IBM Guardium

IBM Guardium

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Expand all | Collapse all

Unable to see full update commands ran on the DBs via Guardium report

  • 1.  Unable to see full update commands ran on the DBs via Guardium report

    Posted Wed February 14, 2024 05:09 AM

    Hello Everyone,

    After installing the STAP agent on a windows server we have been getting logs from it but we noticed that logs generated by update commands are not showing fully in the full sql command column. The full sql command always starts from the stored procedures instead of the update verb.

    Can you all assist with what could be possible causes of this and how you think we can fix this?

    Thank you,



    ------------------------------
    Oluwadamilola Olowojolu
    ------------------------------


  • 2.  RE: Unable to see full update commands ran on the DBs via Guardium report

    Posted Mon March 04, 2024 02:36 AM

    Hello All,

    Please I haven't still been able to resolve this issue and it is delaying the close of our POC.



    ------------------------------
    Oluwadamilola Olowojolu
    ------------------------------



  • 3.  RE: Unable to see full update commands ran on the DBs via Guardium report

    Posted Mon March 04, 2024 08:08 AM

    It sounds like you have a database client that issues a stored procedure call (STC) to the database, you are seeing the stored procedure call in the full SQL report, but mot the statements within the stored procedure.  

    My experience is that this is the expected result.

    The S-TAP only captures what is in the network traffic or inter-process traffic within the server.  The statements within the STC are kept within the database engine and not seen by the S-TAP.

    __PRESENT



    ------------------------------
    Frank Bates
    ------------------------------



  • 4.  RE: Unable to see full update commands ran on the DBs via Guardium report

    Posted Mon March 04, 2024 08:36 AM

    Hello Frank,

    Thank you for the response and help. The customer has another DAM (Imperva) also on that DB server and is able to get the full update logs. I have attached a sample of the logs from the two DAM solutions for further clarity.

    Thank you



    ------------------------------
    Oluwadamilola Olowojolu
    ------------------------------