Hi Igor Volkov,
There are two types of reports you can run from Central Manager: Immediate or schedule(both reports you can for all managed units or specific managed units).
Immediate report: you can run manually when you need data and it will collect from specific managed unit - data doesn't store in CM.
Scheduled Report: you need not run manually every time like a immediate report, while you schedule report, data will be pulled automatically on scheduled basis,it has two options- time granularity(how many seconds or minutes or hours once) to populate data from selected managed units and purge(specify how many days after to delete data) , so in this case this specific report pulls data and keep it in the CM internal database and delete based on the purge(time period) you define.
reference:
https://www.ibm.com/support/knowledgecenter/SSMPHH_11.2.0/com.ibm.guardium.doc/reports/how_to_create_a_distributed_report.htmlThanks,
Panendar Rao.C
------------------------------
PHANENDRA RAO CHAVANA
------------------------------
Original Message:
Sent: Fri November 13, 2020 05:55 AM
From: Igor Volkov
Subject: when the information from collector is written to CM database
Hello.
We have Central Manager+Aggregator and several managed collectors. When we run a report on Central Manager to retrieve audit data from a particulart collector what process takes place: the CM just runs a query on that collector and that audit data is not recorded to CM internal database or the audit data from collector that matches that report is recorded to CM internal database?
------------------------------
Igor Volkov
------------------------------