Extracting data mart to file

You can create your own data mart extractions to CSV file, for export to a destination host.

About this task

The names of extracted CSV files have the format <filename defined by user>_<period start date time short format>.csv. For example, EXP_SESSION_LIST_20180219060000.csv. They are stored in the location you specify when you define the extraction. After you define an extract to file, you can use all the GuardAPI commands on those extracts.

Data mart file names must follow Linux rules. For example, the file name can't include $ because Linux does not support it. If you create a file with the name my$file, the saved file name is my.

Data mart file names must follow Linux rules for naming files. For example, file names can't include "$' since Linux doesn't support it. If you try to create a file named my$file, the saved file name is my.

You can track the extraction and see the overall data mart status in the pre-defined Datamart Extraction Log report.

The data mart configuration commands are run only once per central manager, since all collectors can then receive this information from the central manager.

Bundled data marts: You can bundle a number of CSV export data marts together, both user-defined and pre-defined. Each bundle has a main data mart. Each data mart that is included in a bundle pulls out data based on its own scheduling. After the main data mart extracts data, it puts data files from all the data marts included in the bundle into the one tar file, and sends it to a destination server. The main data mart must have the latest scheduled extraction time of all the data marts in the bundle so that it can include all the other data marts' latest extracts. See datamart_copy_file_bundle.

If you are defining the export by API, you need to know which unit types are relevant for the various domains. Some guidelines for commonly used domains:
  • Classification, discovered instances, outliers, vulnerability assessment: on the units where these processes are enabled or scheduled.
  • Exceptions, groups, system information, unit utilization levels: all units.
  • Access, policy violations, S-TAP status: collectors only.
  • Datasources, users: central manager, standalone.

Procedure

  1. Access the report you want to create a data mart from and click Data mart icon.
    The Data Mart dialog opens.
  2. In the Data Mart Configuration section, enter a Data Mart Name. The data mart name must start with Export:
  3. Optional: Enter a Description.
  4. In the Extract result to row, select File.
  5. Enter a File Name. The file name must start with EXP_
  6. Optional: Enter a File Path. If left blank, files are saved in: /opt/IBM/Guardium/data/dump/DATAMART/. The group guarddatamart or the group guardaggpids must have write access to the file location. The location must have all permissions for mysql and tomcat users; and is accessible from the file server. For example,
    • /var/IBM/Guardium/TSM/
    • /var/IBM/Guardium/data/exportdir/
  7. Specify a Time Granularity for the resulting data mart table. Match your granularity to the frequency at which you run the corresponding reports: hourly, daily, monthly.
  8. Select an Initial Start time from the calendar icon, indicating the date and time for the start of the data extraction. For example, you define the data mart on November 5, 2018, but you need data from November 1, 2018. In this case, set Initial Start to November 1, 2018.
  9. Click Apply to save the Data Mart.
  10. To define a regular data extraction, in the scheduling section click Modify Schedule. Define the data mart extraction schedule.
    • Start time: time of day the extraction starts
    • Restart: leave at Run only once
    • Schedule by: select Day/Week
    • Click Every day
    • Schedule Start Time: leave blank unless you want to start the data mart in the future. In that case, open the calendar and select the date on which to start exporting the data mart.
    • Automatically run dependent jobs. Leave cleared. It is not relevant for data mart.
  11. Select the user roles that have access to this data mart:
    1. Click Roles.
    2. In the Roles dialog, either select All Roles, or the individual roles.
    3. Click Apply. The roles are saved and the dialog closes.
  12. To temporarily stop report extraction click Pause, click Resume to resume report extraction.