Hi all,
I just started to working with IBM Guardium. I has install IBM Guardium V11 on a Virtual Machine and active Base license, Advance Activity Monitoring, Data Protection and Vulnerability Assessment.

I install DB test using MySQL on CentOS 7 machine. I install GIM agent and KTAP, STAP on it. The install process is good and there is no error message. But after that, i go to Guardium WebGUI, i can see GIM process on Monitor GIM processes but i see nothing in S-TAP Control or S-TAP Status. In GIM Clients Status, i do see all the modules is INSTALLED.

I try to install another IBM Guardium VM version 10.1.3. After install GIM agent and KTAP, STAP. I do see the DB Server in S-TAP Control or S-TAP Status.

This cause V11 change and difference from older version or i do wrong in V11 Virtual Machine ?

Another thing is no matter the Virtual Machine is V11 or V10, after create policy and install. I don't see it work on DB. 

I create access rule with severity change to Medium, all conditions leave to blank or default. Action is Alter per match. My purpose is just log all activity like the rule Allow any any in firewall rule or access list. But no matter how i connect to DB local or remote from orther machine, whatever command i run. It don't match the rule and so it log nothing.

Can anybody please tell me where i missing ?

Thanks

------------------------------
Quang Le Nguyen Hong
------------------------------

Hi Quang,

How you installed STAP? Normally the STAP is installed from Collector where the GIM report (normally the CM). In the Setup by Client you must be indicate the Collector where the STAP is report. In the option of parameters under the STAP_SQLGUARD_IP. 
The other option is that the ports required aren't open.
Regards,
Carlos

------------------------------
Carlos Espinoza Chandia
------------------------------

Hi Carlos,
Yes i install STAP from Collector. Please note that this Collector is standalone and non CM. And when install STAP in Setup by Client, i do indicate the Collector where the STAP is report with the option you mention before. But still, nothing show up in STAP control.  The weird thing is although nothing show up in STAP control but some rule still have effect on the DB Server where i install STAP.
If i can see log about activity from the DB where i install S-TAP, it should mean S-TAP was install success even it not show up in S-TAP control, right ?

------------------------------
Quang Le Nguyen Hong
------------------------------

Original Message:
Sent: Fri January 03, 2020 10:02 AM
From: Carlos Espinoza Chandia
Subject: Issue with IBM Guardium

Hi Quang,

How you installed STAP? Normally the STAP is installed from Collector where the GIM report (normally the CM). In the Setup by Client you must be indicate the Collector where the STAP is report. In the option of parameters under the STAP_SQLGUARD_IP. 
The other option is that the ports required aren't open.
Regards,
Carlos

------------------------------
Carlos Espinoza Chandia
------------------------------

Quang,

As Carlos said, you will not be able to see the S-TAP in the 'S-TAP Control' unless you are on the Collector the S-TAP is allocated to, specified during S-TAP installation using the ​STAP_SQLGUARD_IP parameter. If you are on the Collector and are not seeing the S-TAP in the S-TAP Control then it is likely a port issue.

From the Central Manager you are able to see your deployed S-TAPs using the Enterprise S-TAP View, but this report is not generated in real-time meaning that newly installed S-TAPs may take some time before showing up here. The interval at which this report generates can be edited.

For your second question, there are a few things that are not correct in your policy that are causing issues. Alert per match is typically not what is used to log activity, and since there are no conditions there is nothing for the policy rule to match. Rule actions that are used to log activity are typically the 'Log Only' and 'Log Full Details' actions. Do not use Log Full Details unless it is absolutely necessary due to the high stress it can have on the Collector.

I recommend that you go to the Security Learning Academy website. You should be able to use your IBM ID account to get access to their free courses. There are some Guardium courses here that should help you; in particular you should look for the Guardium course named 'Create, install, and update a Guardium policy' under the 'Getting Started with Guardium' roadmap. This should help you understand more about how to build a policy rule that will log activity.

------------------------------
Chase Walkup
------------------------------

Thanks Chase,

I do using the ​STAP_SQLGUARD_IP parameter but still not see it on CM and please note that i don't have CM in my system. Only  Collector. 

Thanks for your recommend, i will check that website. Have a great day!

------------------------------
Quang Le Nguyen Hong
------------------------------

Original Message:
Sent: Fri January 03, 2020 12:51 PM
From: Chase Walkup
Subject: Issue with IBM Guardium

Quang,

As Carlos said, you will not be able to see the S-TAP in the 'S-TAP Control' unless you are on the Collector the S-TAP is allocated to, specified during S-TAP installation using the ​STAP_SQLGUARD_IP parameter. If you are on the Collector and are not seeing the S-TAP in the S-TAP Control then it is likely a port issue.

From the Central Manager you are able to see your deployed S-TAPs using the Enterprise S-TAP View, but this report is not generated in real-time meaning that newly installed S-TAPs may take some time before showing up here. The interval at which this report generates can be edited.

For your second question, there are a few things that are not correct in your policy that are causing issues. Alert per match is typically not what is used to log activity, and since there are no conditions there is nothing for the policy rule to match. Rule actions that are used to log activity are typically the 'Log Only' and 'Log Full Details' actions. Do not use Log Full Details unless it is absolutely necessary due to the high stress it can have on the Collector.

I recommend that you go to the Security Learning Academy website. You should be able to use your IBM ID account to get access to their free courses. There are some Guardium courses here that should help you; in particular you should look for the Guardium course named 'Create, install, and update a Guardium policy' under the 'Getting Started with Guardium' roadmap. This should help you understand more about how to build a policy rule that will log activity.

------------------------------
Chase Walkup
------------------------------

Hi Chase,

I was check the video and follow but unluckyly that the policy i build by follow the video still not working.
I have the DB test like this  :




------------------------------
Quang Le Nguyen Hong
------------------------------

Original Message:
Sent: Fri January 03, 2020 12:51 PM
From: Chase Walkup
Subject: Issue with IBM Guardium

Quang,

As Carlos said, you will not be able to see the S-TAP in the 'S-TAP Control' unless you are on the Collector the S-TAP is allocated to, specified during S-TAP installation using the ​STAP_SQLGUARD_IP parameter. If you are on the Collector and are not seeing the S-TAP in the S-TAP Control then it is likely a port issue.

From the Central Manager you are able to see your deployed S-TAPs using the Enterprise S-TAP View, but this report is not generated in real-time meaning that newly installed S-TAPs may take some time before showing up here. The interval at which this report generates can be edited.

For your second question, there are a few things that are not correct in your policy that are causing issues. Alert per match is typically not what is used to log activity, and since there are no conditions there is nothing for the policy rule to match. Rule actions that are used to log activity are typically the 'Log Only' and 'Log Full Details' actions. Do not use Log Full Details unless it is absolutely necessary due to the high stress it can have on the Collector.

I recommend that you go to the Security Learning Academy website. You should be able to use your IBM ID account to get access to their free courses. There are some Guardium courses here that should help you; in particular you should look for the Guardium course named 'Create, install, and update a Guardium policy' under the 'Getting Started with Guardium' roadmap. This should help you understand more about how to build a policy rule that will log activity.

------------------------------
Chase Walkup
------------------------------

Check value of incoming SQL's in SQL count report.

Log Only does not store Full SQL entity.

------------------------------
Zbigniew Szmigiero
IBM
Warsaw
------------------------------

Original Message:
Sent: Sun January 05, 2020 09:51 PM
From: Quang Le Nguyen Hong
Subject: Issue with IBM Guardium

Hi Chase,

I was check the video and follow but unluckyly that the policy i build by follow the video still not working.
I have the DB test like this  :

I connect it from another computer using MySQL Workbench with user root.

I was create a group user for root

And in the policy i specific this group in access rule with action is log only

But after install this policy and try to do some test from MySQL Workbench. I still see nothing. The S-TAP in this DBe look ok.

------------------------------
Quang Le Nguyen Hong
------------------------------


Original Message:
Sent: Fri January 03, 2020 12:51 PM
From: Chase Walkup
Subject: Issue with IBM Guardium

Quang,

As Carlos said, you will not be able to see the S-TAP in the 'S-TAP Control' unless you are on the Collector the S-TAP is allocated to, specified during S-TAP installation using the ​STAP_SQLGUARD_IP parameter. If you are on the Collector and are not seeing the S-TAP in the S-TAP Control then it is likely a port issue.

From the Central Manager you are able to see your deployed S-TAPs using the Enterprise S-TAP View, but this report is not generated in real-time meaning that newly installed S-TAPs may take some time before showing up here. The interval at which this report generates can be edited.

For your second question, there are a few things that are not correct in your policy that are causing issues. Alert per match is typically not what is used to log activity, and since there are no conditions there is nothing for the policy rule to match. Rule actions that are used to log activity are typically the 'Log Only' and 'Log Full Details' actions. Do not use Log Full Details unless it is absolutely necessary due to the high stress it can have on the Collector.

I recommend that you go to the Security Learning Academy website. You should be able to use your IBM ID account to get access to their free courses. There are some Guardium courses here that should help you; in particular you should look for the Guardium course named 'Create, install, and update a Guardium policy' under the 'Getting Started with Guardium' roadmap. This should help you understand more about how to build a policy rule that will log activity.

------------------------------
Chase Walkup

Accidental double-post... see answer below.

------------------------------
Marek Siekierski
------------------------------

Hi Quang,

Did you ever confirm that STAP shows up in STAP Control? That is the first step before working with any policy.

Try running the following command on the DB server to check if STAP is running:

ps -ef | grep tap​

If it is running, restart the sniffer as the cli user on the collector:

stop inspection-core
start inspection-core

Wait a few seconds, and then check STAP control again to see if it shows up. Otherwise, you can check the STAP.log, syslog, and the sniffer log on the collector and that should tell you if the STAP is being blocked.

If you've confirmed the STAP as mentioned above, then I would recommend opening a case in the support portal for assistance with your policy.

Best of luck.

------------------------------
Marek Siekierski
------------------------------

Hi all my friend,
Thank so much for your response. I was found why my policy define very simple but it not match DB activity i tested. There is 2 reason :

• Some error happen between IBM Guardium and MySQL Workbench. When using MySQL Workbench to access DB from remote host, the username display wrong like this :

• You guys can see that somehow the DB name is missing and DB User Name display very wrong, my DB user Name is something like abc and in Guardium it not display that on the logs. This could be the reason why i can't seeing the log when searching with username, configure policy with DB username condition. But when i use orther tool like Navicat or HeidiSQL, the log showing correct DB Name and DB User Name and policy is matched.  I was change the conditions to Client IP buts somehow when using MySQL Workbench, it still bypass Guardium policy.

• Access DB locally from the machine where DB install. My DB install on CentOS 7 machine and when i access DB from CentOS 7, i can see log on report but policy has no effect.

I will try to testing to make MySQL Workbench work and update with you later. Thanks and please comment if you have any advice for me on this case. Have a great day!

------------------------------
Quang Le Nguyen Hong
------------------------------

Another thing i forgot to mention is though now the policy is working, can block access to DB or masking data but i still not seeing anything in S-TAP Control. Very weird!

------------------------------
Quang Le Nguyen Hong
------------------------------