Creating a Distributed Report

Create and modify distributed reports on a central manager.

About this task

In this example, you'll see how to get a broader view and correlation insight for Exceptions (for example, SQL Errors) that are recorded on specific collectors.

This screen capture shows an example of a distributed report: Correlate Total Exceptions By User (Distributed). This view sums the total exceptions per user from all databases that are associated with the Guardium Managed Units selected for this Distributed Report. Likewise, you can view the Total Failed Login Attempts system wide, or the Total Exceptions per Source Programs.

In this specific example, the report data is gathered hourly - there is no need to wait at least an hour to get the initial results.

Note: The line saying ‘Distributed Report status – click here for details’, shows the status of data gathering, if data is missing from managed units then the line is colored in red; clicking the line navigates to details report of status per units per hour.

1. Click Reports > Report Configuration Tools > Distributed Report Builder.
2. Click New.
3. Select a report from the Based on Report drop-down list as the base for this distributed report. In this example, choose Exceptions Details.
   
4. In the Gather Data From section of the builder, choose All Managed Units (that the Central Manager is managing) or specify certain Group and Specific Managed Units, whose data will be included in the distributed report. If the Central Manager is also an Aggregator, it might need to be included. For this example, choose two groups from the Group list, and a few managed units from the Managed units list, but leave the ‘Central Manager’ unchecked.
5. In the Operation Mode, select the type of report: immediate or scheduled. The Immediate mode is mainly for online / real-time monitoring, such as, view the recent Failed Login Attempts, view recent Excessive Exception, or view real-time alerts. The Scheduled mode is an ongoing data-gathering that runs periodically based on the Schedule defined. This example summarizes the exceptions every hour. There is a requirement for filling in values for Exception Description and Destination Address.
   
   The Send data to and Send data to (secondary) fields define where distributed data is consolidated and made available for reports. By default, data is collected from managed units and made available on the central manager, but it is possible to send the data to any Guardium system using these fields. Send data to (secondary) defines a backup or secondary system where data is also sent. Either Send data to or Send data to (secondary) can identify a central manager, and it is possible for both fields to identify managed units if the data is not needed on a central manager.
6. Click Apply to create the Distributed Report.
7. Define the schedule by clicking Modify Schedule (this is mandatory to activate the process). A standard Schedule Definition window opens. Fill in all required details. See Scheduling for more information on scheduling.
8. Once applied, the new Distributed Report is added and highlighted in the list box.
   
9. If you want to limit the roles for this report, click Roles to open the Assign Security Roles window; select the roles and click Apply.

Results

The data is gathered from all the specified Managed Units and is stored in new designated entity (table). This entity is now available via the Query-Report Builder for use when creating additional queries. The option to build additional queries are available via the Distributed Report result screen as well. Click Edit the query for this report.

This default Report cannot be changed, click Clone, name it, remove all attributes and leave the Date, User Name, Exception Type Description, and Sum Of Count Of Exceptions.