Troubleshooting and Performance Tuning
Diagnostics
must_gather collects logs and configuration for support; run it before restarting so evidence is preserved. Check /var/log/guardium on the appliance and S-TAP logs on the database host. grdapi queries and changes settings from the CLI, and the Health Check tool supports pre-upgrade and periodic checks.
Performance
Common causes: collector CPU or buffer pressure, oversized S-TAP capture scope, slow reports, and aggregation load. Reduce capture with sql_watch and object filters, increase buffer only with disk headroom, and move reporting to an aggregator. Check S-TAP and collector versions first; packet loss on a SPAN feed also causes gaps.
Worked example
A collector shows high CPU and buffer warnings. Run must_gather. Check top sessions and buffer usage; the S-TAP is capturing all schemas. Narrow sql_watch to the audited schemas, restart the tap in a maintenance window, and compare CPU. If reports remain slow, run them on the aggregator instead.
Traps
Restarting before must_gather; raising buffer without disk; blaming the collector when the S-TAP version is wrong; ignoring aggregation windows that overlap peak reporting.