DAM must ensure the continuity of monitoring database environment which precludes any interruption resulting from the need to update the software.
Guardium contains very well designed the update mechanism of the monitored infrastructure with minimal administrator attendance requirements.
Infrastructure patches (appliance patches) can be categorized due to their functionality (categorization is related with patch numbering):
- px0,px00 – Guardium Patch Update (GPU), cumulative patch of Ad-Hoc patches, it can contain new features introduced inside current major version. In most cases does not contain any prerequisites
- p0x-pxxxx – Ad-Hoc patch, contains updates for particular functionality with identified defect – usually related to PMR (Problem Management Resolution). Strictly related with specific GPU. Very often published as a bundle of Ad-Hoc updates
- p6xxx – Security Patch, related with update the vulnerable parts of the specific elements of RedHat, MySQL and other. Can be combined inside GPU patch
- p4xxx – Sniffer Patch, update for collector sniffer
Important: Before installing the patch, review the documentation that came with it
Many patches require appropriate GPU or specific settings on the appliance. Patch installation can be tied with appliance restart or temporary services unavailability.
Process of patching is very simple. After patch download the Guardium administrator has to upload it on central manager. Later using Central Manager console his is able to schedule patch installation on all other appliances inside management domain.
Internal CM patching uses standalone procedure (described later in the article).
All patches are available on IBM Fix Central – http://www.ibm.com/support/fixcentral/
Access to patches and updates requires IBM customer account registration
The form is simple. You do not need put here any Guardium contract information.
To download patch go on Fix Central to “Select Product” tab and point Guardium using content related set of fields
and Browse for fixes
The list of available patches is presented inside functional categories.
System provides possibility to download patch using FTP, HTTP or IBM Download Director tool (requires Java). Last method allows the upload many files in one session
Patches are archived in ZIP format (unzip it before patch upload on collector or central manager). Here is an example of content the Guardium p01 archive
All appliance patches are encrypted and signed to prevent drive by download infection. In most cases the documentation in PDF format is also included and file with MD5 hashes for archive content.
Downloaded patch file (*.sig) should be moved on FTP or SCP server, DVD or into the directory available for browser with access to Guardium portal.
In Guardium 10, when browser has access to the internet the notification about new available patches will be displayed under message icon on status bar
Message contains also direct link to patch on Fix Central. Notification contains information about patches which are not installed on the appliance where user is actually logged in.
Info: New patch notification in portal uses browser snippet. It does not require internet access for appliance
Patch backup configuration
Guardium provides self-protect technique in case of patch installation failure. For patches which are changing critical system parts it creates additional backup of crucial appliance resources what can allow to restore system to state before patch applying.
Patch backup is stored remotely and transmitted using SCP connection. Storage for patch backup can be configured under (Setup->Tools and Views->Patch Backup)
Storage configuration is validated and left the temporary file on it
Patch installation methods
Guardium provides the patch installation invocation from patch file stored locally on the appliance or downloaded remotely over FTP or SCP.
Each method can be divided into two phases: patch upload with registration in patch pool and patch installation. All patches uploaded to the standalone appliance are stored locally and can be used later in case of reinstallation or scheduled installation.
In case of installation by CM the patch file is transmitted to appliance from CM and removed from it after installation.
FTP or SCP patch upload
Installation can be invoked by CLI:
store system patch install ftp store system patch install scp
Both commands are interactive and we need to insert the account credentials and the location of the patch. In this case, two patches were uploaded from FTP server
and this same for SCP, additionally the patch installation sequence was ordered
Installation from CD
Only installation from appliance DVD drive allowed
Patch upload using Guardium fileserver
Execute fileserver from CLI using command
fileserver <your_browser_ip> <time>
and then go to http://your_appliance_ip_address. Use Browse button to point the patch file and Upload it on the appliance
After a while the message similar to below will be displayed
When all patches will be uploaded close the fileserver – press ENTER in the CLI session. Another message will inform you about correctness of patch registration on the appliance
Now we can review the list of patches available on collector using CLI
show system patch available
or in the portal under Manage->Reports->Install Management->Available Patches report
Now we can start the patch installation. From CLI execute the interactive command
store system patch install sys
this syntax defines immediate start of patch installation. To schedule it you can use syntax
store system patch install sys <YYYY-mm-dd> <hh:mm:ss>
Status of path installation can be monitored by command
show system patch installed
Correctness of installation notices the status “DONE: Patch installation Succeeded”
We can also invoke installation from Available Patches report. From Action menu select patch_install
In the pop-up window select patch for installation and schedule time for execution (NOW means immediate start) and push the Invoke now button
Status can be monitored by report Manage->Reports->Install Management->Installed Patches
You can also notice that this patch installation invoked patch backup, new file in the archive appears
Patch installation in Enterprise environment
Guardium is enterprise solution and provides central management for all appliances in the environment.
Info: You do not need upload patch manually to all appliances in managed environment.
The patch installation rules in managed environment:
- Upload and install patch on central manager. In HA configuration install patch on CM backup and promote it as primary then install patch on CM master.
- Execute remote patch installation on aggregation layer (if it exists)
- Move S-TAP’s to backup collector from target of the update and execute remote patch installation
- Restore standard connection of STAP’s to updated collector and update remotely the backup collector
Patch installation is not required on CM before installation it on other appliance but best practice suggests update from top to down.
Patch installation on the CM has to be executed manually (described earlier).
Remote patch installation on aggregator or collector is managed from Manage->Central Management->Central Management form. To order patch installation select appliances and press Patch Distribution button
Then select patch and start installation using Install Patch Now button
Installation can be scheduled (Schedule Patch). Task execution will be notified by separate message
The Patch Installation Status displays current status of task in the pop-up window
Global patch installation review is available in separate view for all appliances managed by CM. From Central Manager form select Patch Installation Status
Sometimes patching may fail. If the error is associated with the patch preparation to system change the simple patch task removal is possible. Here is example where patch return status ERROR and command
remove it from the list and patch installation can be repeated
This command removes patch copy from the appliance. You need to upload patch again.
When patch installation fails (status FAIL) during system modification phase the IBM support should be involved to restore patch backup copy.
This command should be executed with IBM support cooperation.
The space occupied by the patches may grow over time, so you may need to remove them from the appliance.
There is no direct command or portal functionality for patch files removal on standalone appliance. However the command
support clean log_files /
displays list all large files in the log directory (larger than 10 MB) including patch files. Then we are able to point path to patch file and confirm its deletion
On the Central Manager the patch file can be removed from portal. From Patch Distribution form press red X icon in the patch row
additional pop-up window will request for confirmation
Then patch will disappear from Available Patches report
Info: Guardium does not provide the patch uninstallation procedure
Guardium appliance patch mechanism speed up the update process in large monitoring environments. All tasks can be executed from Central Manager.
Update process can be managed also from CLI for standalone installation and CM layer. Patches are encrypted and signed to avoid drive by download attacks.