IBM Guardium

 View Only

 IBM Guardium S-TAP Optimization

Rizwan Ali's profile image
Rizwan Ali posted Thu December 19, 2024 03:44 AM

Dear Security Champs,

I have recently came across an issue where S-TAP agent is installed on a core-banking Oracle database and soon after it all the stack holders started to complain about the slowness of DB response and I/O increase in the db server.

This triggers me to explore the S-TAP agent optimization options, what can be done to improve the performance of the agent apart from logging few events/activity via Policy?

Please spend your 2 cents on this topic.

Jennifer Dodson's profile image
Jennifer Dodson

Rizwan,

The only answer I can think of is that the DB server was already overloaded. I have seen cases where they first blame Guardium but once they turn it off, they find the issue remains.  There could be backups, other monitoring or utilities, high cpu, underlying hardware issues. But Guardium usually only creates very little impact.  They should check cpu, memory, etc. while the STAP is down.  The only other exceptions would be if there is an ATAP or EXIT that may be incorrectly configured but you didn't mention that this was part of the configuration.  Hope this helps.

Jennifer

Rizwan Ali's profile image
Rizwan Ali

Hi Jennifer,

Thank you for your reply.

I was running GIM n STAP agent version 11.3 and i was getting only LOCAL traffic from the Oracle db.

I upgraded the agent to 11.5, enabled A-TAP (as i read somewhere in IBM technotes that if A-TAP is not correctly configured it will send either local or tcp traffic to guardium server)

Once after the upgrade even i was only getting local db user traffic, no application db user logs. Then i restarted the agent, then rediscovered the db instance and i started to get all the logs.

then the DB team, started complaining about the performance. System team is saying that once the guardium agent starts running the I/O starts going up.

can you suggest me what A-TAP configuration can be checked to fix this issue?

Thanks Much,

Rizwan