IBM Security Guardium

 View Only
Expand all | Collapse all

Data Aggregation - Export and Import issue

  • 1.  Data Aggregation - Export and Import issue

    Posted Thu November 05, 2020 08:33 AM
    Hi,

    I want to Export data from Guardium Collector on daily night to Aggregator. So When I setup Data export in the Collector and Data import in the Aggregator, Is there should be any difference in export time(collector) and import time(aggregator)  between Guardium Collector and Aggregator or can we setup at the same time?

    Thanks,
    Panendar Rao.C

    ------------------------------
    PHANENDRA RAO CHAVANA
    ------------------------------


  • 2.  RE: Data Aggregation - Export and Import issue

    Posted Wed November 25, 2020 03:36 AM

    Hi Panendar,

    there is not a general import time as this is depends on the amount of data collected (an this depends on your policy), so the thumb rule wants the more is data collected the more is the time needed for the export and consequentially you have to push ahead the import time on the Aggregator.

    You can start with a couple of hours of difference and check in the Aggregation/Archive Log report how long the exports take, if these exceed the import time set up on the Aggregator you have to adjust it in order to be sure the import starts after the exports have completed on all the Collectors.

    So, if your Collectors export at 1am you want your Aggregator to import  (for example) at 3am. If this is not enough adjust the import accordingly based on the latest export end time of your collectors.

    Remember a couple of things:
    - Today (on the collectors) you export the data of yesterday
    - If an export goes overtime and it's missed by a today import, it will be imported tomorrow, so (today) you will miss that traffic in your reports.

    Regards
    Flavio



    ------------------------------
    Flavio Paiusco
    ------------------------------

    Original Message