IBM Support

Guardium: GDM_ERROR growing rapidly with PARSER_ERROR errors leading to high database disk space usage

Troubleshooting


Problem

Using IBM InfoSphere Guardium product, you notice the database disk space is growing at a fast rate. Upon investigation, you find out GDM_ERROR table is increasing rapidly mostly with PARSER_ERROR errors.

Symptom

- Database disk space growing fast
- GDM_ERROR table space increasing rapidly with errors of type PARSER_ERROR

Cause

Sniffer not able to handle some types of SQLs (usually a sniffer bug). This failure to handle the SQLs occurs frequently enough that GDM_ERROR table grows at a fast rate which then translates to database disk space usage growth.

Diagnosing The Problem

The problem referenced in this article is occurring if both of the following are true:

- Database space growing fast. Use command support show db-status used % to show database used space.


- GDM_ERROR used space increasing at a fast rate. Use command support show db-top-tables all to show the biggest tables. GDM_ERROR will be the biggest, or one of the biggest tables.

Resolving The Problem

To resolve the problem:

1.- Install the latest sniffer patch from FixCentral


    Note: Latest sniffer patch contains the latest fixes to identified defects related to sniffer inability to handle certain SQLs which leads to this problem.


2.- Run below cli commands to enable logging of parser errors and restart the inspection core to apply the change:

     store log sql parser_errors

     restart inspection-core


    Note: You can wait few days after installing the latest sniffer patch before deciding to run this step and only perform this step if GDM_ERROR continues growing rapidly with the last sniffer patch. Alternatively, you can perform this step on any case.


3.- Optional: cleanup GDM_ERROR from current data with one of below options:

    a) immediate cleanup. Use command support clean DAM_data parser_errors to perform the cleanup

    b) wait for normal purge to take care of the purging (you'll start to see decrease in disk space usage when the GDM_ERROR purge period has passed).

    Note that default purge period for GDM_ERROR is 30 days, but you can reduce it if you want the purge to occur sooner . Use commands show purge objects age/store purge objects age to list/change purge age for GDM_ERROR.


4.- Run an Optimize to optimize the TURBINE database. This will reorganize the data in all tables, including GDM_ERROR, which will result in reflecting the current actual reduced size. To run the Optimize, use the diag cli command and select options
      4 Perform Maintenance Actions

      2 TURBINE optimize

[{"Product":{"code":"SSMPHH","label":"IBM Security Guardium"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"--","Platform":[{"code":"PF016","label":"Linux"}],"Version":"9.1;9.0;8.2","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
16 June 2018

UID

swg21700128