IBM Support

Guardium Object, Command or Client/Server reports have no data on Aggregator

Troubleshooting


Problem

My report run on the Guardium Aggregator has no results. This report runs on a regular basis and usually has results. The report has Client/Server, Object, Command or Field as the main entity. Report with session or SQL as the main entity does have results. The same report does have results when run directly on the collectors sending data to this aggregator.

Symptom

"No data found" seen in the interactive report in the GUI on the aggregator. When run on the collector for the same timeframe there is data. The main entity of the report is Client/Server, Object, Command or Field.

Cause

Problem with exporting or importing static tables.

Diagnosing The Problem

1. Check the basics - Guardium reports are not showing any data.

2. Check for aggregation errors around import/export on the aggregator and collectors - How to troubleshoot Guardium aggregation or archive errors. If the data has not imported correctly on the aggregator it may cause this problem.

3. Does the exact same report run on the collector have data?

4. In the case when Client/Server report has no data, does a report with Session as the main entity, with only session attributes, have data?

5. In the case when Object, Command, or Field report has no data, does a report with SQL as the main entity, with only SQL attributes, have data?

If answer to 3 and 4 or 5 is yes, this technote is likely to apply to your case.

Resolving The Problem

1. Confirm that the patch level of the collectors is not higher than the patch level of the aggregator. Schema differences between collectors and aggregator can cause this problem. If collector is at a higher level, install the required patches before moving on to step 2.

2. By default, not all static data is exported from the collector to the aggregator every day. To force the collectors to export all the static data on the next export:

i) Run in the CLI of all collectors exporting to the aggregator:

  • store next_export_static on
ii) Export the data from collectors and import into aggregator, either with 'run once now' or on the usual schedule.

3. If the problem is not resolved by these steps it may require root access by Guardium support to proceed further. Support engineers can use the information in internal section of this technote. Please collect the following information before opening a PMR:

i) In the aggregator CLI run:
  • aggregator debug start
ii) Wait for export and import jobs to run on collector and aggregator.
iii) In the aggregator CLI run:
  • aggregator debug stop
iv) Send the following to the PMR

[{"Product":{"code":"SSMPHH","label":"IBM Security Guardium"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"Guardium Central Manager and Aggregator","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF010","label":"HP-UX"},{"code":"PF016","label":"Linux"},{"code":"PF027","label":"Solaris"},{"code":"PF033","label":"Windows"},{"code":"PF035","label":"z\/OS"}],"Version":"10.0;10.0.1;10.1;8.2;9.0;9.1;9.5","Edition":"All Editions","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
03 February 2021

UID

swg21993824

Page Feedback