Permissions and what is read

SQLTreeo Job Timeline is read-only by design. It sends only SELECT statements to a server and installs nothing on it. This article lists what is read, which permissions that takes, and what stays on your computer.

What it never does

• It does not start, stop, enable, disable or change jobs, schedules or anything else on a server.
• It creates no objects on a server: no tables, no procedures, no jobs.
• It sends no alerts and it is not a monitoring service. It reads while it is open on your computer.
• It does not transfer the command text of job steps.

What is read

What	Read from	Details
Instance	Server properties	Name, version, edition, whether Always On is enabled, the server clock, its UTC offset and the time zones that match it
Jobs	sysjobs, syscategories	Name, enabled state, description, category, owner, creation and modification date
Steps	sysjobsteps	Step number and name, subsystem, database, and the kind of work the step does
Schedules	sysjobschedules, sysschedules	Frequency, active dates and times, next run
History	sysjobhistory	Per run and per step: outcome, start, duration, retries, severity, the server that executed it, and the message
Running jobs	sysjobactivity, syssessions	The jobs of the current Agent session that have started and not finished
Availability groups	sys.availability_groups and related views	Group name and id, whether the group is contained, the role of this replica, the databases in the group, the listener names

The tables are those in msdb.dbo. The jobs of a contained availability group are read with the same queries from the group’s own msdb, see Jobs in availability groups.

Steps are classified on the server. Whether a step is a full or log backup, index maintenance, an integrity check, a statistics update, or decides by itself on which replica it works, is determined inside the query with LIKE on the command. Only the yes or no answers are returned. The command text stays on the server.

History is read incrementally. The first read takes the history of the period set under Settings → Reading the server (90 days by default). Later reads take only the rows added since the previous read. Messages of successful steps are not transferred.

The connection goes to master with the application name SQLTreeo Job Timeline, so you can recognize it in sys.dm_exec_sessions. It does not ask for read-only routing.

By default a light read (clock, availability group roles, running jobs) runs every 30 seconds and a full read (jobs, schedules, new history rows) every 10 minutes.

Some queries run only when you ask for them: Test connection, the sources in Add many servers, and the probe of the diagnostics report. These are SELECT statements as well.

Permissions

Permission	Needed for	Without it
db_datareader in msdb	Everything: jobs, steps, schedules, history and running jobs	Nothing can be shown. Test connection reports that the login cannot read msdb.dbo.sysjobhistory
VIEW SERVER STATE	The role of this replica in each availability group	The application works, and the role shows as unknown
VIEW ANY DEFINITION	Seeing the availability groups at all: names, databases, listeners	The groups are hidden from the login. Jobs of contained availability groups are not read from this server, instance jobs are not linked to their group, and roles are unknown. A note on the server says so
msdb role ServerGroupReaderRole on a Central Management Server	Only the Management server source in Add many servers	That source cannot read the registered servers

On an instance without availability groups, db_datareader in msdb is all that is needed. On SQL Server 2022 and later, grant VIEW SERVER STATE (or VIEW SERVER PERFORMANCE STATE) together with VIEW ANY DEFINITION to make the groups visible. The script below grants both.

db_datareader is the simple way to give the read access. What the queries need is SELECT on eight tables in msdb: sysjobs, syscategories, sysjobsteps, sysjobschedules, sysschedules, sysjobhistory, sysjobactivity and syssessions.

SQLAgentReaderRole alone is not enough. That role gives access to the Agent stored procedures such as sp_help_job. SQLTreeo Job Timeline calls no procedures: it reads the job tables with SELECT, and the role does not grant that.

A dedicated login

A sysadmin login works, and it is more than the application needs. A login of its own with exactly the permissions above is safer. Run this on every instance, with a name and password of your choice:

USE master;
CREATE LOGIN [jobtimeline_reader] WITH PASSWORD = N'<a strong password>';

-- Availability groups: the role of this replica
GRANT VIEW SERVER STATE TO [jobtimeline_reader];
-- Availability groups: see the groups, their databases and listeners
GRANT VIEW ANY DEFINITION TO [jobtimeline_reader];

USE msdb;
CREATE USER [jobtimeline_reader] FOR LOGIN [jobtimeline_reader];
ALTER ROLE db_datareader ADD MEMBER [jobtimeline_reader];

• For Windows authentication, create the login for an account or a group instead: CREATE LOGIN [CORP\DBA-Readers] FROM WINDOWS; and use that name in the other statements.
• On an instance without availability groups, leave the two GRANT statements out.
• On the replicas of an availability group, create the login on every replica: msdb is not part of the group.
• Jobs that live inside a contained availability group are in the group’s own msdb, the database <group name>_msdb. The login must be able to open that database and read the same tables there. When it cannot, the server shows a note that the group’s msdb is not readable on this replica.

What stays on your computer

What	Where
Settings, the server list with its groups, saved connections	%APPDATA%\JobTimeline\settings.json
Trial and license key	%APPDATA%\JobTimeline\license.json
A record of when the trial ends	The registry of your Windows account, HKEY_CURRENT_USER\Software\SQLTreeo\JobTimeline
The history archive	%LOCALAPPDATA%\SQLTreeo\JobTimeline\history, one compressed file per instance or contained availability group

• A password is saved only when you tick Remember password. It is encrypted with Windows Data Protection for your Windows user account. Saved passwords are never shown, never loaded back into a password box, and never written to a log, an export or the diagnostics report.
• The history archive is kept per Windows user on this computer. It is not shared between users or computers. What it holds is described in Job history, baselines and long runs.
• The export of the server list holds names and groups only.
• The diagnostics report is created only when you ask for it, and it leaves your computer only if you send it.

Settings → Connections opens the settings folder and can clear every saved connection.

What contacts the internet

• The license check. When a license key is entered, the application verifies it with the SQLTreeo license service: at startup and when you press Verify and activate. It sends the key, the computer name, the name of the licensee and the application version; the license service also sees the IP address of the connection. During the trial, without a key, nothing is sent.
• The update check. The installed application reads the list of releases from the SQLTreeo Job Timeline release feed on GitHub, at startup and periodically while it runs. You can switch it off under Settings → Updates.

Buttons such as Buy a license and Website open a page in your browser. With Microsoft Entra ID authentication, the sign-in itself goes through Microsoft, as in SSMS.

No job definitions, job history, server names, connection details or passwords are sent to SQLTreeo. The full statement is in the license agreement.