Good Afternoon everyone, 

Windows STAP (STAP Version - 10.6.0.260) on bunch of servers are generating Correlation Disabled messages when Guardium Database Monitor service is stopped on the server. Guardium Database Monitor is stopped on the server due to the following reason as described in the below tech note. 

IBM Security Guardium: Guardium Database Monitor service failed to start

As described in the tech note, when Windows System Admin tried to add Guardium Services to the Debug programs, option to add User or Group was disabled. Is there any other alternate way to add Guardium Services to the Debug programs ? 

Or Is there any other alternative way to get Guardium Database Monitor service running on the server?

Thanks
Vidya

------------------------------
Vidya
------------------------------

Jody,

Thanks! This is the piece of information I have been looking for.

I updated the Guardium services to run as Local System and all messages disappeared. 

Thanks
Vidya

------------------------------
Vidyasagar Palla
------------------------------

Original Message:
Sent: Tue August 25, 2020 06:30 PM
From: Jody Hair
Subject: Windows STAP generating Correlation Disabled messages

Change the WINSTAP to run as "Local System" instead of "Local Service"

 

Manage / Set up by Client

Select your hosts

Add these parameters:

               WINSTAP_ENABLED 2

               WINSTAP_CMD_LINE -SERVICEUSER "LocalSystem"

 

Push the configuration change: Install / Now

 

The S-Tap will restart and run under Local System.

 

There is a support doc for this, but I cannot locate the number.

 

 

 

Thank You,

 

Jody

 

This message (including any attachments) is intended only for the use of the individual or entity to which it is addressed and may contain information that is non-public, proprietary, privileged, confidential, and exempt from disclosure under applicable law or may constitute as attorney work product. If you are not the intended recipient, you are hereby notified that any use, dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, notify us immediately by telephone and (i) destroy this message if a facsimile or (ii) delete this message immediately if this is an electronic communication. Thank you.

Jody, 

Thanks! this is the piece of information that I have been looking for.

Thanks
Vidya

------------------------------
Vidyasagar Palla
------------------------------

Original Message:
Sent: Tue August 25, 2020 06:30 PM
From: Jody Hair
Subject: Windows STAP generating Correlation Disabled messages

Change the WINSTAP to run as "Local System" instead of "Local Service"

 

Manage / Set up by Client

Select your hosts

Add these parameters:

               WINSTAP_ENABLED 2

               WINSTAP_CMD_LINE -SERVICEUSER "LocalSystem"

 

Push the configuration change: Install / Now

 

The S-Tap will restart and run under Local System.

 

There is a support doc for this, but I cannot locate the number.

 

 

 

Thank You,

 

Jody

 

This message (including any attachments) is intended only for the use of the individual or entity to which it is addressed and may contain information that is non-public, proprietary, privileged, confidential, and exempt from disclosure under applicable law or may constitute as attorney work product. If you are not the intended recipient, you are hereby notified that any use, dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, notify us immediately by telephone and (i) destroy this message if a facsimile or (ii) delete this message immediately if this is an electronic communication. Thank you.

Hi Vidya,

This has been documented as a known issue in one of our articles published earlier this year :
https://www.ibm.com/support/pages/ibm-security-guardium-guardium-database-monitor-service-failed-start

Please sign up for IBM Software notifications which will keep you updated with any new documents which are published by our Guardium Support team, such as the one above:
https://www.ibm.com/support/pages/stay-date-my-notifications

Best regards

Chris

------------------------------
Chris Beaney
Data Security Support Manager - Europe, Middle East & Africa
IBM
------------------------------

Yes, both adding "Debug privilege" and using "Local System" are explained the technote that you referred to.

------------------------------
SATOSHI KAWASE
------------------------------