modify_guard_param

This generic API updates the values of specific parameters for various Guardium functions.

Functions that use this parameter include:
Note: Use get_all_modifiable_guard_params to display a list of the parameters that can be modified with this API.

This API is available in Guardium V10.5 and later.

REST API syntax

This API is available as a REST service with the POST method. Call this API as follows: 
POST https://[Guardium hostname or IP address]:8443/restAPI/modify_guard_param

Parameters

Parameter Value type Description
paramName String Required. One of the parameters that are described in the following sections.
paramValue String Required. The new value for the parameter.
api_target_host String

Specifies the target hosts where the API executes. Valid values:
  • all_managed: execute on all managed units but not the central manager
  • all: execute on all managed units and the central manager
  • group:<group name>: execute on all managed units identified by <group name>
  • host name or IP address of a managed unit: specified from the central manager to execute on a managed unit.  For example, api_target_host=10.0.1.123.
  • host name or IP address of the central manager: specified from a managed unit to execute on the central manager. For example, api_target_host=10.0.1.123.

IP addresses must conform to the IP mode of your network. For dual IP mode, use the same IP protocol with which the managed unit is registered with the central manager. For example, if the registration uses IPv6, specify an IPv6 address. The hostname is independent of IP mode and can be used with any mode.

Alerting parameters

Parameter Value Type Description
ALERT_VERB_NUM_LIMIT Integer Sets the maximum number of SQL verbs to show in the Alert log.

Valid value is a positive integer between 1 and 50. The default is 10.

ANTLR3_REMOVE_COMMENTS Boolean Enables or disables logging of comments.
Valid values:
  • 0: logging of comments is enabled
  • 1: logging of comments is disabled

Default = 0
STARTTLS String Sets TLS data encryption for the alerter email server.
Valid values:
  • TLS: Use TLS data encryption.
  • SSL: Use TLS data encryption.
  • NONE: Turn off TLS encryption.

Analyze limits parameters

The analyze limits parameters define thresholds used for the central manager limits tile on the Deployment Health Dashboard and elsewhere. For more information, see Deployment health dashboard.

Parameter Value Type Description
CLASSIFIER_MEMORY_USAGE_THRESHOLD Integer

Valid values: 1 - 100
HTTP_GIMSERVER_AUTH_CONNECTIONS_THRESHOLD Integer

Valid values: 1 - 100
HTTP_GIMSERVER_CONNECTIONS_THRESHOLD Integer

Valid values: 1 - 100
HTTP_GUI_CONNECTIONS_THRESHOLD Integer

Valid values: 1 - 100
MYSQL_CONNECTIONS_THRESHOLD Integer

Valid values: 1 - 100
OPEN_HANDLERS_THRESHOLD Integer

Valid values: 1 - 100
RUNNING_PROCESSES_THRESHOLD Integer

Valid values: 1 - 100
UNAUTHENTICATED_CONNECTIONS_THRESHOLD Integer

Valid values: 1 - 100

Classification parameters

Parameter Value Type Description
classifier_running_timeout Integer Sets a time limit, in minutes, for the housekeeping process (nanny). After the timeout period, the nanny considers the classifier process to be inactive and restarts it.

Valid values: 5 - 720

Default = 30
classifier_gather_data Boolean Enables or disables the gathering of system data.
Valid values:
  • 0: gathering of system data is disabled
  • 1: gathering of system data is enabled
compare_max_row_threshold Integer Changes the display threshold value.

Default and maximum value: 1000 rows

Classifier examples

Use the following example to modify the value of the classifier_running_timeout parameter.
grdapi modify_guard_param paramName=classifier_running_timeout paramValue=50
Use the following example to modify the value of the classifier_gather_data parameter.
>grdapi get_guard_param paramName=classifier_gather_data
ID=0
classifier_gather_data value: false

>grdapi modify_guard_param paramName=classifier_gather_data paramValue=1
ID=0
ok

>grdapi get_guard_param paramName=classifier_gather_data
ID=0
classifier_gather_data value: true
ok
Use the following example to view and modify the value of the compare_max_row_threshold parameter.
grdapi get_guard_param paramName=COMPARE_MAX_ROW_THRESHOLD
ID=0
COMPARE_MAX_ROW_THRESHOLD value: 1000
ok

grdapi modify_guard_param paramName=COMPARE_MAX_ROW_THRESHOLD paramValue=91935
modify_guard_param:
ERR=5059
Error  Parameter Value is greater then MAX allowed : 1000
Error in modify_guard_param. Can not process the request
ok

grdapi modify_guard_param paramName=COMPARE_MAX_ROW_THRESHOLD paramValue=999
ID=0
ok

grdapi get_guard_param paramName=COMPARE_MAX_ROW_THRESHOLD
ID=0
COMPARE_MAX_ROW_THRESHOLD value: 999
ok

Datasource parameters

Parameter Value Type Description
allow_datasource_full_control_by_role Boolean Controls whether assigning a role on a datasource gives the role full control over the datasource.
Valid values:
  • false
  • true

Default = false
customtable_running_timeout Integer Sets a timeout mechanism, in minutes, for a hung custom table data upload. When a datasource hangs, the custom data upload stops after the timeout period and skips to the next datasource in the queue.
MIN_OPTIMIZE_SIZE Integer For a specified database, sets the minimum size for optimization. The size must be between 1000 and 10000000.

Datasources example

Use the following command to modify the value of the customtable_running_timeout parameter.
grdapi modify_guard_param paramName=allow_datasource_full_control_by_role paramValue=true customtable_running_timeout paramValue=5
Use the following command to modify the value of the datasources parameters.
grdapi modify_guard_param paramName=paramName=customtable_running_timeout paramValue=5

Health analyzer parameters

These parameters control the predictions of DB sizes and files on disk (/var). For more information, see DB sizes and files on disk (/var).

Parameter Value Type Description
HEALTH_ANALYZER_DB_LOOKAHEAD_DAYS Integer Alerts are sent if the HEALTH_ANALYZER_DB_USAGE_THRESHOLD is predicted to occur in the next HEALTH_ANALYZER_DB_LOOKAHEAD_DAYS.

Default = 14
HEALTH_ANALYZER_DB_SAMPLE_DAYS Integer The number of immediately preceding days that the DB growth is monitored. Use this parameter to predict future usage.

Default = 7
HEALTH_ANALYZER_DB_USAGE_THRESHOLD Integer The DB size threshold (in %) at which an alert is sent. 100% size varies according to the Guardium system type (50% of /var for collector, and 75% of /var for aggregator).

Range is 1 - 100%. Default = 50
HEALTH_ANALYZER_VAR_LOOKAHEAD_DAYS Integer Alerts are sent if HEALTH_ANALYZER_VAR_USAGE_THRESHOLD is predicted to occur in the next HEALTH_ANALYZER_VAR_LOOKAHEAD_DAYS.

Default = 14
HEALTH_ANALYZER_VAR_SAMPLE_DAYS Integer Number of days the /var growth is monitored. Use this parameter to predict future usage.

Default = 7
HEALTH_ANALYZER_VAR_USAGE_THRESHOLD Integer The /var size threshold (in %) at which an alert is sent.

Range is 1 - 100%. Default = 50

Inspection engine parameter

Before you configure the Database Discovered Instances Rules in the GUI, you need to enable inspection engine creation by setting the IE_CREATION parameter to 1. For more information, see Database discovered instances rules and apply_rules_on_discoveredinstances.

Parameter Value Type Description
IE_CREATION Boolean Required for automatic inspection engine creation. Determines whether Guardium automatically creates inspection engines on a collector, based on whether inspection engine creation is enabled on the Database Discovered Instances Rules page.
Valid values:
  • 0 (false): Disable automatic inspection engine creation.
  • 1 (true): Enable automatic inspection engine creation, according on the rules selected on the Database Discovered Instances Rules page.

Default = 0 (false)

Manage SQL parameter

This parameter enables Guardium to dump full SQL details into the local Kafka server.

Parameter Value Type Description
DUMP_DATA_FOR_FORENSICS Integer Determines whether to dump full SQL details into the Kafka server. The full SQL details are used for forensics and analysis. Valid values:
  • 0 (off): Do not dump full SQL details
  • 1 (on): Dump full SQL details

Default = 0

Nanny parameters

These parameters enable and configure sending test messages to the alerter orrsyslog to verify that it is communicating with Guardium.

Parameter Value Type Description
GENERATE_TOMCAT_DUMP Binary Triggers Tomcat core dump.
NANNY_TEST_RSYSLOG Integer Determines whether the nanny process sends test messages to rsyslog. Valid values:
  • 0 (false): Do not send test messages to rsyslog
  • 1 (true): Send test messages to rsyslog

Success messages are severity info, and error messages are severity med (error).

Default = 1
NANNY_TEST_RSYSLOG_FREQ Integer Determines the frequency, in hours, with which the nanny sends test messages to rsyslog.

Default = 0, which sets the frequency to 5 minutes.
NANNY_TEST_SMTP_ALERTER Integer Determines whether the nanny process checks the status of the SMTP alerter.

If set to 1 (true), the nanny establishes that connectivity is available to the SMTP relay server on the server side and reports the results to Syslog. Success messages are severity info, and error messages are severity med (error).

If the SMTP alerter is down, Guardium attempts to restart it, and reports to Syslog indicating success or failure.

Valid values:
  • 0 (false): Do not test the alerter
  • 1 (true): Test the alerter

Default = 1
NANNY_TEST_SMTP_ALERTER_FREQ Integer Determines the frequency, in hours, with which the nanny tests the alerter.

Default = 0, which sets the frequency to 5 minutes.

Quartz scheduler parameters

These parameters provide input to the Quartz Job Scheduler.

Parameter Value Type Description
QUARTZ_LONG_RUNNING_JOB_THRESHOLD Integer Defines the Quartz Scheduler long running job threshold in minutes.

Default = 600 (minutes).

QUARTZ_MAX_LONG_RUNNING_JOBS Integer Defines the maximum number of long running Quartz Scheduler jobs that is considered unhealthy.

Default = 3.

QUARTZ_SCHD_ENABLE_MONITOR Boolean Enable Quartz Scheduler monitoring.

The default is 0 (off).

To turn on, set to 1.

Runtime sensitive object classifier parameters

These parameters help identify sensitive data (such as credit card information) during runtime. For more information, see Runtime sensitive-object identification.

Parameter Value Type Description
MAX_RSOC_HITS_PER_RETURNED_DATA Integer Defines the threshold for runtime sensitive-object identification patterns that do not use a verification method.

Default = 3.

Valid values are 1 to 64.
MAX_RSOC_SIGNATURE_HITS_PER_RETURNED_DATA Integer Defines the threshold for runtime sensitive-object identification patterns that use a verification method (such as national IDs or credit card data).

Default = 1.

RUNTIME_SENSITIVE_OBJECT_CLASSIFIER Integer Turn runtime sensitive-object classification on or off.

The default is 0 (off).

To turn on, set to 1.

Smart card parameter

This configuration is for logging into the Guardium UI using a smart card. For more details, see Enabling smart card authentication.

Parameter Value Type Description
SMART_CARD_MAPPING_REGEX String Sets the value of the regular expression (regex) in the Guardium Portal page to match the user information on a smart card.

Smart card example

Use the following command to modify the value of the SMART_CARD_MAPPING_REGEX parameter.
grdapi modify_guard_param paramName=SMART_CARD_MAPPING_REGEX paramValue="CN?=?(.*?),?OU?=?Test Agency,?OU?=?Test Department,?O?=?Test Government,?C?=?US"

Sniffer parameters

Use the following parameters to manage Sniffer settings.

Parameter Value Type Description
HOST_SERVICE_OS_NAME_CACHE_SIZE Integer Allows you to change the size of sniffer held values in host name, service name, or OS user name caches.

Default = 2048.

The cache size must be between 1 and 25000.
LOG_GENERAL_RESPONSE_LENGTH Number Displays whether the store log_general_response_length CLI command is enabled or disabled.

Default = disabled
SAVED_RESPONSE_QUEUE_SIZE Integer Allows you to change the queue size for saved responses.

SNMP parameters

Use the following parameters to set certain system SNMP settings.

Parameter Value Type Description
SNMP_ENGINE_ID String If required, change the SNMP engine ID. Use the show system snmp engineid CLI command to see the current engine ID.
Note: Engine ID must be unique.
SNMPV3_USER String Create a new SNMP version 3 user account. Guardium recommends that you use the store system snmp user CLI command to create a new user.
SNMP_VERSION String Set the SNMP version for this machine.

Valid values = v2c or v3

Syslog TCP parameters

These parameters manage TPC reception in syslog.

Parameter Value Type Description
SYSLOG_TCP_RECEPTION_ON Integer Controls whether syslog TCP reception is on.

Default = 1 (off)

Set to 0 to turn on.
SYSLOG_TCP_RECEPTION_PORT Integer Specify the port to use for syslog TCP reception.

Default = 10514.

The port number must be between 1 and 65535.

Threat analytics parameters

Parameter Value Type Description
EI_FAILED_LOGIN_DB_USER_THRESHOLD Number The database user threshold for threat analytics failed log ins. Default = 2.
EI_GRANT_DORMANT_WEEKS_DEFINITION Number The number of weeks without activity to register a user as dormant for threat analytics. Default = 8.