IBM Guardium

IBM Guardium

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  (quick) Enterprise search enabled, but not working

    Posted 10/04/19 06:42 AM

    Hello all,

    I'm trying to figure it out following issue:
    successfully enabled quick search from the CLI is not working after that from the GUI. Depending features are not available as well.
    from CLI:
    >grdapi enable_quick_search schedule_interval=2 schedule_units=MINUTE all=true
    >Quick Search is enabled.
    >ok


    check:
    >grdapi get_quick_search_info
    >Quick Search is enabled.
    >ok

    From the GUI (see attached pictures) the depending features are not working and showing that quick search is still disabled. I have installed all available updates for ver. 11.
    Have you ever faced such problem? Can you give me a hint where I can find more details/logs? 

     


    ------------------------------
    Konstantin Tomanov
    ------------------------------


  • 2.  RE: (quick) Enterprise search enabled, but not working

    Posted 10/07/19 02:54 AM
    ​Hi,

    we had this Problem with all V10.x Versions, happens especially if e.g. AGG / CM is down for some time.

    You have to run this command at all elements - COLL / AGGR / CM and wait around 1 hour -
    that helped at our Setup usually.

    ------------------------------
    Karl Riegler
    ------------------------------



  • 3.  RE: (quick) Enterprise search enabled, but not working

    Posted 10/07/19 10:09 AM
    Hello Karl, 

    Can you share the command? I cannot see it in you reply. 
    I will give it a try, no matter that I'm running ver 11 single appliance.

    ------------------------------
    Konstantin Tomanov
    ------------------------------



  • 4.  RE: (quick) Enterprise search enabled, but not working

    Posted 10/07/19 01:57 PM
    ​Hi,
    we use:
    grdapi enable_quick_search schedule_interval=2 schedule_units=MINUTE includeViolations=true
    ID=0
    Quick Search is enabled.
    ok
     
     
    CHECK:
    gmpshisvgdc02.aurepgmp.lcl>  grdapi get_quick_search_info
    Quick Search is enabled. (2 MINUTE)
    ok


    ------------------------------
    Karl Riegler
    ------------------------------



  • 5.  RE: (quick) Enterprise search enabled, but not working

    Posted 12/11/19 06:28 AM
    Hi Konstantin,

    Does Karl recommendation helped to fix the Quick Search problem or you have another solution to solve this problem? 

    I've one customer with similar problem with V11

    Martin

    ------------------------------
    Martins Zeipe
    ------------------------------



  • 6.  RE: (quick) Enterprise search enabled, but not working

    Posted 12/11/19 09:09 AM
    Hi,
    lernt from support last week that before running the provided Statement following component should be restarted ( valid from 10.6. on ):

    grdapi restart_solr restart_all=true
    But I have no Details About that "solr" daemon.
    grdapi restart_solr restart_all=true
    
    Also after restarting the collectors processes at cm/aggr the same 2 command should be applied.

    My experience is:
    if collectors are for some reason in bad state ( overloaded ... ) the first thing which will stuck is quick search.



    ------------------------------
    Karl Riegler
    ------------------------------



  • 7.  RE: (quick) Enterprise search enabled, but not working

    Posted 12/12/19 03:51 AM

    Thanks for reporting on this. BTW, the command grdapi test_solr can be helpful when trying to figure out what's wrong.

    https://www.ibm.com/support/knowledgecenter/en/SSMPHH_11.0.0/com.ibm.guardium.doc.admin/tshoot/investigation_dashboard_no_results.html



    ------------------------------
    TAL DANIEL
    Data mining developer
    IBM
    +972 74 792 2066
    ------------------------------