What tables are used to store the apps experiences

[Guillermo Salgado]

Hello to all!
I'm running a POC on a customer and their Security Department is asking for what tables are used in APM to store the monitoring data.
They want to know the data stored on them.
There's exist a database dictionary to show them to the customer?
Regards,
guillermo

[David Lewis]

Hello Guillermo,
Could you let us know what specific data you are interested in ?

For the APM product, there are a minimum of three different stores of data.
- Smartstor for metric data which is a proprietary data store
- A Lucene index storage for transaction trace information.
- The APM database, either in Postgres or Oracle. Data showing in APM Team Center will be stored in the tables with apm_ prefix.
Data reported in CEM will be in the other tables in this database, mostly with prefix ts

When you are talking about app experience, perhaps you are also referring to AXA, in which case some of the user data will be stored in ElasticSearch and the rest will be in Oracle DB used for the deployment.
There is a specific documented database reference for AXA
https://docops.ca.com/ca-app-experience-analytics/17-3/en/reference/database-reference/database-tables

Many thanks,
David

[Guillermo Salgado]

Hello David!
Thanks for your fast response.
The customer will evaluate only APM at this moment.
I'm talking about the results of the monitoring the customer applications.
As a Bank, they are worry about capture and store the financial user data, and they need a prove that we cannot capture these information, looking directly to the apm tables.
That's why they need to know which tables are used to store the results of the monitoring.
I hope to be clear to my request.
Regards,
Guillermo

[David Lewis]

Hi Guillermo,
If it is monitoring apps through agents like the Java Agent, we are unlikely to gather the very detailed information. The agent monitors the performance of calls from an application to a database and can provide details of the database call, but the specific information is normalized. 

CEM is more likely to capture sensitive information as it analyses the HTTP request and response body to match transactions, so there is configuration for CEM to block sensitive information if you provide it parameters to ignore.

I would say if you are not able to see the sensitive information as metrics in Introscope WebView or as part of the transaction traces, then the data has not been captured at all. 
I can say that the product is regularly used by financial institutions to monitor real-user transactions so they would have just the same concerns.

There are also the concerns about security to the data that we do gather so there is some documentation on configuring what users could see what..
https://docops.ca.com/ca-apm/10-7/en/administrating/apm-security/

If you need more specific information, I think it would need more detailed review with our consultants about the actual infrastructure to be monitored, just in case something might appear that is specific to the particular environment.

Many thanks,
David

[Guillermo Salgado]

Thanks a lot!