@Wendy Zemba Thanks for the reply Wendy. I don't see anything under s-tap status. no universal connector. but i have checked it has been enabled and configuration was saved successfully have couple of questions

1.I have not setup any policy for UC , do i have setup a policy first before logs can be pulled from cloudwatch?

2.What will be the troubleshooting steps? where should i start from? 

I read somewhere that Universal connector logs cannot be retrieved through normal sessions reports. since logs pulled through universal connector are stored in a table at the backend and it has to be pulled to collector through reports. But i am not sure if its correct or not. I would appreciate any help. 

Thanks 

------------------------------
sara rehan
------------------------------

Hi @sara rehan,

Just because it saved ok, doesn't mean it's correct, the evaluation at save simply looks for issues with the construct of the code, it doesn't test for successful communication or anything. Since it doesn't show up in the STAP status table that tells me logs aren't getting to the collector.

As far as debugging, there's a troubleshooting tool in 11.5+: Troubleshooting tool. 

If that doesn't work, let me know and I'll share some CLI commands and where to look at logs in the fileserver.

------------------------------
Wendy Zemba
Sr. Consultant, Data Protection
Converge Technology Solutions
wendy.zemba@convergetp.com

Need help with your Guardium deployment? Contact me directly to discuss engagement opportunities. Currently serving North America.

Original Message:
Sent: Thu May 08, 2025 11:29 AM
From: sara rehan
Subject: Universal Connector MariaDB on AWS RDS

@Wendy Zemba Thanks for the reply Wendy. I don't see anything under s-tap status. no universal connector. but i have checked it has been enabled and configuration was saved successfully have couple of questions

1.I have not setup any policy for UC , do i have setup a policy first before logs can be pulled from cloudwatch?

2.What will be the troubleshooting steps? where should i start from? 

I read somewhere that Universal connector logs cannot be retrieved through normal sessions reports. since logs pulled through universal connector are stored in a table at the backend and it has to be pulled to collector through reports. But i am not sure if its correct or not. I would appreciate any help. 

Thanks 

------------------------------
sara rehan
------------------------------

Hi @sara rehan,

Here's how to debug the Universal Connector and view the logs.

1. Login to the Collector CLI
2. grdapi set_universal_connector_log_level uc_debug_level=debug
3. Log into the Collector UI, navigate to Universal Connector, open the UC configuration and re-save it.
4. From the Collector CLI, start fileserver.
5. From fileserver, navigate to: 

   logs >  opt-ibm-guardium-log/ > uc_container_log/ > uc-logstash.log

6. From there, there's a lot of different directions it could go based on what you find in the log.
7. Remove debug (note, restarting the UC will set it back to the default, which is info, but I like to keep set it to error): 

   grdapi set_universal_connector_log_level uc_debug_level=error

Regarding the policy. For testing purposes it is helpful to have a policy that contains, at minimum, a Log Masked Details rule so you can validate that the SQLs were captured, but you will get a session record by default.

------------------------------
Wendy Zemba
Sr. Consultant, Data Protection
Converge Technology Solutions
wendy.zemba@convergetp.com

Need help with your Guardium deployment? Contact me directly to discuss engagement opportunities. Currently serving North America.
------------------------------

Original Message:
Sent: Thu May 08, 2025 01:01 PM
From: Wendy Zemba
Subject: Universal Connector MariaDB on AWS RDS

Hi @sara rehan,

Just because it saved ok, doesn't mean it's correct, the evaluation at save simply looks for issues with the construct of the code, it doesn't test for successful communication or anything. Since it doesn't show up in the STAP status table that tells me logs aren't getting to the collector.

As far as debugging, there's a troubleshooting tool in 11.5+: Troubleshooting tool. 

If that doesn't work, let me know and I'll share some CLI commands and where to look at logs in the fileserver.

------------------------------
Wendy Zemba
Sr. Consultant, Data Protection
Converge Technology Solutions
wendy.zemba@convergetp.com

Need help with your Guardium deployment? Contact me directly to discuss engagement opportunities. Currently serving North America.

Original Message:
Sent: Thu May 08, 2025 11:29 AM
From: sara rehan
Subject: Universal Connector MariaDB on AWS RDS

@Wendy Zemba Thanks for the reply Wendy. I don't see anything under s-tap status. no universal connector. but i have checked it has been enabled and configuration was saved successfully have couple of questions

1.I have not setup any policy for UC , do i have setup a policy first before logs can be pulled from cloudwatch?

2.What will be the troubleshooting steps? where should i start from? 

I read somewhere that Universal connector logs cannot be retrieved through normal sessions reports. since logs pulled through universal connector are stored in a table at the backend and it has to be pulled to collector through reports. But i am not sure if its correct or not. I would appreciate any help. 

Thanks 

------------------------------
sara rehan
------------------------------

Hi @sara rehan,

Here's how to debug the Universal Connector and view the logs.

1. Login to the Collector CLI
2. grdapi set_universal_connector_log_level uc_debug_level=debug
3. Log into the Collector UI, navigate to Universal Connector, open the UC configuration and re-save it.
4. From the Collector CLI, start fileserver.
5. From fileserver, navigate to: 

   logs >  opt-ibm-guardium-log/ > uc_container_log/ > uc-logstash.log

6. From there, there's a lot of different directions it could go based on what you find in the log.
7. Remove debug (note, restarting the UC will set it back to the default, which is info, but I like to keep set it to error): 

   grdapi set_universal_connector_log_level uc_debug_level=error

Regarding the policy. For testing purposes it is helpful to have a policy that contains, at minimum, a Log Masked Details rule so you can validate that the SQLs were captured, but you will get a session record by default.

------------------------------
Wendy Zemba
Sr. Consultant, Data Protection
Converge Technology Solutions
wendy.zemba@convergetp.com

Need help with your Guardium deployment? Contact me directly to discuss engagement opportunities. Currently serving North America.
------------------------------

Original Message:
Sent: Thu May 08, 2025 01:01 PM
From: Wendy Zemba
Subject: Universal Connector MariaDB on AWS RDS

Hi @sara rehan,

Just because it saved ok, doesn't mean it's correct, the evaluation at save simply looks for issues with the construct of the code, it doesn't test for successful communication or anything. Since it doesn't show up in the STAP status table that tells me logs aren't getting to the collector.

As far as debugging, there's a troubleshooting tool in 11.5+: Troubleshooting tool. 

If that doesn't work, let me know and I'll share some CLI commands and where to look at logs in the fileserver.

------------------------------
Wendy Zemba
Sr. Consultant, Data Protection
Converge Technology Solutions
wendy.zemba@convergetp.com

Need help with your Guardium deployment? Contact me directly to discuss engagement opportunities. Currently serving North America.

Original Message:
Sent: Thu May 08, 2025 11:29 AM
From: sara rehan
Subject: Universal Connector MariaDB on AWS RDS

@Wendy Zemba Thanks for the reply Wendy. I don't see anything under s-tap status. no universal connector. but i have checked it has been enabled and configuration was saved successfully have couple of questions

1.I have not setup any policy for UC , do i have setup a policy first before logs can be pulled from cloudwatch?

2.What will be the troubleshooting steps? where should i start from? 

I read somewhere that Universal connector logs cannot be retrieved through normal sessions reports. since logs pulled through universal connector are stored in a table at the backend and it has to be pulled to collector through reports. But i am not sure if its correct or not. I would appreciate any help. 

Thanks 

------------------------------
sara rehan
------------------------------

Hi @sara rehan,

Here's how to debug the Universal Connector and view the logs.

1. Login to the Collector CLI
2. grdapi set_universal_connector_log_level uc_debug_level=debug
3. Log into the Collector UI, navigate to Universal Connector, open the UC configuration and re-save it.
4. From the Collector CLI, start fileserver.
5. From fileserver, navigate to: 

   logs >  opt-ibm-guardium-log/ > uc_container_log/ > uc-logstash.log

6. From there, there's a lot of different directions it could go based on what you find in the log.
7. Remove debug (note, restarting the UC will set it back to the default, which is info, but I like to keep set it to error): 

   grdapi set_universal_connector_log_level uc_debug_level=error

Regarding the policy. For testing purposes it is helpful to have a policy that contains, at minimum, a Log Masked Details rule so you can validate that the SQLs were captured, but you will get a session record by default.

------------------------------
Wendy Zemba
Sr. Consultant, Data Protection
Converge Technology Solutions
wendy.zemba@convergetp.com

Need help with your Guardium deployment? Contact me directly to discuss engagement opportunities. Currently serving North America.

Original Message:
Sent: Thu May 08, 2025 01:01 PM
From: Wendy Zemba
Subject: Universal Connector MariaDB on AWS RDS

Hi @sara rehan,

Just because it saved ok, doesn't mean it's correct, the evaluation at save simply looks for issues with the construct of the code, it doesn't test for successful communication or anything. Since it doesn't show up in the STAP status table that tells me logs aren't getting to the collector.

As far as debugging, there's a troubleshooting tool in 11.5+: Troubleshooting tool. 

If that doesn't work, let me know and I'll share some CLI commands and where to look at logs in the fileserver.

------------------------------
Wendy Zemba
Sr. Consultant, Data Protection
Converge Technology Solutions
wendy.zemba@convergetp.com

Need help with your Guardium deployment? Contact me directly to discuss engagement opportunities. Currently serving North America.

Original Message:
Sent: Thu May 08, 2025 11:29 AM
From: sara rehan
Subject: Universal Connector MariaDB on AWS RDS

@Wendy Zemba Thanks for the reply Wendy. I don't see anything under s-tap status. no universal connector. but i have checked it has been enabled and configuration was saved successfully have couple of questions

1.I have not setup any policy for UC , do i have setup a policy first before logs can be pulled from cloudwatch?

2.What will be the troubleshooting steps? where should i start from? 

I read somewhere that Universal connector logs cannot be retrieved through normal sessions reports. since logs pulled through universal connector are stored in a table at the backend and it has to be pulled to collector through reports. But i am not sure if its correct or not. I would appreciate any help. 

Thanks 

------------------------------
sara rehan
------------------------------

@sara rehan,

Sorry to hear you are still having issues. 

Guardium UC is a "pull", so one way from Guardium to the CloudWatch group is required.

Is your Collector and the CloudWatch group in different aws accounts? If so, did you follow the configuration for cross account IAM Role? https://github.com/IBM/universal-connectors/blob/main/input-plugin/logstash-input-cloudwatch-logs/SettingsForRoleArn.md

I've also run into a situation where the VPC wasn't opened between the two accounts.

Hi @sara rehan,

Here's how to debug the Universal Connector and view the logs.

1. Login to the Collector CLI
2. grdapi set_universal_connector_log_level uc_debug_level=debug
3. Log into the Collector UI, navigate to Universal Connector, open the UC configuration and re-save it.
4. From the Collector CLI, start fileserver.
5. From fileserver, navigate to: 

   logs >  opt-ibm-guardium-log/ > uc_container_log/ > uc-logstash.log

6. From there, there's a lot of different directions it could go based on what you find in the log.
7. Remove debug (note, restarting the UC will set it back to the default, which is info, but I like to keep set it to error): 

   grdapi set_universal_connector_log_level uc_debug_level=error

Regarding the policy. For testing purposes it is helpful to have a policy that contains, at minimum, a Log Masked Details rule so you can validate that the SQLs were captured, but you will get a session record by default.

------------------------------
Wendy Zemba
Sr. Consultant, Data Protection
Converge Technology Solutions
wendy.zemba@convergetp.com

Need help with your Guardium deployment? Contact me directly to discuss engagement opportunities. Currently serving North America.

Original Message:
Sent: Thu May 08, 2025 01:01 PM
From: Wendy Zemba
Subject: Universal Connector MariaDB on AWS RDS

Hi @sara rehan,

Just because it saved ok, doesn't mean it's correct, the evaluation at save simply looks for issues with the construct of the code, it doesn't test for successful communication or anything. Since it doesn't show up in the STAP status table that tells me logs aren't getting to the collector.

As far as debugging, there's a troubleshooting tool in 11.5+: Troubleshooting tool. 

If that doesn't work, let me know and I'll share some CLI commands and where to look at logs in the fileserver.

------------------------------
Wendy Zemba
Sr. Consultant, Data Protection
Converge Technology Solutions
wendy.zemba@convergetp.com

Need help with your Guardium deployment? Contact me directly to discuss engagement opportunities. Currently serving North America.

Original Message:
Sent: Thu May 08, 2025 11:29 AM
From: sara rehan
Subject: Universal Connector MariaDB on AWS RDS

@Wendy Zemba Thanks for the reply Wendy. I don't see anything under s-tap status. no universal connector. but i have checked it has been enabled and configuration was saved successfully have couple of questions

1.I have not setup any policy for UC , do i have setup a policy first before logs can be pulled from cloudwatch?

2.What will be the troubleshooting steps? where should i start from? 

I read somewhere that Universal connector logs cannot be retrieved through normal sessions reports. since logs pulled through universal connector are stored in a table at the backend and it has to be pulled to collector through reports. But i am not sure if its correct or not. I would appreciate any help. 

Thanks 

------------------------------
sara rehan
------------------------------

is this any better? 

Collector is not on cloud, its virtual appliance. this is why we are using access and secret access key. Do we have to allow outbound port 443 from collector?

@sara rehan,

Sorry to hear you are still having issues. 

Guardium UC is a "pull", so one way from Guardium to the CloudWatch group is required.

Is your Collector and the CloudWatch group in different aws accounts? If so, did you follow the configuration for cross account IAM Role? https://github.com/IBM/universal-connectors/blob/main/input-plugin/logstash-input-cloudwatch-logs/SettingsForRoleArn.md

I've also run into a situation where the VPC wasn't opened between the two accounts.

Hi @sara rehan,

Here's how to debug the Universal Connector and view the logs.

1. Login to the Collector CLI
2. grdapi set_universal_connector_log_level uc_debug_level=debug
3. Log into the Collector UI, navigate to Universal Connector, open the UC configuration and re-save it.
4. From the Collector CLI, start fileserver.
5. From fileserver, navigate to: 

   logs >  opt-ibm-guardium-log/ > uc_container_log/ > uc-logstash.log

6. From there, there's a lot of different directions it could go based on what you find in the log.
7. Remove debug (note, restarting the UC will set it back to the default, which is info, but I like to keep set it to error): 

   grdapi set_universal_connector_log_level uc_debug_level=error

Regarding the policy. For testing purposes it is helpful to have a policy that contains, at minimum, a Log Masked Details rule so you can validate that the SQLs were captured, but you will get a session record by default.

------------------------------
Wendy Zemba
Sr. Consultant, Data Protection
Converge Technology Solutions
wendy.zemba@convergetp.com

Need help with your Guardium deployment? Contact me directly to discuss engagement opportunities. Currently serving North America.

Original Message:
Sent: Thu May 08, 2025 01:01 PM
From: Wendy Zemba
Subject: Universal Connector MariaDB on AWS RDS

Hi @sara rehan,

Just because it saved ok, doesn't mean it's correct, the evaluation at save simply looks for issues with the construct of the code, it doesn't test for successful communication or anything. Since it doesn't show up in the STAP status table that tells me logs aren't getting to the collector.

As far as debugging, there's a troubleshooting tool in 11.5+: Troubleshooting tool. 

If that doesn't work, let me know and I'll share some CLI commands and where to look at logs in the fileserver.

------------------------------
Wendy Zemba
Sr. Consultant, Data Protection
Converge Technology Solutions
wendy.zemba@convergetp.com

Need help with your Guardium deployment? Contact me directly to discuss engagement opportunities. Currently serving North America.

Original Message:
Sent: Thu May 08, 2025 11:29 AM
From: sara rehan
Subject: Universal Connector MariaDB on AWS RDS

@Wendy Zemba Thanks for the reply Wendy. I don't see anything under s-tap status. no universal connector. but i have checked it has been enabled and configuration was saved successfully have couple of questions

1.I have not setup any policy for UC , do i have setup a policy first before logs can be pulled from cloudwatch?

2.What will be the troubleshooting steps? where should i start from? 

I read somewhere that Universal connector logs cannot be retrieved through normal sessions reports. since logs pulled through universal connector are stored in a table at the backend and it has to be pulled to collector through reports. But i am not sure if its correct or not. I would appreciate any help. 

Thanks 

------------------------------
sara rehan
------------------------------

@Wendy Zemba Thanks for the reply Wendy. I don't see anything under s-tap status. no universal connector. but i have checked it has been enabled and configuration was saved successfully have couple of questions

1.I have not setup any policy for UC , do i have setup a policy first before logs can be pulled from cloudwatch?

2.What will be the troubleshooting steps? where should i start from? 

I read somewhere that Universal connector logs cannot be retrieved through normal sessions reports. since logs pulled through universal connector are stored in a table at the backend and it has to be pulled to collector through reports. But i am not sure if its correct or not. I would appreciate any help. 

Thanks 

cloudwatch_logs { 	log_group => [ "/aws/rds/instance/test/postgresql"] 	start_position => "beginning" 	access_key_id => "<Enter the access key id>" 	secret_access_key => "<<Enter the secret access key id>>" 	region => "ap-south-1" #Default value: us-east-1 	interval => 60 	codec => null

add_field => {"account_id" => "<ACCOUNT_ID>"}

type => "aws_mysql"

Original Message:
Sent: 5/8/2025 11:29:00 AM
From: sara rehan
Subject: Universal Connector MariaDB on AWS RDS

@Wendy Zemba Thanks for the reply Wendy. I don't see anything under s-tap status. no universal connector. but i have checked it has been enabled and configuration was saved successfully have couple of questions

1.I have not setup any policy for UC , do i have setup a policy first before logs can be pulled from cloudwatch?

2.What will be the troubleshooting steps? where should i start from? 

I read somewhere that Universal connector logs cannot be retrieved through normal sessions reports. since logs pulled through universal connector are stored in a table at the backend and it has to be pulled to collector through reports. But i am not sure if its correct or not. I would appreciate any help. 

Thanks 

------------------------------
sara rehan
------------------------------

Hi @sara rehan,

You need to use the input and filter that matches your DBMS type, in your case MariaDB, correct? Looks like you're using MYSQL.

https://github.com/IBM/universal-connectors/blob/main/filter-plugin/logstash-filter-mariadb-aws-guardium/README.md

Below depicts what you would put in for a MariaDB filter. Note that you need to include the availability zone of your region, I added "a", but you need to confirm. You also need to change the parameters represented by the < >'s (highlighted yellow).

cloudwatch_logs {
    log_group => ["/aws/rds/instance/test/postgresql"]
    region => "ap-south-1a"
    codec => plain
    sincedb_path => "NUL"
    access_key_id => "<ACCESS_KEY>"
    secret_access_key => "<SECRET_ACCESS_KEY>"
    type => "mariadb"
    event_filter => ''
    start_position => "end"
    add_field => {"account_id" => "<ACCOUNT_ID>"}

I'm not 100% how it will function if you don't include the filter, but it's easy enough to drop in there. The only thing you would change in it, without direction from support, would be the type. The type parameter in the filter needs to match the type value you enter in to the above input section, in this example "mariadb". 

------------------------------
Wendy Zemba
Sr. Consultant, Data Protection
Converge Technology Solutions
wendy.zemba@convergetp.com

Need help with your Guardium deployment? Contact me directly to discuss engagement opportunities. Currently serving North America.

Original Message:
Sent: Sat June 14, 2025 02:54 PM
From: sara rehan
Subject: Universal Connector MariaDB on AWS RDS

cloudwatch_logs { 	log_group => [ "/aws/rds/instance/test/postgresql"] 	start_position => "beginning" 	access_key_id => "<Enter the access key id>" 	secret_access_key => "<<Enter the secret access key id>>" 	region => "ap-south-1" #Default value: us-east-1 	interval => 60 	codec => null

add_field => {"account_id" => "<ACCOUNT_ID>"}

type => "aws_mysql"

Original Message:
Sent: 5/8/2025 11:29:00 AM
From: sara rehan
Subject: Universal Connector MariaDB on AWS RDS

@Wendy Zemba Thanks for the reply Wendy. I don't see anything under s-tap status. no universal connector. but i have checked it has been enabled and configuration was saved successfully have couple of questions

1.I have not setup any policy for UC , do i have setup a policy first before logs can be pulled from cloudwatch?

2.What will be the troubleshooting steps? where should i start from? 

I read somewhere that Universal connector logs cannot be retrieved through normal sessions reports. since logs pulled through universal connector are stored in a table at the backend and it has to be pulled to collector through reports. But i am not sure if its correct or not. I would appreciate any help. 

Thanks 

------------------------------
sara rehan
------------------------------

Hi,

I have been using simple filter with type =>mysql . Since I don't have full access to CLI, I am limited to what I can check. Network team confirmed that they can see traffic flow form collector to vpc endpoint and back but somehow not pulling logs since access key in aws rds has not been accessed when I run the troubleshooting tool it doesn't give me much information. I'm just not sure why is it not accessing the logs in cloudwatch. 

Hi @sara rehan,

You need to use the input and filter that matches your DBMS type, in your case MariaDB, correct? Looks like you're using MYSQL.

https://github.com/IBM/universal-connectors/blob/main/filter-plugin/logstash-filter-mariadb-aws-guardium/README.md

Below depicts what you would put in for a MariaDB filter. Note that you need to include the availability zone of your region, I added "a", but you need to confirm. You also need to change the parameters represented by the < >'s (highlighted yellow).

cloudwatch_logs {
    log_group => ["/aws/rds/instance/test/postgresql"]
    region => "ap-south-1a"
    codec => plain
    sincedb_path => "NUL"
    access_key_id => "<ACCESS_KEY>"
    secret_access_key => "<SECRET_ACCESS_KEY>"
    type => "mariadb"
    event_filter => ''
    start_position => "end"
    add_field => {"account_id" => "<ACCOUNT_ID>"}

I'm not 100% how it will function if you don't include the filter, but it's easy enough to drop in there. The only thing you would change in it, without direction from support, would be the type. The type parameter in the filter needs to match the type value you enter in to the above input section, in this example "mariadb". 

------------------------------
Wendy Zemba
Sr. Consultant, Data Protection
Converge Technology Solutions
wendy.zemba@convergetp.com

Need help with your Guardium deployment? Contact me directly to discuss engagement opportunities. Currently serving North America.

Original Message:
Sent: Sat June 14, 2025 02:54 PM
From: sara rehan
Subject: Universal Connector MariaDB on AWS RDS

cloudwatch_logs { 	log_group => [ "/aws/rds/instance/test/postgresql"] 	start_position => "beginning" 	access_key_id => "<Enter the access key id>" 	secret_access_key => "<<Enter the secret access key id>>" 	region => "ap-south-1" #Default value: us-east-1 	interval => 60 	codec => null

add_field => {"account_id" => "<ACCOUNT_ID>"}

type => "aws_mysql"

Original Message:
Sent: 5/8/2025 11:29:00 AM
From: sara rehan
Subject: Universal Connector MariaDB on AWS RDS

@Wendy Zemba Thanks for the reply Wendy. I don't see anything under s-tap status. no universal connector. but i have checked it has been enabled and configuration was saved successfully have couple of questions

1.I have not setup any policy for UC , do i have setup a policy first before logs can be pulled from cloudwatch?

2.What will be the troubleshooting steps? where should i start from? 

I read somewhere that Universal connector logs cannot be retrieved through normal sessions reports. since logs pulled through universal connector are stored in a table at the backend and it has to be pulled to collector through reports. But i am not sure if its correct or not. I would appreciate any help. 

Thanks 

------------------------------
sara rehan
------------------------------

@sara rehan,

At this point, I recommend performing some hands-on troubleshooting. If you haven't already, consider opening a support case for further assistance.

Hi,

I have been using simple filter with type =>mysql . Since I don't have full access to CLI, I am limited to what I can check. Network team confirmed that they can see traffic flow form collector to vpc endpoint and back but somehow not pulling logs since access key in aws rds has not been accessed when I run the troubleshooting tool it doesn't give me much information. I'm just not sure why is it not accessing the logs in cloudwatch. 

Hi @sara rehan,

You need to use the input and filter that matches your DBMS type, in your case MariaDB, correct? Looks like you're using MYSQL.

https://github.com/IBM/universal-connectors/blob/main/filter-plugin/logstash-filter-mariadb-aws-guardium/README.md

Below depicts what you would put in for a MariaDB filter. Note that you need to include the availability zone of your region, I added "a", but you need to confirm. You also need to change the parameters represented by the < >'s (highlighted yellow).

cloudwatch_logs {
    log_group => ["/aws/rds/instance/test/postgresql"]
    region => "ap-south-1a"
    codec => plain
    sincedb_path => "NUL"
    access_key_id => "<ACCESS_KEY>"
    secret_access_key => "<SECRET_ACCESS_KEY>"
    type => "mariadb"
    event_filter => ''
    start_position => "end"
    add_field => {"account_id" => "<ACCOUNT_ID>"}

I'm not 100% how it will function if you don't include the filter, but it's easy enough to drop in there. The only thing you would change in it, without direction from support, would be the type. The type parameter in the filter needs to match the type value you enter in to the above input section, in this example "mariadb". 

------------------------------
Wendy Zemba
Sr. Consultant, Data Protection
Converge Technology Solutions
wendy.zemba@convergetp.com

Need help with your Guardium deployment? Contact me directly to discuss engagement opportunities. Currently serving North America.

Original Message:
Sent: Sat June 14, 2025 02:54 PM
From: sara rehan
Subject: Universal Connector MariaDB on AWS RDS

cloudwatch_logs { 	log_group => [ "/aws/rds/instance/test/postgresql"] 	start_position => "beginning" 	access_key_id => "<Enter the access key id>" 	secret_access_key => "<<Enter the secret access key id>>" 	region => "ap-south-1" #Default value: us-east-1 	interval => 60 	codec => null

add_field => {"account_id" => "<ACCOUNT_ID>"}

type => "aws_mysql"

Original Message:
Sent: 5/8/2025 11:29:00 AM
From: sara rehan
Subject: Universal Connector MariaDB on AWS RDS

@Wendy Zemba Thanks for the reply Wendy. I don't see anything under s-tap status. no universal connector. but i have checked it has been enabled and configuration was saved successfully have couple of questions

1.I have not setup any policy for UC , do i have setup a policy first before logs can be pulled from cloudwatch?

2.What will be the troubleshooting steps? where should i start from? 

I read somewhere that Universal connector logs cannot be retrieved through normal sessions reports. since logs pulled through universal connector are stored in a table at the backend and it has to be pulled to collector through reports. But i am not sure if its correct or not. I would appreciate any help. 

Thanks 

------------------------------
sara rehan
------------------------------

Hi Wendy,

We have two troubleshooting calls with IBM but we are not getting anywhere. we have made progress but still not logs.

• we have guardium collector vm on prem
• trying to get to aws rds cloudtwach using IAM role access key credentials and logroup
• vpc endpoint created on aws rds for private connectivity 
• firewall rules created to allow traffic from collector soruce ip to vpc endpoint in this case sts
• when run commands from docker container it does not show any connectivity to vpc endpoint 
• but when run command outside docker it shows connectivity to vpc endpoint and resolves into private ips
• does it matter if there is no connectivity through docker? can we just ignore it? 
• if not then what do we have to do to make docker use host ip to send traffic out of collector to vpc endpoint

Thanks

regards 

@sara rehan,

At this point, I recommend performing some hands-on troubleshooting. If you haven't already, consider opening a support case for further assistance.

Hi,

I have been using simple filter with type =>mysql . Since I don't have full access to CLI, I am limited to what I can check. Network team confirmed that they can see traffic flow form collector to vpc endpoint and back but somehow not pulling logs since access key in aws rds has not been accessed when I run the troubleshooting tool it doesn't give me much information. I'm just not sure why is it not accessing the logs in cloudwatch. 

Hi @sara rehan,

You need to use the input and filter that matches your DBMS type, in your case MariaDB, correct? Looks like you're using MYSQL.

https://github.com/IBM/universal-connectors/blob/main/filter-plugin/logstash-filter-mariadb-aws-guardium/README.md

Below depicts what you would put in for a MariaDB filter. Note that you need to include the availability zone of your region, I added "a", but you need to confirm. You also need to change the parameters represented by the < >'s (highlighted yellow).

cloudwatch_logs {
    log_group => ["/aws/rds/instance/test/postgresql"]
    region => "ap-south-1a"
    codec => plain
    sincedb_path => "NUL"
    access_key_id => "<ACCESS_KEY>"
    secret_access_key => "<SECRET_ACCESS_KEY>"
    type => "mariadb"
    event_filter => ''
    start_position => "end"
    add_field => {"account_id" => "<ACCOUNT_ID>"}

I'm not 100% how it will function if you don't include the filter, but it's easy enough to drop in there. The only thing you would change in it, without direction from support, would be the type. The type parameter in the filter needs to match the type value you enter in to the above input section, in this example "mariadb". 

------------------------------
Wendy Zemba
Sr. Consultant, Data Protection
Converge Technology Solutions
wendy.zemba@convergetp.com

Need help with your Guardium deployment? Contact me directly to discuss engagement opportunities. Currently serving North America.

Original Message:
Sent: Sat June 14, 2025 02:54 PM
From: sara rehan
Subject: Universal Connector MariaDB on AWS RDS

cloudwatch_logs { 	log_group => [ "/aws/rds/instance/test/postgresql"] 	start_position => "beginning" 	access_key_id => "<Enter the access key id>" 	secret_access_key => "<<Enter the secret access key id>>" 	region => "ap-south-1" #Default value: us-east-1 	interval => 60 	codec => null

add_field => {"account_id" => "<ACCOUNT_ID>"}

type => "aws_mysql"

Original Message:
Sent: 5/8/2025 11:29:00 AM
From: sara rehan
Subject: Universal Connector MariaDB on AWS RDS

@Wendy Zemba Thanks for the reply Wendy. I don't see anything under s-tap status. no universal connector. but i have checked it has been enabled and configuration was saved successfully have couple of questions

1.I have not setup any policy for UC , do i have setup a policy first before logs can be pulled from cloudwatch?

2.What will be the troubleshooting steps? where should i start from? 

I read somewhere that Universal connector logs cannot be retrieved through normal sessions reports. since logs pulled through universal connector are stored in a table at the backend and it has to be pulled to collector through reports. But i am not sure if its correct or not. I would appreciate any help. 

Thanks 

------------------------------
sara rehan
------------------------------