IBM Guardium

IBM Guardium

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Installing STAP Agent in Windows 2019

    Posted 11/09/20 06:47 PM
    We had to install Guardium 10.6.0.260 STAP on a Windows 2019 Machine because 10.5 was not supported. However, after install we cannot see it from the Collector that is still at 10.5.

    Is there any way of using the 10.6 agent?


    ------------------------------
    Joao Goncalves
    Pyxis, Lda.
    Sintra
    +351 91 721 4994
    ------------------------------


  • 2.  RE: Installing STAP Agent in Windows 2019

    Posted 11/10/20 07:25 AM
    Hi Joao,

    Can I guess that you tried to upgrade Win S-TAP V10.5 to V10.6.0.260 on your Windows 2019 machine?
    Did you do it via GIM or standalone installer?
    Did the installation complete successfully?
    Did you find any error in the installer log? (It's C:\IBM Windows S-TAP.ctl by default.)
    Is the Win S-TAP up and running? Run "tasklist /svc | findstr Guardium_Stapr.exe" to see if the service is running.
    Is the Win S-TAP connecting to the target collector? You will get the process ID of Windows S-TAP by issuing the above command, and run "netstat -aon | findstr <PID>" to see where your S-TAP is connecting.
    If Win S-TAP is not running properly, please try to restart Win S-TAP and check Stap.ctl (It's under "C:\Program Files\IBM\Windows S-TAP\Logs" by default) to see if there is any error.

    All the above information is gathered in Windows S-TAP Must Gather. If it's difficult for you to troubleshoot by yourself, please open a support ticket and send Windows S-TAP Must Gather.

    Please refer to the following blogs to know more about Windows S-TAP Must Gather.

    Overview of Windows S-TAP Must Gather V2
    https://community.ibm.com/community/user/security/blogs/satoshi-kawase1/2020/06/17/overview-of-windows-s-tap-must-gather-v2

    Files Collected by Windows S-TAP Must Gather V2
    https://community.ibm.com/community/user/security/blogs/satoshi-kawase1/2020/06/22/files-collected-by-windows-s-tap-must-gather-v2

    Reading Basic Environment Information from Windows S-TAP Must Gather
    https://community.ibm.com/community/user/security/blogs/satoshi-kawase1/2020/06/29/reading-basic-environment-info-windows-s-tap

    Thanks!
    Satoshi

    ------------------------------
    SATOSHI KAWASE
    ------------------------------



  • 3.  RE: Installing STAP Agent in Windows 2019

    Posted 11/11/20 03:08 PM
    The STAP agent is started and connected to the Collector

    KScdL@2$V0001.000100000000000002D60000000002800000
    `I 11/11/2020 18:08:47.393 Startup: 
    `I 11/11/2020 18:08:47.393 Startup: 
    `I 11/11/2020 18:08:47.393 Startup: 
    `I 11/11/2020 18:08:47.393 Startup: The STAP service version 10.6.0.260 (V10.6.0.Latest) has started...
    `I 11/11/2020 18:08:53.549 Services: Started the Guardium Database Monitor service
    `I 11/11/2020 18:08:53.815 Wfp: Connected to driver
    `I 11/11/2020 18:08:54.033 Nmp: Connected to driver
    `I 11/11/2020 18:08:55.174 Tcp: Connected to collector 192.168.1.75
    `I 11/11/2020 18:08:55.174 Services: Stopped the StapAT service
    `I 11/11/2020 18:08:55.205 Wfp: Sniffer activated
    `I 11/11/2020 18:08:55.205 Nmp: Sniffer activated

    C:\Users\student>netstat -aon | findstr 6572
     TCP 192.168.1.99:49770 192.168.1.75:9500 ESTABLISHED 6572

    However, it is not visible from the Collector. 



    The client has GIM 10.5 and STAP 10.6 installed and the collector is 10.5.

    Is this the usual behaviour or can we expect that a 10.5 collector is able to use a 10.6 STAP agent (even with some limitations)?
    Is there any configuration that we must use to make a 10.6 Agent coexist with a 10.5 collector?

    ------------------------------
    Joao Goncalves
    Pyxis, Lda.
    Sintra
    +351 91 721 4994
    ------------------------------

    Original Message


  • 4.  RE: Installing STAP Agent in Windows 2019

    Posted 11/12/20 02:22 AM

    Hi Joao,

    It seems the Win S-TAP is up and running, and connecting to the collector.
    I'm not a collector side guy, but I guess you're seeing "Enterprise S-TAP View" on managed unit or standalone collector because I can see "Not a Manager" in the screen shot. Can you open "S-TAP Control" to see if the S-TAP is listed?
    If not, I'd strongly suggest to open a support ticket. I'm not expecting you to attach any diagnostic information in this forum because it may contain PII.

    Thanks,
    Satoshi



    ------------------------------
    SATOSHI KAWASE
    ------------------------------

    Original Message


Related Content