Troubleshooting
Problem
A complex Guardium audit report (with many joins) can appear to hang when run as an audit process ( the simple GUI report will run quickly via GUI)
Symptom
This problem has been seen specifically with complex reports (eg with many "WHERE" clauses in the report definition.)
- When run as a stand alone report - the report runs quickly
- When run via an audit it can take ages / appear to hang.
Cause
Unknown at this point - Appears to happen only sometimes if the underlying report definition is complex - with many attributes reported and many "WHERE" clauses defined.
There could be many reasons for an audit report hanging / taking time - however it has been noted that the following combinations may cause the report when run as an audit to run slowly / hang.
- including certain Entity/Attributes in the report and "WHERE" condition of the report.
- specific amounts of data in the various tables
Environment
This is noticed in v9.5 p750 and p758 - and might apply to v10 also (not verified)
Resolving The Problem
For example - Consider a report which includes the following Attribute within the report
GDM_APP_EVENT.EVENT_VALUE_STR
The report was running slow / hanging via audit but fast in stand alone GUI.
This data item was not in fact needed to be displayed in the report - and so could be removed from the report definition.
Once the item was removed from the report definition the report runs fast as an audit (as well as via the GUI)
Other items in the report / "WHERE" clause etc were as follows - for example ...
GDM_ACCESS.SERVER_TYPE GDM_ACCESS.SERVICE_NAME GDM_SENTENCE.VERB GDM_APP_EVENT.EVENT_VALUE_STR GDM_CONSTRUCT_TEXT.FULL_SQL GDM_SENTENCE.VERB GDM_OBJECT.OBJECT_NAME GROUP_MEMBER
So - the suggestion here is that if
- an audit report takes a long time / hangs as an audit
- and it runs quickly via GUI report
then consider to remove some entities from the report / make it simpler to see if that speeds up the report when run via audit.
For the described problem above- removing the GDM_APP_EVENT.EVENT_VALUE_STR from the report definition allowed the audit report to run quickly (like the underlying GUI report)
If this does not help resolve / workaround the problem then contact IBM Support for further assistance.
Was this topic helpful?
Document Information
Modified date:
04 October 2018
UID
ibm10734031