PAM does not correctly create database objects on External Log Server

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

You followed the procedure documented on page Configure an External MySQL Database for Session Logs (Optional) to have PAM send all session log messages to an external database. You did this in the past and know that PAM should create three database tables with names log, log_device_group and log_user_group. But you find that PAM creates only table log, with the other two missing.

Cause

The tomcat log, which can be downloaded from the Configuration > Diagnostics > Diagnostic Logs > Download page, contains the following error:

2026-01-28T19:56:20.058+0000 SEVERE [TP5] com.ca.pam.rest.LogsConfigService.saveExternalLogConfig Call to Gatekeeper service controller failed: java.sql.SQLException: Unable to create or change a table without a primary key, when the system variable 'sql_require_primary_key' is set. Add a primary key to the table or unset this variable to avoid this message. Note that tables without a primary key can cause performance problems in row-based replication, so please consult your DBA before changing this setting.

The log table has its own primary key log_id. The log_device_group and log_user_group tables don't have their own primary key but use foreign key log_id as their unique key. When system variable sql_require_primary_key is enabled, the MySQL server blocks creation of these two tables.

Resolution

Temporarily disable system variable sql_require_primary_key before configuring the external log server in PAM. Once the tables are created, you can enable the variable again.

If you already have a database configured, where PAM created only the log table, start over or remove the log table at least. PAM will not attempt to create any of the database tables, if it finds that the log table exists already.