Highlighted
Absent Member.
Absent Member.
2498 views

Need Help with SQL Connector

Trying to get our SQL servers to properly send log data to our ArcSight.

The "Microsoft SQL Server Multiple Instance Audit DB" connector is not working. I have a current case open with HP/ArcSight, but they are slow to respond. The last effort (with their tech support) was to attempt using a JDBC driver; still no success.

Here is a brief rundown of my setup:

1. Connector Server (Win2008 R2): Using the Smart Connector (version 5.2.6) for the SQL.

  1.a. JDBC driver (version 4) dropped into the suggested folder (/current/user/agent/lib)

  1.b. Connector uses a service account/pass with high enough permissions to access other servers on the domain.

2. On the SQL Server, added account (service account from above) to ensure it has permission to read/write to the folder where the SQL Trace files are.

  2.a. Verified the trace files are sent to a specific folder. (using a UNC, could directly access the folder and trace files)



Here is a copy of the error I am getting:

Connector table parameters did not pass the verification with error [0:Unable to open a connection to [jdbc:sqlserver:\\<servername>:1433;DatabaseName=Master]. (No suitable driver found for jdbc:sqlserver:\\<servername>:1433;DatabaseName=Master)

0:The trace file folder [\\<servername>\sql_logs] for SQL Server Instance [jdbc:sqlserver:\\<servername>:1433;DatabaseName=Master] does not exist ] for connector {SQL_DB]. Do you still want to continue?


Can anyone help me with this issue?


Does anyone have better or more specific instructions to get an SQL connector to work?


Labels (2)
0 Likes
9 Replies
Highlighted

Re: Need Help with SQL Connector

Eric - One thing you'll want to keep in mind is if you put in a new JDBC driver into current/user/agent/lib, you'll need to quit out of the connector setup and start it up again to get the JDBC driver recognized.

Also, what name did you give to the JDBC driver and what is the version?

0 Likes
Highlighted
Absent Member.
Absent Member.

Re: Need Help with SQL Connector

I have tried repeatedly to go back and forth between the ODBC and the JDBC driver.  At this point neither is working.

The JDBC driver I downloaded from Microsoft has two files: sqljdbc.jar and sqljdbc4.jar

Dated:  2/17/2012

I have tried one then the other, then I placed both in the folder ArcSight suggests. Still no luck.

0 Likes
Highlighted

Re: Need Help with SQL Connector

Eric - Are you using "runagentsetup" to setup the Connector?  If so, can you try running "arcsight agentsetup" instead from the same directory?  I noticed a difference in the number of parameters displayed (at least in 5.2.5).

0 Likes
Highlighted
Valued Contributor.
Valued Contributor.

Re: Need Help with SQL Connector

Eric,

I solved this same problem using the JDBC version 2.0. The others gave me the same error.

Hope it help.

0 Likes
Highlighted
Absent Member.
Absent Member.

Re: Need Help with SQL Connector

Hi eric

Have you tried with older JDBC verison (1.2 or 2.0)? All my flexcconnector are working with JDBC 1.2 version.

0 Likes
Highlighted
Absent Member.
Absent Member.

Re: Need Help with SQL Connector

0 Likes
Highlighted
Trusted Contributor.
Trusted Contributor.

Re: Need Help with SQL Connector

Or see for jtds - just don't try to get support for a connector using it...

Highlighted
Outstanding Contributor.
Outstanding Contributor.

Re: Need Help with SQL Connector

Not that I'm advocating use of JTDS rather than using the supported methods, but...

If using JTDS, if any of your resulting event data looks something like ClobImpl***, you may need to add ";useLOBs=false" to the end of your JDBC connection string.

Cheers,

Ian.

Highlighted
Absent Member.
Absent Member.

Re: Need Help with SQL Connector

It might be that the datasource is created using the odbcad32 in /syswow64 and it cannot locate the drivers (which are probably 32bit).  Try creating the datasource using the /system32/odbcad32 and see if it works.

Start>run>odbcad32, righ click properties give you the source directory...

You do have to make sure there are no other datasource editors open - only one at a time.  Otherwise there is weird behaviour in updates to the configs.

HTH

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.