IBM Security Guardium

 View Only
  • 1.  Strip schedule reports

    Posted Thu May 19, 2022 05:49 PM
    Hello all,

    I have a problem. I created a report using Audit Process Builder to do this reports weekly. This worked fine for a few months, but today there too many transactions, then the report grew up and it is more than 80,000 rows, so the report don't sent via email and the result file can't open with Excel, it's send a error of memory and the excel is hang.

    I'll like to strip the report in small reports but automatically, but I don't know how it do.

    Another option is left the reports in a some repository and then the users can access their to the local computers.

    Anybody can help me?

    Regards,

    ------------------------------
    Carlos Espinoza Chandia
    ------------------------------


  • 2.  RE: Strip schedule reports

    Posted Fri May 20, 2022 09:54 AM
    This is a shot in the dark, consider looking at the following CLI settings.

    show csv_fetch_size
    show csv_max_size
    store csv_fetch_size
    store csv_max_size

    ------------------------------
    Walter York
    ------------------------------



  • 3.  RE: Strip schedule reports

    IBM Champion
    Posted Fri May 20, 2022 10:23 AM
    @Carlos Espinoza Chandia

    In addition to increasing the csv_fetch and csv_max sizes, you can compress the file to avoid it being too large for email. Within your Audit Process, under 'Advance Options' there's a checkbox 'Zip CSV for email'.  

    The other thing that you may be running into is the length of the file name. Microsoft has a 400 character max and I have hit it because Guardium adds a lot of characters to the end of the file name that you can't control. Try renaming it and see if that helps. If so, you can control the ​file name up to the date time stamp. It's a concatenation of 'CSV/CEF file name' under advanced options and 'CSV/CEF file Label' with the task (or the task name if you don't set 'export as').

    ------------------------------
    Wendy
    ------------------------------



  • 4.  RE: Strip schedule reports

    Posted Fri May 20, 2022 01:05 PM
    Hi Wendy:

    Well, the system show that there are 30,000 rows as maximum but the result report has 80,000. If I try open the file with 80K rows, the file hangs the application because is too large. Yes, the configuration has check in the compress box and Zip CSV too. But the report don't sent. When I view results (under Audit Process Builder), the system show this messages:

    - The maximum number of rows for remote source report is 800000. Use cli command store save_result_fetch_size to increase the size
    - Overall Value: 800000

    Increasing the size can't resolve the problem to open the file with too many rows. I search any option that strip report in a small reports with a certain rows number. Of course, I can make a lot of reports with a special conditions (i.e. Instances, users, etc.) but in the future this could be repeat or appears more conditions.

    Regards,

    ------------------------------
    Carlos Espinoza Chandia
    ------------------------------



  • 5.  RE: Strip schedule reports

    Posted Fri May 20, 2022 02:36 PM
    try restarting the system or restarting gui to see if the change applies fully afterward.  Could be a bug.

    ------------------------------
    Walter York
    ------------------------------