IBM Security Guardium

 View Only
Expand all | Collapse all

Truncated object name in daily report

  • 1.  Truncated object name in daily report

    Posted Tue December 07, 2021 04:27 PM
    Hello All,

    We're currently having an issue with a customer report where the 'Objects and Verbs' field does not always show the fully qualified object name even though it exists in both the SQL construct column and the Full SQL column. In each case the table name is in the 'O&A' field but only a few contain the DB and schema name. Both my team and IBM Support have not been able to reproduce the issue as yet but we are continuing to troubleshoot. Has anyone else run into this problem? The database is MS SQL Server and the main entity of the report is 'Object'. We see this issue with various table names accessed by multiple users. One thing to note is that the FQ table name is always present for DELETE statements but not for INSERT statements. At least that is what we're seeing now. We have seen a bit of a pattern in the INSERT statements where the first INSERT will have the FQ name but the subsequent INSERTs do not and, usually there is an equal number of INSERTS for many of the tables no matter which user executes the statement.

    Any information or advice anyone can provide would be greatly appreciated.

    Thank you,
    Pat Kelly, Information Insights, LLC

    Patrick Kelly

  • 2.  RE: Truncated object name in daily report

    Posted Wed December 08, 2021 05:27 AM

    There is no limit for the length of sniffed SQL statement but there is a limit for the size of logged SQL statement. Currently max_sql_size is 32k. If every entries in the report shows "Truncated SQL" as YES then sniffer has marked the SQL statement for truncation and the SQL will be logged as truncated.