Defining the query name and attributes

Select the domain, then set the query name, the main entity, and configure roles, datamart, drilldown control, and API assignments.

About this task

When creating a query from scratch, the next step is to select the main entity (from the domain). The main entity that you select determines:
  • The level of detail for the report. There is one row of data for each occurrence of the main entity included in the report. The location of the main entity within the hierarchy of entities is important in terms of what values can be displayed. Attributes in an entity at a higher level in the hierarchy can have a field mode of type value. Attributes in an entity at a lower level in the hierarchy cannot have a field mode of type value. You can see the hierarchy in the entities list in the query-report builder. The hierarchy is exactly as the list displays, from top to bottom.
  • The time fields against which the Period From and Period To runtime parameters are compared to select the data in the report. The Query-Report Builder uses the main entity (among other parameters) to determine which time fields are used when defining the Period From and Period To values. This can be important for long-running sessions, such as when pooled sessions are kept open by an application server. When applicable, the Period Start/Period End from the Access Period entity is used, in other cases it chooses period values according to the main entity:
    • Session - the time stamp used is for the last update that is made to the session entity
    • Session Start - the starting time of the session entity is used
    • Session End - the ending time of the session entity is used
    • Full SQL - time stamp from Full SQL domain; query includes rows from the Full SQL domain even if not linked to values (for example - when Log Full Details is set, there are no values)
    • Full SQL Values - time stamp from the Full SQL  domain; query includes rows only if they have values from the Full SQL domain even if not linked to the Field domain
    • Field SQL Values - time stamp from the Full SQL  domain; query includes rows only if they have values from the Full SQL domain and they are linked to the Field domain
Other options in this row are:
  • Partition optimization is enabled by default and improves query performance with partitioned database tables. You can disable this feature by clearing the Partition optimization check box. Partition optimization should not be disabled without the direction of Guardium support.
  • Run in Two Stages. Use this selection for two-stage execution for Audit tasks of type report. This applies to reports on queries on specific tables only. This two-stage mechanism applies to running queries as audit processes with columns and conditions only on the following entities: Access (client/server), Session, Access Period, Construct (SQL), Object, and Sentence (Command). This two-stage mechanism is not used if the query contains a condition with the Like Group operator or any alias-related operator (such as In Aliases Group) or the condition uses Having. By default, queries run in one stage. to disable two stage queries system wide, create the file: /var/log/guard/DontRunInTwoStages. Existence of this file indicates that the two stage method is NOT used.
    Note: Fields containing tuples (combined fields) in the Two Stages execution is not supported.
Note: The Main Entity drop-down list includes only primary entities. However, access to secondary entities (for example Session Start and Session End) can be done through its corresponding primary entity (for example, Session for Session Start and Session End).

Procedure

  1. For both cloned and new reports, in the right pane, enter a unique query name in the query name textbox. (You can use Ctrl+V to paste, or type the query name; right-click to copy the query name is not supported.)
  2. Select the main entity from the drop-down list.
  3. Click Next to select columns and save the query. Once the query is saved, additional buttons in this row become available, as relevant.