Enabling Guardium in the Netezza Performance Server container

Starting from 11.3.1.3-IF1, Guardium support is introduced. Learn how to enable query and result sharing with Guardium from Guardium enabled docker container on your Netezza Performance Server.

Before you begin

Root access to the NPS host nodes.
NPS must be in Online state before you begin.

About this task

This procedure configures Guardium® on the active node (ha1) first, then deploys the configuration to the standby node (ha2). The guardium.env file defines the network tap and collector settings that the Guardium S-TAP agent uses to connect to the Guardium collector.

Procedure

Log in to the container and verify that the NPS state is Online.
On the active node (ha1), open the guardium.env file in a text editor:
```
vi /opt/appliance/storage/nps/onprem-host/guardium.env
```

Set the following variables in the guardium.env file:

STAP_CONFIG_TAP_PRIVATE_TAP_IP=127.0.0.1
STAP_CONFIG_TAP_TAP_IP=NPS_hostname
STAP_CONFIG_TAP_FORCE_SERVER_IP=1
GUARDIUM_INFO=guardium_collector_IP_or_hostname

Where:

NPS_hostname is the fully qualified domain name of the NPS host, for example ha1.apdomain.ibm.com.
guardium_collector_IP_or_hostname is the IP address or hostname of the Guardium collector, for example lit4col02.dev.fyre.ibm.com.

Example:

STAP_CONFIG_TAP_PRIVATE_TAP_IP=127.0.0.1
STAP_CONFIG_TAP_TAP_IP=ha1.apdomain.ibm.com
STAP_CONFIG_TAP_FORCE_SERVER_IP=1
GUARDIUM_INFO=lit4col02.dev.fyre.ibm.com

From the nps_scripts directory on ha1, remote deploy the Netezza Performance Server container to the same active node (ha1):
```
[root@ha1 nps_scripts]# ./install_nps_remote.sh -n node
```

Start the NPS container:

[root@ha1 nps_scripts]# podman start ipshost1

After NPS is online, open the postgresql.conf file and add the following session variable to enable Guardium query sharing:
```
enable_guardium_share_info = yes
```
In the same postgresql.conf file, add the path to the libguard_netezza_exit_64.so Guardium library:
```
guardium_exit_lib='/usr/lib64/libguard_netezza_exit_64.so'
```
Restart the NPS container to apply the configuration changes:
```
podman stop ipshost1
podman start ipshost1
```
Confirm that NPS is online and that Guardium is working correctly.
After confirming that the Guardium setup is working on ha1, remotely deploy the container to the standby node (ha2):
```
[root@ha1 nps_scripts]# ./install_nps_remote.sh -n node
```
Start the NPS container on ha1:
```
podman start ipshost1
```

Results

Guardium is enabled on both the active node (ha1) and the standby node (ha2). The NPS container reports data activity to the Guardium collector.