Highlighted
vdor Absent Member.
Absent Member.
621 views

Time Based DB FlexConnector failing to pull events with timestamp Java errors

I'm building a Time Based DB Flex Connector to pull events from a SQL Server using a select statement. So far, I've gotten the connector to use the ODBC connection and open my properties file and run, but it's not pulling events and I'm getting all sorts of timestamp errors like the following:

[2012-06-01 13:42:58,433][FATAL][default.com.arcsight.agent.sdk.d.b.z][processQuery()]
java.lang.NullPointerException
    at sun.jdbc.odbc.JdbcOdbcPreparedStatement.clearParameter(JdbcOdbcPreparedStatement.java:1023)
    at sun.jdbc.odbc.JdbcOdbcPreparedStatement.setTimestamp(JdbcOdbcPreparedStatement.java:903)
    at com.arcsight.agent.sdk.d.b.x.a(x.java:149)
    at com.arcsight.agent.sdk.d.b.z.i(z.java:235)
    at com.arcsight.agent.sdk.d.b.z.run(z.java:731)
    at java.lang.Thread.run(Thread.java:662)
[2012-06-01 13:43:03,433][FATAL][default.com.arcsight.agent.sdk.d.b.z][processQuery()]
java.lang.NullPointerException
    at sun.jdbc.odbc.JdbcOdbcPreparedStatement.clearParameter(JdbcOdbcPreparedStatement.java:1023)
    at sun.jdbc.odbc.JdbcOdbcPreparedStatement.setTimestamp(JdbcOdbcPreparedStatement.java:903)
    at com.arcsight.agent.sdk.d.b.x.a(x.java:149)
    at com.arcsight.agent.sdk.d.b.z.i(z.java:235)
    at com.arcsight.agent.sdk.d.b.z.run(z.java:731)
    at java.lang.Thread.run(Thread.java:662)

I thought this might be because the timestamp I'm using for timestamp.field contains milleseconds, so I used a SQL CAST statement to convert it into just seconds, but am still getting the problem.

The SQL statement I'm using executes just fine in MS SQL Server Management Studio. I wasn't sure if things like CAST, table joins or table aliases might make not work however...

I've attached my logs and properties file below. This is being run in Windows environments and is connecting to SQL Server 2008 via teh 64Bit ODBC driver.

Labels (2)
0 Likes
3 Replies
vdor Absent Member.
Absent Member.

Re: Time Based DB FlexConnector failing to pull events with timestamp Java errors

So I have attempted to run this as an ID Based flex connector  instead, and it will actually start without errors. Now the only problem  is that it's not actually pulling any events..

One of the things that is confusing is my WHERE clause:

query = \
SELECT  \
    ntr.ID, n.Name,n.IPAddress,n.Notes,n.LastScanPolicyName,ntr.EndTime,    \
    ntr.HighestScoringModule,ntr.HighestScore,ntr.ProgressText,ntr.ScoreDeviation,ntr.ScanPolicyID \
FROM    \
    Node n, NodeTaskResult ntr \
WHERE    \
    N.ID=NTR.NodeID and ntr.ID is not null and ntr.ID > ? \
ORDER BY \
    ntr.ID


maxid.query=select max(ID) from NodeTaskResult

id.field=ntr.ID

uniqueid.fields=ntr.ID,ntr.EndTime

token.count=10

If I'm using NTR.ID as my ID, do I need to include the '?' in the where clause, or something identifiying it as a variable? The connector is running fine, but it's not selecting any data (this query does work in SQL), is there something obvious I may be missing?

I've uploaded the Agent.log and my properties file.

0 Likes
owang1 Absent Member.
Absent Member.

Re: Time Based DB FlexConnector failing to pull events with timestamp Java errors

Hi Evan,

Hava you solve the problem about the Time-based flexconncet, I am now encounter the same question. can you share me how to ?

Regards,

Owen

0 Likes
katango1 Absent Member.
Absent Member.

Re: Time Based DB FlexConnector failing to pull events with timestamp Java errors

Hi Evan,

I am not sure at:

    N.ID=NTR.NodeID and ntr.ID is not null and ntr.ID > ? \

because....

   ">=?" is what the connector uses as an ID (or Time) place holder

I believe also that "ntr.ID is not null" is redundant, you can get rid of it, because the ">=?".


and...

If you use the > ? setting in the query then no events prior to the last completed query will be returned.  If you have the < ? setting in the query than the first time that the SmartConnector runs it will pull in all of the old events in the database, generating the high EPS.  As it moves forward to the next query it will still retrieve a lot records, but recognize and ignore the duplicates.


Regards

Michael

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.