The Guardium Installation Manager (GIM) is a very flexible, powerful, lightweight module of the IBM Security Guardium solution intended to ease the management of the other Guardium software that is deployed at the DB hosts (S-TAP, CAS, FAM, K-TAP, the GIM itself, etc.).
A very common task for large enterprise level infrastructures, is having the need to move some of the already deployed GIM clients to point to another GIM server (in this context, the GIM server can be any Guardium appliance, but it is recommended to use a Central Manager for easiness of management), either by a reorganization of the infrastructure, appliance's role changes, etc.
In this article, we will discuss two ways to accomplish the task.
Explain how to easily move a GIM client to point to another GIM server.
The images describing the method documented in this article are based on Guardium v10.5.
The same principles apply for previous versions of Guardium, simply, get familiar with the name and location of the menus at the GUI that correspond to your version.
- Moving a GIM client to another GIM server using the GIM's GUI.
This method can be used when you have a fully operational GIM client, and it is connected properly to the GIM Server.
1. Open the GIM Server's GUI (appliance). Navitage to "Manage -> Module Installation -> Set up by Client". From there, select the GIM client you wish to move, then hit the "Next" button.
2. Now, find the currently installed GIM bundle client at the selected machine, by selecting the module from the list menu. If needed, apply some filters to help you out to find it. Once done, click on the "Next" button.
3. At the "Choose parameters" section, use the list menu to find a parameter named "GIM_URL". Here, set the IP address of the new Guardium machine that will serve as the GIM Server. Once done, hit "Next".
4. At the new frame that appears, double check the GIM Client name and the new GIM Server IP. If everything is correct, click on the "Install" button.
5. The button will turn into a list menu. From there, select the absolute or relative time when you want to submit the change and then, click "OK".
You will see a pop-up window that notifies about the action. Just close it.
6. To monitor the status of the process, move to the "Choose bundle" section of the "Setup by Client" window. There, you must see the "Status" column again as "Installed".
Tip: you can exploit the benefits of the report named GIM Events List ("Manage > Reports > Install Management > GIM Events List") in order to monitor/confirm a successful installation.
- Moving a GIM client to another GIM server using the GIM's CLI.
This method is useful when the GIM client is not connected anymore to the GIM server (for example, if the GIM was already server was decommissioned, or is not reachable anymore by the GIM client), so the GUI method will not work.
It is also useful when you have the need of applying the change using a custom build script or application.
Note: the method implies to have root access to the GIM client.
1. First, fully identify the GIM installation folder (the one you set up as the installation prefix during the installation).
Note: One possible approach in Linux and UNIX systems could be to query the process table, looking for the string "gim".
2. Using that folder as a prefix, you must be able to find a script called "configurator.sh" at the "/guardium/modules/UTILS/current/" sub-folder. The below is a sample of it.
Tip: you can use the standard Linux/UNIX find command to find the absolute path of that file, using the GIM installation prefix as a starting point for the lookup.
3. You must use the absolute path of the "configurator.sh" to run it, so that:
- If you want to know current GIM server IP address:
|<absolute_path_to_configurator.sh> --get GIM | grep -w GIM_URL|
- If you want to set a new GIM server's IP address:
|<absolute_path_to_configurator.sh> --set GIM_URL <GIM_SERVER_IP>|
4. Wait for a couple of minutes for the change to take effect. After a while, issue run the getter of the "configurator.sh" utility again to see if the change is committed.
Tip: you can confirm if the change was successful by querying the most recent lines of the "GIM.log" file. This file should be at the "<GIM_installation_prefix>/guardium/modules/GIM/current/GIM.log" path.
03 September 2018