Linux-UNIX: guardctl utility commands for A-TAP

There are two methods of managing your A-TAPs: either as user root for all functions, or as a db user. The db user option can configure, activate, deactivate, and instrument A-TAP, but cannot perform all functions. This means that the non-root user can handle day to day activities of the A-TAP, without requiring the root user. The guardctl help window lists the permitted commands for the logged-in user. The functionality is:

• When activating an A-TAP instance not as root, the current user must be the db_user specified in the instance configuration, and must be specified as the db_user for the matching inspection engine in the S-TAP configuration.
• A non-root user cannot manage (configure, active, deactivate, and instrument) an A-TAP instance that was initially configured by the root user.
• The root user can activate and deactivate a non-root created A-TAP instance, but must specify the instance name as ${DB_USER}/${DB_INSTANCE}

Authorizing the user is optional. If you have db_user specified in the guard_tap.ini, you don't need to authorize the user, but you still may. If db_user is not specified in the guard_tap.ini, you must authorize the user and cannot perform any actions as non-root with guardctl.

Syntax

<guardium_base>/xxx/guardctl [<parameter>=value>] [<parameter>=<value> ...] <command> [-q | -v | -qv]

Use these flags to manage the output:

• -q (quiet): suppress all output except name-value pairs
• -v (value pairs): add name-value pairs related to each command
• -qv: outputs name-value pairs only

The following example shows the output for the name-value pairs.

db_instance: ${db_instance}
db_user: ${db_user}
db_base: ${db_base}
db_home: ${db_base}
db_version: ${db_version}
db_type: ${db_type}
is_active: ${is_active} (“yes” or “no”)
is_instrumented: ${is_db_instrumented} (“yes” or “no”)
msg: some string
rv: ${retval}
overall_rv: ${retval} 
overall_msg: (string)