Windows: S-TAP user's guide
The Guardium S-TAP is a lightweight software agent installed on database servers and file servers. The S-TAP generally accounts for between 1% - 3% of CPU usage. In most installations, the impact is negligible with no noticeable impact on performance. The information collected by the S-TAPs is the basis of all Guardium traffic reports, alerts, visualizations, etc.
For data activity monitoring, the S-TAP monitors activity between the client and the database and forwards that information to the Guardium collector. The database traffic is logged into the collector based on criteria specified in the security policy. You can reduce the amount of traffic that is originally sent to the collector by ignoring trusted connections or ignoring traffic from specific IPs.
Limitation: Windows S-TAP does not support MySQL encrypted traffic.