Highlighted
mat053241 Super Contributor.
Super Contributor.
486 views

MSSQL id flex connector - convertHashMapToRequiredTypes issue

Jump to solution

Created a id based flex connector that pulls data from an mssql database table.  Im connected to the database and there is data coming back into our logger appliance; however, not all of the fields were being populated.  When I run debug on the connector, I noticed the following errors:

 

[2018-12-03 13:47:34,129][DEBUG][default.com.arcsight.agent.sdk.d.i.g][convertHashMapToRequiredTypes] Failed to get [ProductName]. Value is null, ignoring
[2018-12-03 13:47:34,129][DEBUG][default.com.arcsight.agent.sdk.d.i.g][convertHashMapToRequiredTypes] Failed to get [Size]. Value is null, ignoring
[2018-12-03 13:47:34,129][DEBUG][default.com.arcsight.agent.sdk.d.i.g][convertHashMapToRequiredTypes] Failed to get [FileName]. Value is null, ignoring
[2018-12-03 13:47:34,129][DEBUG][default.com.arcsight.agent.sdk.d.i.g][convertHashMapToRequiredTypes] Failed to get [ProductVersion]. Value is null, ignoring
[2018-12-03 13:47:34,129][DEBUG][default.com.arcsight.agent.sdk.d.i.g][convertHashMapToRequiredTypes] Failed to get [ParentProcess]. Value is null, ignoring
[2018-12-03 13:47:34,129][DEBUG][default.com.arcsight.agent.sdk.d.i.g][convertHashMapToRequiredTypes] Failed to get [Reason]. Value is null, ignoring
[2018-12-03 13:47:34,129][DEBUG][default.com.arcsight.agent.sdk.d.i.g][convertHashMapToRequiredTypes] Failed to get [CompanyName]. Value is null, ignoring
[2018-12-03 13:47:34,129][DEBUG][default.com.arcsight.agent.sdk.d.i.g][convertHashMapToRequiredTypes] Failed to get [_IPV6_ADDR]. Value is null, ignoring
[2018-12-03 13:47:34,129][DEBUG][default.com.arcsight.agent.sdk.d.i.g][convertHashMapToRequiredTypes] Failed to get [FileExtension]. Value is null, ignoring
[2018-12-03 13:47:34,129][DEBUG][default.com.arcsight.agent.sdk.d.i.g][convertHashMapToRequiredTypes] Failed to get [FileVersion]. Value is null, ignoring
[2018-12-03 13:47:34,129][DEBUG][default.com.arcsight.agent.sdk.d.i.g][convertHashMapToRequiredTypes] Failed to get [FilePath]. Value is null, ignoring
[2018-12-03 13:47:34,129][DEBUG][default.com.arcsight.agent.sdk.d.i.g][convertHashMapToRequiredTypes] Failed to get [Vendor]. Value is null, ignoring
[2018-12-03 13:47:34,129][DEBUG][default.com.arcsight.agent.sdk.d.i.g][convertHashMapToRequiredTypes] Failed to get [FileDescription]. Value is null, ignoring
[2018-12-03 13:47:34,129][DEBUG][default.com.arcsight.agent.sdk.d.i.g][convertHashMapToRequiredTypes] Failed to get [HashValue]. Value is null, ignoring

Query:

SELECT \
	AMEventPK, \
	RuleName, \
	AuditOnly, \
	FileOwner, \
	Reason, \
	EventDefinitionFK, \
	ComputerName, \
	GroupName, \
	UserName, \
	fName AS FileName, \
	FilePath, \
	FileExtension, \
	FileVersion, \
	ProductVersion, \
	HashValue, \
	Size, \
	Vendor, \
	ProductName, \
	CompanyName, \
	FileDescription, \
	ParentProcess \
FROM FIMS.BigData.vw_AppSense_BlockedAndSelfElevationEvents \
WHERE AMEventPK > ? \

But when I run the query directly against the datbase using sql developer, all of the fields show up.  I've never seen 'convertHashMapToRequiredTypes' before, so im wondering what it might be.  Is this related to tokenization?  

Any help would be appreciated.

------
0 Likes
1 Solution

Accepted Solutions
Knowledge Partner
Knowledge Partner

Re: MSSQL id flex connector - convertHashMapToRequiredTypes issue

Jump to solution

My advice would be to try tokenizing the fields and assign the token.types corresponding to the data types of the database collumns and then map them to the fields as per the CEF guide field datatypes and field size.

I am almost certain that you cannot go wrong by doing that.

4 Replies
Knowledge Partner
Knowledge Partner

Re: MSSQL id flex connector - convertHashMapToRequiredTypes issue

Jump to solution

Could you post the token section of your parser?

I have never encountered this issue before.

0 Likes
mat053241 Super Contributor.
Super Contributor.

Re: MSSQL id flex connector - convertHashMapToRequiredTypes issue

Jump to solution

I didn't create a token section as I've never needed one before.  I suppose that's my next step in troubleshooting.  it's just odd that only about half of the fields are being returned when the agent runs the query, yet when it's a direct connection to the database with the same query it returns all fields.

------
0 Likes
Knowledge Partner
Knowledge Partner

Re: MSSQL id flex connector - convertHashMapToRequiredTypes issue

Jump to solution

My advice would be to try tokenizing the fields and assign the token.types corresponding to the data types of the database collumns and then map them to the fields as per the CEF guide field datatypes and field size.

I am almost certain that you cannot go wrong by doing that.

mat053241 Super Contributor.
Super Contributor.

Re: MSSQL id flex connector - convertHashMapToRequiredTypes issue

Jump to solution

Yeah - that did it.  I ended up having to tonkenize every field.  Wondering what made this different than every other IB/TB flex connector i've ever built..  Ah well.  Thanks for the suggestion!

------
0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.