Welcome Serena Central users! CLICK HERE
The migration of the Serena Central community is currently underway. Be sure to read THIS MESSAGE to get your new login set up to access your account.
Highlighted
hima.cholakurus Trusted Contributor.
Trusted Contributor.
1248 views

Error with map.0.properties file

Jump to solution

Hi,

I have a syslog smart connector installed on the linux server.The connector version=7.5.0.7983.0

My requirement is  to assign a  string constant value to  'sourceUserPrivileges' depending on the different values for field 'destinationDnsDomain'.I tried using map.0.proerpties file and restarted the connector,but it is not working.I checked in agent.log and found this error:

[2017-08-01 11:21:37,947][INFO ][default.com.arcsight.agent.n.c][getInputStream] Resource [map.0.properties] found in [/opt/SC-SYS-UCBAP-QA1/current/user/agent/map/map.0.properties]
[2017-08-01 11:21:37,947][FATAL][default.com.arcsight.agent.c7.d][loadLookUpTable] Format is not correct, expected [5] columns, received [2] with tokens [[event.deviceDnsDomain, set.event.sourceUserPrivileges]]
[2017-08-01 11:21:37,948][ERROR][default.com.arcsight.agent.loadable._AgentNATProcessor][init] Unable to load map mappings from [map.0.properties]
[2017-08-01 11:21:37,948][ERROR][default.com.arcsight.agent.loadable._AgentNATProcessor][init]
com.arcsight.common.InitializationException: Exception initializing 'com.arcsight.agent.c7.d': Unable to Read table look up setter information.
        at com.arcsight.agent.c7.d.<init>(d.java:284)
        at com.arcsight.agent.dn.ai.j(ai.java:211)
        at com.arcsight.agent.dn.ai.a(ai.java:252)
        at com.arcsight.agent.util.ar$b.run(ar$b.java:203)
        at java.util.TimerThread.mainLoop(Timer.java:555)
        at java.util.TimerThread.run(Timer.java:505)
[2017-08-01 11:21:57,714][WARN ][default.com.arcsight.agent.dl.d][lookupAllByName] Cannot find information for [usqm3qlww01.-]
[2017-08-01 11:21:59,532][INFO ][default.com.arcsight.agent.util.ah][checkStatusLine] E0:rzP0mF0BABCAAeCP2+pkPA==->|20005|40:100|20000|32:99|10005|11:103|19999|34:100|20005|54:103|9994|8:96|20009|16:103|19997|16:98|9999|8:96|20003|16:97|20003|26:98|20001|16:97|10001|8:97|20008|17:103|19995|16:96|10002|8:97|20002|16:97|20002|17:98|10005|8:102|19998|24:98|20002|18:98|

I could see the values present in the filed destincationDnsDomain,but sourceUserPrivileges is not getting the proper value.Here i am pasting an example of how i did it in map.0.properties file.

event.destinationDnsDomain,set.event.sourceUserPrivileges

A,X

event.destinationDnsDomain,set.event.sourceUserPrivileges

B,Y

 

 

Labels (1)
0 Likes
1 Solution

Accepted Solutions
Michel Beaudry Outstanding Contributor.
Outstanding Contributor.

Re: Error with map.0.properties file

Jump to solution

Hi,

 

As the agent log pointed out, your map.0.properties contains 5 tokens on the first line and this is what is being evaluated y the connector framework. Since this line refer to an example, it should be commented out with a # at the beginning of the line.

Then all you only need in your map.0.properties is:

event.deviceDnsDomain,set.event.sourceUserPrivileges
ebanking.qc.unicreditgroup.ae,CorporateAD
ebanking.qc.unicreditgroup.de,CorporateDE
ebanking.qc.unicreditgroup.it,BusinessItaly

This should work

 

Regards,

 

Michel Beaudry

5 Replies
Michel Beaudry Outstanding Contributor.
Outstanding Contributor.

Re: Error with map.0.properties file

Jump to solution

It would be much easier to help you out if you upload the actual map.0.properties file.

 

0 Likes
hima.cholakurus Trusted Contributor.
Trusted Contributor.

Re: Error with map.0.properties file

Jump to solution

Hi,

here i am uploading the contents of map.0.properties file

event.targetAddress,event.targetPort,set.additionaldata.networkid,set.additionaldata.nattedtargetaddress,set.additionaldata.nattedtargetport
#0.0.0.1,80,netid2,2.2.2.1,8080

event.deviceDnsDomain,set.event.sourceUserPrivileges
ebanking.qc.unicreditgroup.ae,CorporateAD

event.deviceDnsDomain,set.event.sourceUserPrivileges
ebanking.qc.unicreditgroup.de,CorporateDE

event.deviceDnsDomain,set.event.sourceUserPrivileges
ebanking.qc.unicreditgroup.it,BusinessItaly

0 Likes
Michel Beaudry Outstanding Contributor.
Outstanding Contributor.

Re: Error with map.0.properties file

Jump to solution

Hi,

 

As the agent log pointed out, your map.0.properties contains 5 tokens on the first line and this is what is being evaluated y the connector framework. Since this line refer to an example, it should be commented out with a # at the beginning of the line.

Then all you only need in your map.0.properties is:

event.deviceDnsDomain,set.event.sourceUserPrivileges
ebanking.qc.unicreditgroup.ae,CorporateAD
ebanking.qc.unicreditgroup.de,CorporateDE
ebanking.qc.unicreditgroup.it,BusinessItaly

This should work

 

Regards,

 

Michel Beaudry

hima.cholakurus Trusted Contributor.
Trusted Contributor.

Re: Error with map.0.properties file

Jump to solution

Hi Michel,

I tried commenting but then again it was throwing error

[2017-08-02 11:21:19,806][FATAL][default.com.arcsight.agent.c7.d][loadLookUpTable] Token [#event.targetAddress] is not of the form event.<event field>, additionaldata.<additional data field>, or one of the valid prefixes (range., regex.)
[2017-08-02 11:21:19,806][ERROR][default.com.arcsight.agent.loadable._AgentNATProcessor][init] Unable to load map mappings from [map.0.properties]
[2017-08-02 11:21:19,806][ERROR][default.com.arcsight.agent.loadable._AgentNATProcessor][init]
com.arcsight.common.InitializationException: Exception initializing 'com.arcsight.agent.c7.d': Unable to Read table look up setter information.
        at com.arcsight.agent.c7.d.<init>(d.java:284)
        at com.arcsight.agent.dn.ai.j(ai.java:211)
        at com.arcsight.agent.dn.ai.a(ai.java:252)
        at com.arcsight.agent.util.ar$b.run(ar$b.java:203)
        at java.util.TimerThread.mainLoop(Timer.java:555)
        at java.util.TimerThread.run(Timer.java:505)

And then,i just removed those two lines and it started working like a charm:)

Many thanks for your valuable suggestion.

 

Regards,

Hima

0 Likes
hima.cholakurus Trusted Contributor.
Trusted Contributor.

Re: Error with map.0.properties file

Jump to solution

Hi,

Now i am encountering another prpblem.

Although the mapping works fine,but for few of the events,it is getting wrongly mapped.For destinationDnsDomain 'ebanking.qc.unicreditgroup.ae',sourceUserPrivileges is getting value 'BusinessItaly' which is wrong.

I checked in agent.log and there is not error.I checked in console and  destinationDnsDomin is value is correct.

Any idea?

Here i am pasting the new map.0.properties file

event.destinationDnsDomain,set.event.sourceUserPrivileges
ebanking.qc.unicreditgroup.ae,CorporateAD

event.destinationDnsDomain,set.event.sourceUserPrivileges
ebanking.qc.unicreditgroup.de,CorporateDE

event.destinationDnsDomain,set.event.sourceUserPrivileges
ebanking.qc.unicreditgroup.it,BusinessItaly

Regards,

Hima

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.