IBM Support

Guardium sniffer restarts with error: guard::datasource::Policy_rule_action_Rule_action_type_IsValid(value)

Troubleshooting


Problem

The Guardium sniffer process is restarting several times per minute and STAPs are not active on the GUI. In snif_stderr.txt file you see multiple errors like: guard::datasource::Policy_rule_action_Rule_action_type_IsValid(value)

Symptom

  • STAPs red in the GUI
  • In GUI->Guardium Monitor->Buffer Usage Monitor the column "Mem Sniffer" is increasing and decreasing in size very often
  • In the same report, the column "TID" is changing very often.
  • In the snif_stderr.txt (available from fileserver) you see an error:

      •  libprotobuf FATAL ../../../BUILD/guard-platform/libs/guard++/datasource/datasource.pb.h:6545] CHECK failed: ::guard::datasource::Policy_rule_action_Rule_action_type_IsValid(value): (value)

Cause

On appliances of any version, a failed policy install can sometimes cause this problem.

On v8.2 appliances, installing a policy with "Z/OS Audit" action will cause this problem. This action is only available in version 9 and above.

Resolving The Problem

1. Reinstall the policy via

GUI -> Administration Console->Configuration->Policy Installation->Install & Override

2. If you are on a v8.2 or below appliance: check for Z/OS Audit action. Remove that action from the policy or upgrade to v9 to use it.

[{"Product":{"code":"SSMPHH","label":"IBM Security Guardium"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"Guardium Database Activity Monitor","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF010","label":"HP-UX"},{"code":"PF016","label":"Linux"},{"code":"PF027","label":"Solaris"},{"code":"PF033","label":"Windows"},{"code":"PF035","label":"z\/OS"}],"Version":"8.0.1;8.1;8.2;9.0;9.1","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
16 June 2018

UID

swg21685799

Page Feedback