Difference between KTAP_Installed and KTAP_Enabled value

The difference between KTAP_Installed  and KTAP_Enabled is that KTAP_Installed ensures the KTAP  binaries are installed while KTAP_Enabled ensures KTAP module is running. 

For example, If KTAP_ENABLED is detected to be set to false, the logic for bundle-STAP installation via GIM is to disable KTAP at the end of the startup process. It sets "ktap_installed=0" and restarts STAP process.

KTAP_Enabled -  Enables the K-TAP module. Default=1 (yes)

KTAP_Installed - Installs the KTAP binaries 

K-Tap is the recommended mechanism to collect local and network traffic on a Unix database server. Unlike the Tee, with K-Tap you do not need to change how database clients connect to the server. K-Tap is a kernel module that is installed into the operating system. Once installed, it can be enabled or disabled using a configuration file setting. When enabled, it observes access to a database server by hooking the mechanisms used to communicate between the database client and server. When K-Tap is disabled, the Tee can be used to monitor local traffic. K-Tap and Tee are almost always mutually exclusive - to monitor local access you either use K-Tap or the Tee. 

NOTE: If KTAP is disabled (KTAP_Enabled=0) inspection core will use Tee port for monitoring.