Architecture, Installation, and Upgrade
Roles and topology
Guardium Data Protection (GDP) v11.x separates capture, storage, and management. An S-TAP (with the GIM client) runs on the database host and forwards traffic to a Collector, which parses SQL, applies policy, and stores audit records in its internal database. Aggregators consolidate data from multiple collectors for longer retention and cross-collector reporting. A Central Manager (CM) holds configuration-policies, users, data sources, alerts-and distributes it to managed units; it is not in the traffic path.
Install and upgrade rules
- Choose the unit type during appliance setup: Collector, Aggregator, Central Manager, or a combined role such as a standalone collector.
- Deploy S-TAP through GIM after the collector is registered with the CM, or install manually when GIM cannot reach the host.
- Upgrade in order: CM first, then aggregators, then collectors, using patch distribution from the CM. Check S-TAP/collector compatibility before pushing.
- Run pre-upgrade health checks and a configuration backup.
Worked example
Three Oracle servers in a PCI segment need centralized audit. Install a collector in the segment, a CM in the management zone, and an aggregator for 12-month retention. Register the collector to the CM, deploy S-TAP via GIM, confirm traffic, then upload the patch to the CM and push it to managed units in order. The CM never sees database traffic, so capacity planning belongs on collectors and aggregators.
Traps
Assuming the CM sees traffic; upgrading a collector before its CM; forgetting that GIM must be installed before S-TAP; mixing incompatible S-TAP and collector versions.