IBM Support

What does max_sql_size mean for the Guardium sniffer process?

Question & Answer


Question

The CLI command show max_sql_size displays the maximum length of SQL statements that can be processed by the Guardium sniffer. How is the size defined? What are the implications of this parameter? Can I change the max_sql_size?

Cause

The sniffer cannot log SQL statements of unlimited length. Use the max_sql_size parameter to define the largest SQL  statement that the sniffer will accept.

Answer

How is the size defined?
By the total size, in bytes, of packets containing the SQL, which can be seen in the packet headers of a slon file. The default size is 32K.

Can I change the max_sql_size?
Use store max_sql_size to change the size of the parameter.
Important: While Guardium does not limit the maximum value for this parameter, a larger setting significantly increases the likelihood of sniffer performance problems caused by processing large SQL statements. For best performance, Guardium recommends that you do not change  the default value. If change is absolutely required, we strongly discourage customers from going above 512K as a max value.

What are the implications of this parameter?
 SQL statements (or blocks of statements for MSSQL traffic) larger than the max size are analyzed, parsed, and logged as truncate. The statements are also truncated after they reach the max size. Sniffer also mark those SQL statements as truncated so they can easily be identified and reported.

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSMPHH","label":"IBM Security Guardium"},"Component":"Guardium Database Activity Monitor","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF010","label":"HP-UX"},{"code":"PF016","label":"Linux"},{"code":"PF027","label":"Solaris"},{"code":"PF033","label":"Windows"}],"Version":"All Versions","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
20 February 2019

UID

swg21985772