IBM Support

IBM Security Guardium: Data Streamed by S-TAP is not Reported for DB2 IMS

Troubleshooting


Problem

DB2 IMS Events are not reported as expected in Guardium.

Cause

Incorrect entity or fields used for reporting.

Diagnosing The Problem

Use this data collection list for the DB2 IMS platform when Guardium is not showing data as expected:

Note: This is similar to the data collection for middleware databases, the difference is in how the slon is captured.

1. Policy(ies)
2. Install order of the policies
3. Buffer Usage Report while the problem is reproduced
4. CLI support must_gather sniffer_issuesr
5. Check the Parser Error report/GDM_ERROR table to see if any errors exits related to IMS data
6. CLI support store zdiag on (and then "off" when the reproduction is complete). This will generate a slon and tcpdump

There is data logging on the STAP side, but that can be difficult to implement. It's easier to start the troubleshooting on the Guardium side and examine the right reporting data.

Resolving The Problem

Keep these points in mind when creating reports for IMS Data:

1. IMS Joblogs show the number of commands sent which can be correlated with events. But the "Log Full Details" rule action must be used in order to see details of the events.

2. The attribute "Access Period" should not be used since this can show more events than were sent.

3. Certain session attributes such as session start/stop times don't make sense for IMS data.

[{"Product":{"code":"SSMPHH","label":"IBM Security Guardium"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"Guardium Database Activity Monitor","Platform":[{"code":"PF035","label":"z\/OS"}],"Version":"9.5","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
16 June 2018

UID

swg21988707