Abstract: A method by a security analysis server to generate a traffic monitoring rule. The method includes receiving, from a database agent because of a current configuration of the database agent, counts of an amount of traffic sent over a first set of one or more of the database connections being monitored by the database agent and generating a traffic monitoring rule that indicates database connections for which the database agent is to send counts of an amount of traffic, rather than all the traffic, sent over those database connections to the security analysis server because those database connections have been determined by the security analysis server to be of an application database connection type based on an analysis by the security analysis server of the counts. The method further includes applying the traffic monitoring rule by sending instructions to the database agent to alter the current configuration.

Abstract: A method by a security analysis server to generate a traffic monitoring rule. The method includes receiving, from a database agent because of a current configuration of the database agent, counts of an amount of traffic sent over a first set of one or more of the database connections being monitored by the database agent and generating a traffic monitoring rule that indicates database connections for which the database agent is to send counts of an amount of traffic, rather than all the traffic, sent over those database connections to the security analysis server because those database connections have been determined by the security analysis server to be of an application database connection type based on an analysis by the security analysis server of the counts. The method further includes applying the traffic monitoring rule by sending instructions to the database agent to alter the current configuration.

Abstract: A method by a security analysis server to generate a traffic monitoring rule. The method includes receiving, from a database agent because of a current configuration of the database agent, counts of an amount of traffic sent over a first set of one or more of the database connections being monitored by the database agent and generating a traffic monitoring rule that indicates database connections for which the database agent is to send counts of an amount of traffic, rather than all the traffic, sent over those database connections to the security analysis server because those database connections have been determined by the security analysis server to be of an application database connection type based on an analysis by the security analysis server of the counts. The method further includes applying the traffic monitoring rule by sending instructions to the database agent to alter the current configuration.

Abstract: A method by a security analysis server to generate a traffic monitoring rule. The method includes receiving, from a database agent because of a current configuration of the database agent, counts of an amount of traffic sent over a first set of one or more of the database connections being monitored by the database agent and generating a traffic monitoring rule that indicates database connections for which the database agent is to send counts of an amount of traffic, rather than all the traffic, sent over those database connections to the security analysis server because those database connections have been determined by the security analysis server to be of an application database connection type based on an analysis by the security analysis server of the counts. The method further includes applying the traffic monitoring rule by sending instructions to the database agent to alter the current configuration.

Abstract: Apparatus, methods and computer-readable medium for displaying information related to performance of a given database statement which accesses a plurality of multi-partition objects during a time interval. In some embodiments, the method comprises: a) determining, for a given database statement that accesses a plurality of index or table partitions during the time interval, for each accessed partition of a plurality of partitions, a respective aggregate wait time associated with said accessed partition; b) in accordance with the determined wait times for the given database statement, presenting, to a user, a description of performance of the database during the time interval.

Abstract: Apparatus, methods, and computer readable medium for monitoring a database and for determining aggregate I/O wait times (i.e. for a ‘target’ index or table) associated at least one I/O category selected from a plurality of I/O categories are disclosed herein.

Abstract: Apparatus, methods, and computer code for monitoring a database and for determining estimated aggregate disk-sort wait times for a database statement and/or database table and/or database index and/or database session are described. A description of database performance may be presented to a user in accordance with the determined aggregate disk-sort wait time(s).

Abstract: Apparatus, methods, and computer code for monitoring a database and for detecting execution plan changes in the database. In the event that an execution plan is detected for a given database statement during the course of the monitoring, an alert signal may be generated. Optionally, the generation of the alert signal is further contingent upon a property of the database statement for which an execution plan change has been detected, for example, an execution time. In some embodiments, a detection agent is configured to repetitively attempt to detect an execution plan, for example, in accordance with a specified frequency parameter.