IBM Guardium - When to Restart, When to Reboot

To see full traffic, certain databases must be restarted after an S-TAP installation.

UNIX/Linux S-TAP

Table 1. Database restart after S-TAP installation

SHM - Shared memory

NR = No restart/reboot required (based on utilizing live update mechanism and referencing live update link if you have one)

REQ = Restart required

REQ * = restart required for database and listener

REQ-Exit = In this case, an A-TAP or Exit driver is required to capture shared memory traffic. Restart of the database is required in order to activate the process. Restart the S-TAP before restarting database. See additional Informix Exit and DB2 Exit restart instructions below.

NA = not applicable

Note: MySQL database with RedHat operating system - NR

Note: A restart of the database instance is required in cases where connection pooling is used. (The DB listener needs to be restarted in an application server environment because all sessions need to disconnect and then reconnect.)

Note (V10.0 UNIX/Linux S-TAP) - Nothing is different about when to restart, but in v10. Guardium no longer supports the"guard-stap-update script" anymore. Instead, the shell installer provided has the upgrade logic incorporated into it, so just run the new installer.

Informix exit and DB2 exit restart instructions when upgrading

For DB2 exit

When upgrading S-TAP , user will need to:

1. Stop DB2.

2. Upgrade S-TAP.

3. Copy latest db2 exit lib to DB2 commexit directory.

4. Restart S-TAP.

5. Start DB2.

When patching DB2, user will need to:

1. Stop DB2.

2. Patch the DB2 database.

Note: In case the DB2 configuration is overwritten, then user will need to re-enable using:

db2 UPDATE DBM CFG USING COMM_EXIT_LIST libguard_db2_exit_64

3. Start DB2.

For Informix exit

When upgrading S-TAP with ifxguard activated:

1. Stop ifxguard.

2. Upgrade the S-TAP.

3. Copy the libguard_informix_exit_64.so from guard_stap directory to Informix lib directory.

4. Start ifxguard.

5. Restart S-TAP.

6. Start Informix.

When patching Informix, user will need to:

1. Stop ifxguard.

2. Patch the database.

3. Start ifxguard.

What must be restarted after a live upgrade of UNIX/Linux S-TAP

No restarts are necessary at all for live upgrades that do not include ATAP.

UNIX/Linux S-TAP Guidelines

No reboot

S-TAP/KTAP may be upgraded without a reboot when using the "guard-stap-update" utility. This utility can be used from V8.0 versions and up. (For v10.0 UNIX-Linux S-TAP, see note above about Guardium now longer supporting "guard-stap-update" utility.)

If the system is being "upgraded" from a non-GIM version to the same GIM version, the system doesn't need to be rebooted.

If upgrading a non-GIM S-TAP with GIM BUNDLE-STAP, with the same revision number that is currently running, no reboot is required.

Bundle GIM upgrade (in addition to bundle S-TAP upgrade) is required ONLY in the following upgrade paths:

• If you are going from V8 to V9.

  If you have a V9 bundle S-TAP installed with a patch LOWER than V9.0 patch 100 or build number LOWER than 9.0.0_r57263.

  All the other upgrade paths do NOT require bundle GIM upgrade.

A reboot of the database server is required if upgrading from Guardium V7.0.

Upgrade S-TAP at next reboot with the Guardium Upgrader utility. This utility is used to upgrade from Guardium V7.0 shell installers. Use of this utility requires a reboot.

If you are removing a previous version of S-TAP that used KTAP, you will need to reboot the database server.

When upgrading S-TAP through GIM:

• If specifying KTAP_LIVE_UPDATE=Y, no reboot required.

  If specifying KTAP_LIVE_UPDATE=N, a reboot is required.

To re-install S-TAP with KTAP using the same revision number requires an un-install and a reboot.

After installation of UNIX ATAP in Oracle cluster environment, instances must be restarted as well as all inter-cluster processes.

Restart/load/instrumented/activated requirements for ATAP

ATAP or S-TAP or KTAP are not rebooted.

S-TAP is stopped/started/ restarted. KTAP is loaded/unloaded. ATAP is instrumented/ activated/ deactivated/ de-instrumented.

Database instances which require ATAP must be stopped prior to instrumenting (if required) and activation.

De-instrumenting or deactivation of ATAP also requires appropriate database instances to be stopped.

ATAP should be deactivated (and de-instrumented, if applicable), prior to any upgrades of the database, such as when a Fixpack is applied.

Finally, ATAP should be deactivated and de-instrumented prior to any S-TAP upgrades (not necessary for GIM bundle upgrades).

Windows S-TAP

Table 2. Database restart after S-TAP installation

NR = No restart/reboot required (based on utilizing live update mechanism and referencing live update link if you have one)

• Databases do not need to be restarted
• Reboot database servers only when you need to upgrade the driver