Need SAP IQ Community Guidance – Trellix DAM Agent Installation Compatibility and Impact

[Srinath2]

Hello Experts,

We are planning to deploy a Trellix DAM (Database Activity Monitoring) agent on our SAP Sybase IQ 16.1SP05 PL10  environment as part of an enterprise security requirement.
Before proceeding, we want to understand if anyone in the community has implemented a similar setup and can share insights or experiences regarding compatibility and performance impact.

Here are the key details we’ve collected from the Security (DAM) team:

• Tool Name & Version: Trellix DAM 10.2.0

• Deployment Type: Host-based agent installed directly on the Sybase IQ server OS (no SPAN/TAP setup).

• Working Mechanism:

  • The DAM agent operates entirely at the OS level, monitoring SQL activities from memory.

  • It does not connect to the database, create users, or modify any schema/configuration.

  • Monitoring is controlled through rules configured on the Trellix DAM GUI console.

• Performance Impact:

  • The agent is lightweight, with minimal CPU utilization (normal for any agent-based installation).

  • No impact on raw or storage devices.

  • No downtime required during installation.

  • Real-time monitoring based on rule matching (no batch/scheduled jobs).

• Rollback Option:

  • The agent can be stopped or uninstalled from the OS level without restarting the database.

We raised a support case with SAP OEM, and SAP clarified that SAP IQ does not certify or validate third-party monitoring tools — compatibility and performance assurance are the responsibility of the DAM vendor.

However, before we proceed in production, we are seeking advisory inputs or best practices from the community on:

1. Whether anyone has implemented Trellix DAM (or similar tools like Guardium / Imperva) with SAP IQ 16.1.

2. Any observed performance overhead, configuration changes, or tuning considerations.

3. Recommended IQ parameters or OS-level checks to monitor after agent installation.

4. Any precautions, known issues, or SAP IQ processes that could be affected by third-party OS-level monitoring agents.

We are mainly concerned about ensuring that this integration doesn’t interfere with database memory, query processing, or I/O performance.

Any guidance, experience sharing, or reference documentation would be greatly appreciated.

Thanks in advance,
Shahid Hawaldar
Associate DBA – SAP Sybase IQ

[RobertWaywell]

You should ask the vendor if they specifically support SAP IQ. I see that their documentation states that they support "Sybase" but does not specify what "Sybase" database they support. Usually when a vendor only refers to supporting "Sybase" they are referring to SAP ASE, not SAP IQ.