Job dependencies
When you create and schedule tasks such as installing policies, updating groups, or running audit processes, you can run the task on a schedule that you define for that process. If that task (the parent) depends on other scheduled jobs (such as jobs that populate groups that are needed by the audit process), then the schedule must ensure that related jobs run and complete in a timely manner before the parent task starts.
Manually defining a schedule that includes these dependent jobs can be complicated or impossible. Therefore, to automate the process, select Auto-complete dependent jobs, which takes the following steps:
- Guardium checks to see whether the parent task has dependent jobs.Note: This is a specific check: For example, if the parent task depends on a group, and the group is populated by a query, the query that populates the group must run first to refresh the group (that is, the parent task depends on the group). However, if that group is static or not populated by a query, then the parent task does not have a dependency on the group. In this case, it is your responsibility to ensure that the data in the group is up to date.
- If dependent jobs are found, Guardium checks to see whether the jobs have run in the past 24 hours.
- If the dependent jobs have not run in the past 24 hours, Guardium runs the dependent jobs in the appropriate order. That is, if dependent jobs have dependencies on each other, they are run sequentially and in an order that clears those dependencies.
- After all of dependent jobs run successfully, the parent job runs.
- If any of the dependencies fails to run, the job that is currently scheduled does not run. If a failure occurs, an error message is written to the Scheduled Jobs Exception report. The dependent job will retry three times, three minutes apart before failing.
| Job type | Dependent jobs | Reason |
|---|---|---|
| Audit process with discover sensitive data task | Where the task includes a discover sensitive data scenario with a for Add To Group of Objects, Add To Group of Object/Fields or Add To Access Rule. For more information, see Discovery scenarios and What to discover. | Before installing policy rules that use groups, the group data must be up to date. |
| Audit Process with report task | A custom table upload job where the custom table name is referred to by the report audit task. | Custom table data that is referred to by a report-type audit task must be populated with up-to-date data before the Audit Process can run. |
| Audit Process with report task | Groups that are defined in an audit task report condition that are populated by the 'Populate From Query' mechanism. | Groups that are referred to by a query condition must be populated with up-to-date data before a report-type Audit Task can run. |
| Audit Process (for aggregators) | Import | For aggregators only. Ensures that information is imported from all aggregated units before any audit process can run. |
| Policy Installation with a discover sensitive data task | Groups that are defined in any policies to be installed that are populated by the 'Populate From Query' mechanism. | Before installing policy rules that use groups, the group data must be up to date. |
| Populate From Query | Populating a query that uses an uploaded custom table as an entity. | For any entity that uses populate from query with custom table data, the custom table must be populated with up-to-date data. |
To enable job dependencies, select Auto run dependent jobs in the Scheduler of a task. When you save the task, a window opens with details of the prerequisite jobs that must run before this job runs.
To identify job dependencies, run the auto_execute_suggested_dependencies API with the jobTrigger=<job name> parameter.
To obtain a list of all the scheduled jobs and triggers, run the list_scheduler_jobs API.