Hi all,

I have installed successfully stap and ktap on Centos 7 and it's status is green on the STAP-control tap but I am not getting any traffic even I have created a policy with an action log and alert in the rules.

can anyone help me?

Hi Mina, to collect traffic you should have set the Database auto discovery as a parameter of the S-TAP, did you do it?
What kind of database do you expect to find?
Have you configured an "Inspection Engines"? Try to add it manually.
See on the Collector the view: "STAP Control", what do you see under the "Inspection Engines" item?
Try to launch an auto discovery, and let us know.

Hi Mina,

You need to check some points:

1- Where do you check the logging status? First, you should perform the necessary checks through the Session reports. If you can see database sessions in the Session reports, you will need to define a rule in the policy section with the action set to "log full details" for detailed logging, and then install it on the collector appliance.

2- First, ensure that the inspection engine definition on the collector appliance is correct; if the Inspection Engine configuration is incorrect, manually define it.

3- If your Inspection Engine configuration is correct but you're still experiencing logging issues, check if the database traffic is encrypted. If the database traffic is encrypted, you will need to follow the A-TAP instructions.

Hi Mina,

First make sure your report is configured correctly (you can start with a report with "session" main entity if you find any logs then the agent collecting traffic with no issues.

second if you didn't find and logs in your report check agent inspection engines.

if not created by default during agent installation there is more than on way to discover inspection engines.

if created check your policy if there is any ignore rules installed.

please note:

when explaining an issue like this try to provide more details like

1. DB version and type  
2. Guredium version (collector and central manager)
3. installed gent version 
4. if you find any error during installation (STAP events and GIM events reports.