Question about SQL Express 2012 end of life

[BFost]

Hi, I just installed Veeam Agent for Windows version 5, and noticed that SQL Express 2012 localdb was installed with it. I have been trying to get rid of SQL Express 2012 from my environment because of security scans looking for end of life software. I have heard that SQL Express 2012 goes end of life in July 2022. At this point will it be possible to upgrade it? Thanks.

[Gostev]

Hi, I'm not sure about upgrade possibility. But the next version of Veeam Agent for Windows will not use LocalDB at all. Thanks!

[BFost]

Thanks, I appreciate it.

[SigHunter]

Hi, I'm not sure about upgrade possibility. But the next version of Veeam Agent for Windows will not use LocalDB at all. Thanks!

can you please elaborate on that?

[Gostev]

Not much to expand here really... it will be like all other Veeam Agents (for Linux/Mac/AIX/Solaris) which also do not use LocalDB.

[BFost]

Hi, I wanted to check to see if there was any update on this. The most recent Veeam Agent for Windows Free on the website is 5.0.3, and it still requires Microsoft SQL Server 2012 SP4 Express LocalDB Edition. I believe this will not receive security patches after July 12, 2022. Is there any new info on this? Vulnerability management scanners don't like to see end of life software. Thanks!

https://docs.microsoft.com/en-us/lifecy ... of-support

[Gostev]

Extended Security Updates will still be provided for SQL Server 2012 through July 8, 2025.

Alternatively, keep in mind you can always switch to using "managed by server" agent-based backup job type in Veeam Backup & Replication for protecting your physical machines. This job type doesn't deploy full blown agent with LocalDB.

[BFost]

Thanks, I appreciate it.

[JPMS]

Hi, I'm not sure about upgrade possibility. But the next version of Veeam Agent for Windows will not use LocalDB at all. Thanks!

Do you know if this is likely to be released before SQL Express 2012 goes EOL.

We recommend Veeam Agent for Windows to friends and colleagues for their stand alone use (like home PCs). "Managed by server" and ESU are not an option.

[Gostev]

No, definitely well after that.

[JPMS]

I appreciate it is offered as a free solution but I'm pretty disappointed in Veeam that they haven't addressed this prior to 2012 EOL. It's not like Microsoft don't publicise these dates far in advance. I appreciate that the non-database version may be a significant development but how hard would it have been to integrate a newer version of SQL Express?

Veeam surely understand the importance of using supported software. I feel I have given poor advice to others and it damages my, and their, confidence in Veeam products.

[Gostev]

It's not simple unfortunately and comes with very significant QC costs. So naturally we don't want to spend time on this, further delaying the new agent version that does not use SQL Express at all.

And no, actually we're not that worried about vendors officially supporting the 3rd party components we're using. In fact, the majority of the 3rd party components we use were NEVER officially supported by their author or vendor to start with, but rather provided "without support or warranties of any kind". Besides, some of those authors and vendors no longer exist even - and yet we're able to maintain the corresponding components and fix/patch them as needed. I guess the best example is those older/unsupported VMware VDDK versions that we carry to be able to process the corresponding older/unsupported ESXi versions... somehow no one ever saw an issue with us using them (despite being officially unsupported) in the past 10 years.

In the end, what matters is that Veeam will support customers using our product regardless of the support status of its individual components. The only difference is that from July, in case of non-security issues with LocalDB we will be on our own and will have to patch them ourselves. Although the chances that the most stable 10 years old LocalDB code will suddenly break after July are near zero anyway.

[JPMS]

"The only difference is that from July, in case of non-security issues with LocalDB..."

I should have made my concerns clearer, I agree, SQL 2012 is unlikely to suddenly break but what happens if there is a security issue which MS no longer patch because the product is not supported?

[Gostev]

Security updates will still be provided by Microsoft, see my earlier post above.

[JPMS]

I did read your earlier post, "Extended Security Updates will still be provided for SQL Server 2012 through July 8, 2025." but those are only available as a purchasable option. Are you suggesting end users do that? Or are you saying that you subscribe to them and can include them in product updates?

[Gostev]

Actually, it was never possible to get SQL LocalDB updates for end users, whether security or regular, as it is excluded from Windows Update by Microsoft. It was always on us to include them into the next VAW build, so we would just continue doing so should they appear. Which is again quite unlikely after 10 years and considering that SQL LocalDB has no remote interfaces in principle (it can only be accessed locally).