If you're using A-TAP in your Guardium Data Protection environment, we have some exciting news that is going to make your life a whole lot easier. But first, let's talk about what A-TAP is and why this new update matters so much.
Recap: What is A-TAP?
If you're already familiar with A-TAP, feel free to skip ahead to the What's New in GDP 12.2: A-TAP Live Upgrades section.
In Guardium Data Protection (GDP), S-TAP agents monitor databases using a kernel-level component called K-TAP. However, when database traffic is encrypted, K-TAP cannot see through it.
A-TAP (Application-level TAP) is an application-level tap that operates inside the database server process space, allowing Guardium to monitor traffic that cannot be captured at the kernel level — such as encrypted traffic inside shared memory or inter-process communications. Where S-TAP uses K-TAP to monitor network traffic, A-TAP works above the kernel, capturing unencrypted data at the application layer before it becomes encrypted.
How It Works:
- A-TAP attaches to the database server's internal communication paths
- It captures SQL statements and session details before encryption occurs
- It forwards that data to K-TAP, which then sends it on to S-TAP and ultimately the Guardium Collector
What's New in GDP 12.2: A-TAP Live Upgrades
In previous versions of Guardium, upgrading S-TAP required deactivating A-TAP and restarting databases. For organizations monitoring many database instances with A-TAP, this meant coordinating maintenance windows and managing downtime.
Here's the game changer: Starting with GDP version 12.2 (S-TAP version 12.2 and above), A-TAP live upgrade is now supported.
You do NOT need to deactivate A-TAP before upgrading S-TAP anymore.
What This Means for You
No more database restarts during S-TAP upgrades. When you upgrade S-TAP from version 12.2 onwards, your databases can keep running. Your A-TAP monitoring stays active. Your applications stay online.
This is a major improvement for anyone using S-TAP with A-TAP, and it applies to:
- All supported A-TAP databases
- All new 12.2.x releases going forward
Even Better: Instance Discovery with Active A-TAP (12.2.1+)
The improvements don't stop there. Starting with S-TAP version 12.2.1, instance discovery is also supported with A-TAP active.
In practical terms, this means:
- Your database is running
- A-TAP is active and monitoring
- You run auto-discovery
- The db_exec_file of the discovered instance will reflect correctly
What You Need to Know
If You're Already on GDP 12.2+
Congratulations! You can already take advantage of A-TAP live upgrades. Your next S-TAP upgrade will be significantly smoother.
If You're on an Earlier Version
This is a compelling reason to plan your upgrade to GDP 12.2. Beyond A-TAP live upgrades, GDP 12.2.x ships with many other new capabilities that enhance your data protection posture.
Important Note
While A-TAP live upgrades eliminate the need for database restarts during S-TAP upgrades, initial A-TAP configuration still requires coordination with database and system administrators.
The Bottom Line
GDP 12.2 takes A-TAP to the next level. With live upgrades, you get all the monitoring benefits without the operational complexity—no database restarts, no A-TAP deactivation during S-TAP upgrades.
If you're using A-TAP, upgrade to GDP 12.2 to take advantage of these improvements.
Other Monitoring Options
S-TAP with A-TAP is not the only option for monitoring encrypted database traffic. IBM suggests using STAP with EXIT library for whenever is available. Other than that, depending on your database type and environment, also consider Agentless Universal Connectors, External S-TAP, or Cloud Streaming. The new live upgrade capability in GDP 12.2 makes STAP with A-TAP significantly more attractive for many on-premise or IaaS use cases.
For detailed information about GDP 12.2 features and upgrade procedures, refer to the IBM Guardium Data Protection documentation.