL Server source parameters as follows:
- SQLServer Connection URL:
jdbc:sqlserver://<host>:1433;databaseName=<db>;integratedSecurity=true;authenticationScheme=NTLM;domain=<domain>; - SQLServer JDBC Driver: Upload the
mssql-jdbcJAR. The driver class name iscom.microsoft.sqlserver.jdbc.SQLServerDriver. - SQLServer Username: Enter the domain user.
- SQLServer Password: Enter the domain password.
Note
Azure SQL Database refers to the single-database PaaS offering, not Azure SQL Managed Instance.
Always On Availability Groups¶
Configure the connector to connect through the availability group listener (the virtual network name for the group), not through an individual replica node. Set the listener hostname in the SQLServer Connection URL parameter in the SQLServer Source Parameters context.
Always On Availability Groups provide high availability through a shared listener and automatic failover between replicas. Always On Availability Groups are separate from SQL Server transactional replication.
Warning
Do not change the connection target after replication has started. Each database maintains its own replication position independently, so switching to a different server or listener can cause the connector to lose track of which changes have already been processed. This might result in data loss.
For failover behavior, see Always On Availability Groups and source failover.
SQLServer Destination Parameters¶
| Parameter | Description | Required |
|---|---|---|
| Destination Database | The database where data is persisted. It must already exist in Snowflake. The name is case-sensitive. For unquoted identifiers, provide the name in uppercase. | Yes |
| Destination Schema Pattern | A pattern for the names of destination schemas where data is persisted. The connector creates the schemas if they don’t exist. You can customize the pattern per ingested table using these optional variables:
For example, for a table with the qualified name To ingest all tables into a single schema, provide a schema name without any variables,
like Important Don’t change this setting after the connector has begun ingesting data. Changing this setting after ingestion has begun breaks the existing ingestion. If you must change this setting, create a new connector instance. | Yes |
| Snowflake Authentication Strategy | When using:
| Yes |
| Snowflake Account Identifier | When using:
| Yes |
| Snowflake Connection Strategy | When using KEY_PAIR, specify the strategy for connecting to Snowflake:
| Required for BYOC with KEY_PAIR only, otherwise ignored. |
| Snowflake Object Identifier Resolution | Specifies how source object identifiers such as schemas, tables, and column names are stored and queried in Snowflake. This setting dictates whether you must use double quotes in SQL queries. Option 1: Default, case-insensitive (recommended).
For example, Note Snowflake recommends using this option if database objects are not expected to have mixed case names. Important Do not change this setting after connector ingestion has begun. Changing this setting after ingestion has begun breaks the existing ingestion. If you must change this setting, create a new connector instance. Option 2: Case-sensitive.
Note Snowflake recommends using this option if you must preserve source casing for legacy or compatibility reasons.
For example, the source database includes table names that differ in case only, such as | Yes |
| Snowflake Private Key | When using:
| No |
| Snowflake Private Key File | When using:
| No |
| Snowflake Private Key Password | When using:
| No |
| Snowflake Role | When using:
| Yes |
| Snowflake Username | When using:
| Yes |
| Oversized Value Strategy | Determines how the connector handles values that exceed its internal size limits (16 MB) during replication. Possible values are:
| No |
| Table Storage Format | Standard Snowflake tables or Iceberg tables. Defaults to STANDARD. Don’t change after the connector starts. | Yes |
| Iceberg Version | The Iceberg table version, 2 or 3 (default 3). Ignored unless Table Storage Format is ICEBERG. Don’t change this value after ingestion begins. | No |
| Snowflake Warehouse | Snowflake warehouse used to run queries. | Yes |
The following destination parameter controls how the connector handles invalid rows:
| Parameter | Description | Required |
|---|---|---|
| Error Handling Strategy | Determines how the connector handles invalid rows that Snowflake rejects during ingestion. Possible values are:
For more information, see Error handling for invalid rows. | No |
SQLServer Ingestion Parameters¶
| Parameter | Description |
|---|---|
| Column Filter JSON | Optional. A JSON array of filter objects specifying which columns to include or exclude per table. For syntax details and examples, see Replicate a subset of columns in a table. |
| Concurrent Select Queries For Incremental | Maximum number of concurrent SELECT queries to run against the source database during incremental replication. Default: 1, maximum: 8. Increasing this can speed up replication when many tables are active, but will also increase the load on the source database. |
| Concurrent Select Queries For Snapshot | Maximum number of concurrent queries to the source database to run in the Snapshot flow. Increasing this can speed up snapshotting large numbers of tables, but will also increase the load on the source database. |
| Included Table Names | A comma-separated list of source table paths, including their databases and schemas, for example:
|
| Included Table Regex | A regular expression to match against table paths, including database and schema names. Every path matching the expression is replicated, and new tables matching the pattern that are created later are also included automatically, for example:
|
| Ingestion Type | Controls whether newly added tables go through a full initial snapshot before switching to incremental replication, or skip straight to incremental replication. Set to |
| Max Batch Size | The maximum number of rows to fetch in a single batch. Default: 100000. |
| Merge Task Schedule CRON | CRON expression defining periods when merge operations from Journal to Destination Table will be
triggered. Set it to For example:
For additional information and examples, see the cron triggers tutorial in the Quartz Documentation. |
| Re-read Tables in State | Only applicable when Starting Change Tracking Position is
For more information, see Specify load from change tracking table position. |
| Re-snapshot Table Exclusions | A comma-separated list of fully qualified table names that should not be replicated, from among tables matching the included criteria. Use the same format and quoting rules as Included Table Names, for example: |
| SQL Server Read Timeout | Read timeout in milliseconds applied to both snapshot and incremental queries. A query that runs longer than this value is closed by SQL Server. Default: 60000. |
| Starting Change Tracking Position |
For more information, see Specify load from change tracking table position. |
Read the source under SNAPSHOT isolation¶
The connector reads the source tables during both snapshot and incremental replication. Under SQL Server’s default READ COMMITTED isolation level, these reads acquire shared locks that can deadlock with concurrent writes from other database clients. To avoid these deadlocks without affecting the isolation level that other applications use, configure the connector to read under SNAPSHOT isolation. For background, see Source database locking behavior.
Enable SNAPSHOT isolation for the connector in two steps:
-
On each source database, allow snapshot isolation:
-
Add a dynamic property named Use Snapshot Isolation with the value
trueto the connector’s processors. Because the connector reads the source tables during both snapshot and incremental replication, add this dynamic property to both theMultiDatabaseFetchTableSnapshotprocessor and theMultiDatabaseCaptureChangeSqlServerprocessor.
The connector checks each source database when it starts and uses SNAPSHOT isolation only for databases that
have ALLOW_SNAPSHOT_ISOLATION enabled. For a database that doesn’t have it enabled, the connector falls back
to the default isolation level. Because this check runs at startup, restart the processors after you change
ALLOW_SNAPSHOT_ISOLATION.
Caution
ALLOW_SNAPSHOT_ISOLATION only makes SNAPSHOT isolation available to sessions that explicitly request it, such
as the connector. It doesn’t change the default READ COMMITTED isolation level, so other applications that use
the source database are unaffected.
Don’t use READ_COMMITTED_SNAPSHOT (RCSI) for this purpose. Although RCSI also removes the shared locks, it
redefines the default READ COMMITTED isolation level for every connection to the database. Applications that
rely on the default lock-based READ COMMITTED behavior (for example, expecting readers to block on concurrent
uncommitted writes) can see different results after the change.
Replicate tables from a SQL Server replica server¶
The connector can ingest data from a primary server or from a subscriber server using transactional replication. Before configuring the connector to connect to a SQL Server replica, ensure that replication between the primary and replica nodes works correctly. For instructions on setting up transactional replication, see Tutorial: Configure transactional replication. When investigating issues with missing data in the connector, first ensure that missing rows and change tracking events are present in the replica server used by the connector.
Note
When using a replica server, the connector setup differs from the standard primary server configuration. The connection user and change tracking don’t need to be configured on the primary server. Instead, make sure that the connection user is available on the replica server and has access to the data and change tracking tables there.
To configure the connector to read from a subscriber server instead of the publisher, specify the subscriber server URL in the SQLServer Connection URL parameter.
Warning
Do not change the database server after replication has started. Each database maintains its own change tracking state independently, so switching to a different server would cause the connector to lose track of which changes have already been processed, and may result in data loss.
Replicate a subset of columns in a table¶
The connector can filter the data replicated per table to a subset of configured columns. Primary key columns are always included regardless of exclusions.
To apply column filters, set the Column Filter JSON parameter in the Ingestion Parameters context to a JSON array of filter objects, one per table you want to filter.
Columns can be included or excluded by name or by regular expression pattern. You can apply a single condition per table, or combine multiple conditions, with exclusions always taking precedence over inclusions.
Syntax¶
Each object in the array identifies a table and specifies which columns to include or exclude.
Because this connector uses three-part fully qualified names (database, schema, and table), each object
can include a database or databasePattern field in addition to the schema and table fields.
The following rules apply:
- Use
database,schema, andtablefor exact name matching, ordatabasePattern,schemaPattern, andtablePatternfor regex matching. You can’t use both a field and its pattern variant in the same object (for example,schemaandschemaPatterncan’t both appear). - At least one of
included,excluded,includedPattern, orexcludedPatternmust be provided. - When both included and excluded filters are specified, exclusions take precedence.
- When multiple filters match the same table, the last matching filter is used, with exact matches taking precedence over pattern-based filters.
- The value can be an array of objects to apply different filters to different tables.
Examples¶
Include specific columns by name:
Exclude specific columns by name:
Combine an include pattern with a specific exclusion (for example, include all email columns except admin_email):
Mix a database pattern with an exact schema and table name to apply a filter across databases:
Pass multiple filter objects to apply different rules to different tables:
Including and excluding the same column¶
Removing a column from a table’s replicated set (by excluding it or by removing
it from the included list) has the same effect on the destination as dropping
the column at the source: the connector soft-deletes the column on the
destination by renaming it with a suffix (by default, __SNOWFLAKE_DELETED).
If you then add the column back to the replicated set and later remove it a
second time, replication for the affected table fails because the soft-deleted
column name is already taken. To recover, restart replication for the affected
table.
Replicate a partitioned table¶
The connector supports replication of partitioned tables. A SQL Server partitioned table is replicated into Snowflake as a single destination table, containing data from all partitions.
To replicate a partitioned table, ensure that change tracking is enabled on the partitioned table, as described in Set up your SQL Server instance.
For more information about how the connector handles snapshots of large partitioned tables, see Snapshot of partitioned tables.
Track data changes in tables¶
The connector replicates the current state of data from the source tables, as well as detected changes from each polling interval. This data is stored in journal tables created in the same schema as the destination table.
Note
Because the connector uses SQL Server Change Tracking, multiple updates to the same row between polling intervals are rolled up into a single change. Journal tables reflect the net result of changes, not every intermediate state. For more information, see About Openflow Connector for SQL Server.
The journal table names are formatted as: <source_table_name>_JOURNAL_<timestamp>_<schema_generation>
where <timestamp> is the value of epoch seconds when the source table was added to replication, and <schema_generation> is an integer increasing with every schema change on the source table.
As a result, source tables that undergo schema changes will have multiple journal tables.
When you remove a table from replication, then add it back, the <timestamp> value changes, and <schema_generation> starts again from 1.
Important
Snowflake recommends not altering the structure of journal tables in any way. The connector uses them to update the destination table as part of the replication process.
The connector never drops journal tables, but uses the latest journal for every replicated source table, only reading append-only streams on top of journals. To reclaim the storage, you can:
- Truncate all journal tables at any time.
- Drop the journal tables related to source tables that were removed from replication.
- Drop all but the latest generation journal tables for actively replicated tables.
For example, if your connector is set to actively replicate source table orders,
and you have earlier removed table customers from replication, you may have
the following journal tables. In this case you can drop all of them except orders_5678_2.
Configure scheduling of merge tasks¶
The connector uses a warehouse to merge change data capture (CDC) data into destination tables. The processor named Merge Journal to Destination triggers this operation. When there are no new changes, or when no new FlowFiles are waiting in the Merge Journal to Destination queue, no merge is triggered and the warehouse is available for auto-suspension.
To limit warehouse cost and restrict merges to scheduled times, use the CRON expression in the Merge Task Schedule CRON parameter. It throttles the FlowFiles that reach the Merge Journal to Destination processor, so merges are triggered only during the specified period. The connector evaluates the schedule in the UTC time zone.
For additional information and examples, see the cron triggers tutorial in the Quartz Documentation.
Run the flow¶
- Right-click on the canvas and select Enable all Controller Services.
- Right-click on the imported process group and select Start. The connector starts the data ingestion.