Predefined admin Reports

This page provides a short description of all predefined reports on the default administrator layout. For a description of the reports on the default user layout, see Predefined user Reports.

The reports are presented in tab > menu order. Some tabs contain both report and application portlets. For information about an application portlet, click the help button on its toolbar.

System View Tab

• STAP Status Monitor

• Current Status Monitor (on Predefined Reports - Common page)

• Request Rate

• CPU Usage

• Logins to Guardium

• Scheduled Job Exceptions

Daily Monitor Tab

• SQL Count

• Session Count

• Logged Threshold Alerts

• Logged R/T Alerts

• Exception Count

• Dropped Requests

• TCP Exceptions

• Admin User Logins

• Databases by Type

• Databases Discovered

• Values Changed

• Throughput

• Throughput (Graphical)

• Data Sources (on Predefined Reports - Common page)

• Parser Exceptions

Guardium Monitor Tab

• Current Status Monitor (on Predefined Reports - Common page)

• Running Query Monitor (in the Guardium Administration Guide)

• Logins to Guardium

• User Activity Audit Trail

• Guardium Group Details

• Guardium Users

• Guardium Roles

• Guardium Applications

• Number of Active Audit Processes

• Outstanding Audit Process Reviews

• User To-Do Lists

• Scheduled Job Exceptions

• Guardium API Exceptions

• Aggregation/Archive Log

• Definitions Export/Import Log

• User Comments - Sharable

• Cls/Asmt Job Queue

• Buffer Usage Monitor

• Scheduled Jobs

Tap Monitor Tab

• Rogue Connections

• S-TAP Configuration Change History

• Primary Guardium Host Change Log

• S-TAP Status

• Inactive S-TAPs Since

• Back to top

System View Tab

STAP Status Monitor

For each S-TAP reporting to this Guardium appliance, this report identifies the S-Tap Host, S-Tap Version, DB Server Type, Status (active or inactive), Last Response Received (date and time), Primary Host Name, and true/false indicators for: KTAP, TEE, MS SQL Server Shared Memory, DB2 Shared Memory, Local TCP monitoring, Named Pipes Usage, and Encryption.

This report has no run-time parameters, and is based on a system-only query that cannot be modified.

• Back to top

Current Status Monitor

This report appears on the default layout for both administrators and users. See Current Status Monitor on the Predefined Reports - Common page.

• Back to top

Request Rate

By default, displays the request rate for the last two hours. This graphical report is intended to display recent activity only. If you alter the run-time parameters to include a larger timeframe, you may receive a message indicating that there is too much data. Use a tabular report to display a larger time period.

• Back to top

CPU Usage

By default, displays the CPU usage for the last two hours. This graphical report is intended to display recent activity only. If you alter the From and To run-time parameters to include a larger timeframe, you may receive a message indicating that there is too much data. Use a tabular report to display a larger time period.

• Back to top

Logins to Guardium

Displays the user name, success (1=successful), login and logout date and time, host name and remote IP address.

• Back to top

Scheduled Job Exceptions

Displays a timestamp and the description for each scheduled job exception (including assessment errors).

• Back to top

Daily Monitor Tab

SQL Count

For the reporting period, the total number of different SQL commands issued.

• Back to top

Session Count

For the reporting period, the total number of different sessions open.

• Back to top

Logged Threshold Alerts

For the reporting period, the total number of threshold alerts logged.

• Back to top

Logged R/T Alerts

For the reporting period, the total number of logged real time alerts, listed by rule description.

• Back to top

Exception Count

For the reporting period, the total number of exceptions logged.

• Back to top

Dropped Requests

Tracks requests dropped by an inspection engine (Exception Description = Dropped database request). Under extremely rare, high-volume situations some requests may be lost. When this happens, the sessions from which the requests were lost are listed in the Dropped Requests report.

• Back to top

TCP Exceptions

For the reporting period, for each exception where the Exception Description of the Exception Type entity is TCP/IP Protocol Exception, a row of this report lists the following attribute values from the Exception entity: Exception Timestamp, Exception Description, Source Address, Destination Address, Source Port, Destination Port, and count of Exceptions for that row.

• Back to top

Admin User Logins

Summary of logins to the database using a database user name defined in the Admin Users group. The report displays the client IP address from which the user with administrative privileges logged into the database, database user name, source program, session start date and time, and session total for that record.

• Back to top

Databases by Type

Server type and client sources for each database type monitored.

• Back to top

Databases Discovered

For the reporting period, for each Discovered Port entity where the DB Type attribute value is NOT LIKE Unknown, this report lists the Probe Timestamp, Server IP, Sever Host Name, DB Type, Port, Port Type, and count of Discovered Ports for the row.

• Back to top

Values Changed

For the reporting period, this report provides detailed information about monitored value changes. All attribute values displayed are from the Monitor Values entity. The query this report is based upon has a non-standard sorting sequence, as follows:

• Server IP

• DB Type

• Audit Timestamp

• Audit Table Name

• Audit Owner

The query this report is based upon has a number of run-time parameters (see below), all of which use the LIKE operator and default to the value %, meaning all values will be selected.

For each monitored value selected, a row of the report lists the Timestamp, Server IP, DB Type, Service Name, Database Name, Audit Login Name, Audit Timestamp, Audit Table Name, Audit Owner, Audit Action, Audit Old Value, Audit New Value, SQL Text, Triggered ID, and a count of Change Columns entities for that row.

• Back to top

Throughput

For each Access Period in the reporting period, each row lists the Period Start time, the count of Server IP addresses, and the total number of accesses (Access Period entities).

You can restrict the output of this report using the Server IP run time parameter, which by default is set to ”%” to select all IP addresses.

• Back to top

Throughput (Graphical)

This report is a Distributed Label Line chart version of the tabular Throughput report described above, plotting the total number of accesses over the reporting period, one data point per Period Start time.

You can restrict the output of this report using the Server IP run time parameter, which by default is set to ”%” to select all IP addresses.

• Back to top

DataSources

This report appears on the default layout for both administrators and users. See Data Sources on the Predefined Reports - Common page.

• Back to top

Parser Exceptions

For each parser exception, this report lists the Source Address, Destination Address, Database Protocol, Uer Name, Exception Description, and the SQL string that caused the exception. A parser exception is any exception with an Exception Type of PARSER_ERROR. There are a number of run-time parameters that can  be used to restrict the search (see below).

• Back to top

Guardium Monitor Tab

Current Status Monitor

This report appears on the default layout for both administrators and users. See Current Status Monitor on the Predefined Reports - Common page.

• Back to top

Running Query Monitor

The Running Query Monitor is an administrator tool that appears on the Guardium Monitor tab. For information on how to use this tool, see the Running Query Monitor topic in the Guardium Administrator Guide.

• Back to top

Logins to Guardium

All values for this report are from the Guardium Logins entity. For the reporting period, each row of the report lists the User Name, Login Succeeded (1= Successful, 0=Failed), Login Date And Time, Logout Date And Time (which will be blank if the user has not yet logged out), Host Name, Remote Address (of the user) and count of logins for the row.

• Back to top

User Activity Audit Trail

The User Activity Audit Trail menu selection displays two reports, each of which is described separately below. In addition, from each of those reports, a third report can be produced. See:

• User Activity Audit Trail

• System/Security Activities

• Detailed Guardium User Activity (Drill-Down)

User Activity Audit Trail

For the reporting period, for each User Name seen on a Guardium User Activity Audit entity, each row displays the Guardium User Name, an Activity Type Description (from the Guardium Activity Types entity), a Count of Modified Entity values, the Host Nasme, and the total number of Guardium Activity Audits entities for that row.

From any row of the this report, the Detailed Guardium User Activity report (see below) is available as a drill-down report.

System/Security Activities

For the reporting period, for each User Name seen on a Guardium User Activity Audit entity, each row displays the Guardium User Name, an Activity Type Description (from the Guardium Activity Types entity), a Count of Modified Entity values, the Host Name, and the total number of Guardium Activity Audits entities for that row.

From any row of the this report, the Detailed Guardium User Activity report (see below) is available as a drill-down report.

Detailed Guardium User Activity (Drill-Down)

This report is not available from the menu, but can be opened for any row of the User Activity Audit Trail report (see above), or the System/Security Activities report (also see above). For the selected row of the report, based on the User Name and Activity Type Description, this report lists the following attribute values, all of which are from the Guardium User Activity Audit entity, except for the Activity Type Description, which is from the Guardium Activity Types entity: User Name, Timestamp, Modified Entity, Object Description, All Values, and a count of Guardium User Activity Audits entities for the row.

• Back to top

Guardium Group Details

For the reporting period, each row of the report lists a group member. The columns contain the following information: Group Description, Group Type, Group Subtype, Timestamp (from the Group Member entity), Group Member, and count of Group Member entities for the row.

You can restrict the output of this report using the run-time parameters described below, both of which are used with the LIKE operator and a default value of %, which selects all values.

• Back to top

Guardium Users

Lists each user, date of last activity, and number of roles assigned. For each user, you can drill down to the Record Details report to see the roles assigned to that user.

• Back to top

Guardium Roles

This menu pane displays two reports: All Roles &endash; Application Access, and All Roles &endash; User, each of which is described below.

All Roles - Application Access

For each role, this report lists the number of applications to which it is assigned. To list the applications to which a role is assigned, click on the role and drill down to the Record Details report.

All Roles - User

For each role, this report lists the number of users to which it is assigned. To list the users to which a role is assigned, click on the role and drill down to the Record Details report.

• Back to top

Guardium Applications

For each Guardium application, each row lists a security role assigned, or the word all, indicating that all roles are assigned.

• Back to top

Number of Active Audit Processes

Number of active Guardium audit processes. When central management is used, this report contains data only on the Central Manager, and is empty on all managed units (the standard message, No data found for requested query, displays). There are no run-time parameters for this report.

• Back to top

Outstanding Audit Process Reviews

Number of outstanding Guardium audit processes, listed by Guardium users.

• Back to top

User To-Do Lists

Displays for each Guardium audit process: a description, login name, action required (review or approve), status, user who has signed or reviewed, and execution date of the specified task.

• Back to top

Scheduled Job Exceptions

Displays a time stamp and description of all Guardium scheduled job exceptions. These are jobs where the Exception Type ID is one of the following: SCHED_JOB_EXCEPTION, ASSESSMENT_EXCEPTION, or ASMT_ERROR.

• Back to top

Guardium API Exceptions

Displays a time stamp and description of all GuardAPI exceptions. These are jobs where the Exception Type ID is GUARD_API_EXCEPTION.

• Back to top

Aggregation/Archive Log

This report lists Guardium aggregation activity by Activity Type. Each row of the report contains the Activity Type, Start Time, File Name, Status, Comment, Guardium Host Name, Records Purged, Period Start, Period End, and count of log records for the row. You can limit the output by setting the Guardium Host Name run-time parameter, which is set to % by default (to select all servers). The Records Purged column contains a count of records purged only when the activity type is Purge.

• Back to top

Definitions Export/Import Log

This report lists Guardium export/import activity by Activity Type. Each row of the report contains the Activity Type, Start Time, File Name, Status, Comment, and count of log records for the row.

• Back to top

User Comments - Sharable

Sharable user comments are all comments except for inspection engine, installed policy, and audit process results comments. For each sharable user comment, this report lists the date created, the type of item to which it applies (an alert, for example), the user who created the comment, and the contents of the comment.

• Back to top

Cls/Asmt Job Queue

Displays the Classifier/Assessment Job Queue. For each job, lists the Process Run ID, Process Type, Status, Cls/Asmt Process Id, Report Result Id, Cls/Asmt Description, Audit Task Description, Queue Time, Start Time, End Time, and Data Sources.

How the Jobqueue's status is effected

The Jobqueue

Assessments and Classifications run in their own separate process called the Jobqueue. Jobs are queued and have their status maintained while a Listener periodically polls the queue looking for waiting jobs to run.

Halting

Running jobs are monitored to reduce the number of hung jobs that might cause the jobqueue to be come overloaded. If a job is inactive for 30 minutes, the Listener is terminated and restarted, effectively stopping the operation of a job. Before the Listener is restarted, a process called the Cleaner runs, the status is set from RUNNING to HALTED, and then the Listener is restarted. A status of HALTED status means the job was not able to run to completion.

Resubmitting

Sometimes the Listener gets restarted for reasons other than a job hanging, for example rebooting the machine. When the Cleaner halts the running jobs, it will see if the job has responded in the past 8 minutes. If it has, the job will be copied and that copy will be resubmitted onto the jobqueue. The original halted will still display on the queue, and still have the results it was able to process available.

Monitoring

The mechanism by which jobs maintain their active status is by "touching" the timestamp on the jobqueue record. It is important to note that the jobqueue record is used for the entire job. Each individual Classifier Rule, or Assessment Test interacts with the timestamp for its parent process and they do not have individual timestamps that are monitored.

The Classifier will update its timestamp before every rule is tested, and after every SQL operation. For example, if the Classifier is scanning the data, in a database that supports paging, it will touch the timestamp after each batch of data is brought back from the database. This is because, depending on the state of the target database, the Classifier has the potential to invoke some long-running queries that will be limited to 30 minutes of execution.

Assessments touch the timestamp after each test in the Assessment is evaluated. Most Assessment Test run in a few seconds or less.

Observed Tests

The exception to the relatively quick running of Assessment tests, is the category of tests that are "Observed". These tests are based on queries and reports that use the internal sniffing data on the Guardium appliance and can run for longer periods of time and are unable to update the timestamp while they are in process. Therefore, Observed Assessment Tests have their timestamps set two hours into the future when they are started, essentially giving them two hours and thirty minutes to run to conclusion. This can be confusing when looking at the jobqueue and seeing the timestamp set to a time in the future. Just like any other Assessment Test, when the Observed Test ends, the timestamp will be touched. If the next test is an Observed test, the timestamp will once again be set two hours into the future, otherwise, the timestamp will be set to the current time.

• Back to top

Buffer Usage Monitor

Provides an extensive set of buffer usage statistics. See the description of the Sniffer Buffer Usage entity for a description of the fields listed on this report.

• Back to top

Installed Patches

Displays a list of installed patches. There are no run-time parameters, and this reporting domain is system-only.

• Back to top

Scheduled Jobs

Displays the list of currently scheduled jobs.

• Back to top

Tap Monitor Tab

Rogue Connections

This report is available only when the Hunter option is enabled on Unix servers. The Hunter option is only used when the Tee monitoring method is used. This report lists all local processes that have circumvented S-TAP to connect to the database.

• Back to top

S-TAP Configuration Change History

Lists S-TAP configuration changes &endash; each inspection engine change will be displayed on a separate row. Each row lists the S-TAP Host, DB Server Type, DB Port From, DB Port To, DB Client IP, DB Client Mask, and Timestamp for the change.

• Back to top

Primary Guardium Host Change Log

Log of primary host changes for S-TAPs. The primary host is the Guardium unit to which the S-TAP sends data. Each line of the report lists the S-TAP Host, Guardium Host Name, Period Start and Period End.

• Back to top

S-TAP Status

Displays status information about each inspection engine defined on each S-TAP Host. This report has no From and To date parameters, since it is reporting current status. Each row of the report lists the S-TAP Host, DB Server Type, Status, Last Response, Primary Host Name, Yes/No indicators for the following attributes: KTAP Installed, TEE Installed, Shared Memory Driver Installed, DB2 Shared Memory Driver Installed, LHMON Driver Installed, Named Pipes Driver Installed, and App Server Installed. In addition, it lists the Hunter DBS.

• Back to top

Inactive S-TAPs Since

Lists all inactive S-TAPs defined on the system. It has a single run-time parameter: Period From, which is set to now -1 hour by default. Use this parameter to control how you want to define "inactive." This report contains the same columns of data described above for the S-TAP Status report, with the addition of a count for each row of the report.

• Back to top