Highlighted
Super Contributor.. Per Bejder Super Contributor..
Super Contributor..
654 views

Timebased flexconnector only collects the first event

Jump to solution

Hi

I have written an timebased flexconnector that only collect the first event and ignores any events that comes after the first.

My properties files look like this, (heimdal.sdktbdatabase.properties)

version.order=1
version.id=2.0
version.query=select dbo.CCCAudit.UID_CCCAudit FROM dbo.CCCAudit
 
query = SELECT dbo.CCCAudit.CCC_OperationDate, dbo.CCCAudit.CCC_Action, dbo.CCCAudit.CCC_ChangeAfter, dbo.CCCAudit.CCC_ChangeBefore, dbo.CCCAudit.CCC_ChangeRecipient, dbo.CCCAudit.CCC_ObjectID, dbo.CCCAudit.CCC_ObjectName, dbo.CCCAudit.CCC_ObjectType, dbo.CCCAudit.CCC_OperationType, dbo.CCCAudit.CCC_OperationUser FROM dbo.CCCAudit WHERE dbo.CCCAudit.CCC_OperationDate >= ? ORDER BY dbo.CCCAudit.CCC_OperationDate DESC
 
timestamp.field=dbo.CCCAudit.CCC_OperationDate
 
uniqueid.fields=dbo.CCCAudit.UID_CCCAudit
 
token.count=11
token[0].name=UID_CCCAudit
token[0].type=String
token[1].name=CCC_OperationDate
token[1].type=TimeStamp
token[1].format=yyyy-MM-dd HH\:mm\;ss\:SSS
token[2].name=CCC_Action
token[2].type=String
token[3].name=CCC_ChangeAfter
token[3].type=String
token[4].CCC_ChangeBefore
token[4].type=String
token[5].CCC_ChangeRecipient
token[5].type=String
token[6].CCC_ObjectID
token[6].type=String
token[7].CCC_ObjectName
token[7].type=String
token[8].CCC_ObjectType
token[8].type=String
token[9].CCC_OperationType
token[9].type=String
token[10].CCC_OperationUser
token[10].type=String
 
event.deviceVendor=__getVendor("Heimdal")
event.deviceProduct=__stringConstant("Heimdal")
#event.endTime=__parseMultipleTimeStamp(CCC_OperationDate,"yyyy-MM-dd HH\:mm\:ss\:SSS","yyyy-MMdd'T'HH\:mm\:ssZ","yyyy-MM-dd'T'HH\:mm\:ss\:SSS","yyyy-MM-dd'T'HH\:mm\:ss")
event.endTime=CCC_OperationDate
 
event.name=CCC_ObjectName
event.message=CCC_Action
event.deviceHostName=_DB_HOST
event.destinationUserName=CCC_OperationUser
 
event.deviceCustomString1Label=__stringConstant("Change After")
event.deviceCustomString2Label=__stringConstant("Change Before")
event.deviceCustomString3Label=__stringConstant("Change Recipient")
event.deviceCustomString4Label=__stringConstant("Object ID")
event.deviceCustomString5Label=__stringConstant("Object Type")
 
event.deviceCustomString1=CCC_ChangeAfter
event.deviceCustomString2=CCC_ChangeBefore
event.deviceCustomString3=CCC_ChangeRecipient
event.deviceCustomString4=CCC_ObjectID
event.deviceCustomString5=CCC_ObjectType
 
severity.map.medium.if.deviceSeverity=21
severity.map.high.if.deviceSeverity=0..20

Do anyone have an idea why this happens?

Best regards from Denmark

Per Bejder

Labels (1)
Tags (2)
0 Likes
1 Solution

Accepted Solutions
Marijo Mandic Acclaimed Contributor.
Acclaimed Contributor.

Re: Timebased flexconnector only collects the first event

Jump to solution

Hello Per,

as you opted out for time-based parser (database.sdktbdatabase.properties, Time-based Database).

1) In your parser I can see:

version.order=1
version.id=2.0
version.query=select dbo.CCCAudit.UID_CCCAudit FROM dbo.CCCAudit
query = SELECT dbo.CCCAudit.CCC_OperationDate, dbo.CCCAudit.CCC_Action, dbo.CCCAudit.CCC_ChangeAfter, dbo.CCCAudit.CCC_ChangeBefore, dbo.CCCAudit.CCC_ChangeRecipient, dbo.CCCAudit.CCC_ObjectID, dbo.CCCAudit.CCC_ObjectName, dbo.CCCAudit.CCC_ObjectType, dbo.CCCAudit.CCC_OperationType, dbo.CCCAudit.CCC_OperationUser FROM dbo.CCCAudit WHERE dbo.CCCAudit.CCC_OperationDate >= ? ORDER BY dbo.CCCAudit.CCC_OperationDate DESC
timestamp.field=dbo.CCCAudit.CCC_OperationDate
uniqueid.fields=dbo.CCCAudit.UID_CCCAudit

 

2) But what seems to be missing is "lastdate.query", as explained in Developers Guide:
The setup will run queries in the FlexConnector configuration file as part of verification of the connector parameters. One of the queries is maxid.query for id- based connectors  lastdate.query for time-  connectors, which will set MaxID or lastdate.query for the FlexConnector; when the FlexConnector is started, it will only process rows added after MaxID or lastdate.query.

3) So how you could try is:

version.id=
version.order=
version.query=s
lastdate.query=
query=
timestamp.field=
uniqueid.fields=

 

Regards,

Marijo

3 Replies
Marijo Mandic Acclaimed Contributor.
Acclaimed Contributor.

Re: Timebased flexconnector only collects the first event

Jump to solution

Hello Per,

as you opted out for time-based parser (database.sdktbdatabase.properties, Time-based Database).

1) In your parser I can see:

version.order=1
version.id=2.0
version.query=select dbo.CCCAudit.UID_CCCAudit FROM dbo.CCCAudit
query = SELECT dbo.CCCAudit.CCC_OperationDate, dbo.CCCAudit.CCC_Action, dbo.CCCAudit.CCC_ChangeAfter, dbo.CCCAudit.CCC_ChangeBefore, dbo.CCCAudit.CCC_ChangeRecipient, dbo.CCCAudit.CCC_ObjectID, dbo.CCCAudit.CCC_ObjectName, dbo.CCCAudit.CCC_ObjectType, dbo.CCCAudit.CCC_OperationType, dbo.CCCAudit.CCC_OperationUser FROM dbo.CCCAudit WHERE dbo.CCCAudit.CCC_OperationDate >= ? ORDER BY dbo.CCCAudit.CCC_OperationDate DESC
timestamp.field=dbo.CCCAudit.CCC_OperationDate
uniqueid.fields=dbo.CCCAudit.UID_CCCAudit

 

2) But what seems to be missing is "lastdate.query", as explained in Developers Guide:
The setup will run queries in the FlexConnector configuration file as part of verification of the connector parameters. One of the queries is maxid.query for id- based connectors  lastdate.query for time-  connectors, which will set MaxID or lastdate.query for the FlexConnector; when the FlexConnector is started, it will only process rows added after MaxID or lastdate.query.

3) So how you could try is:

version.id=
version.order=
version.query=s
lastdate.query=
query=
timestamp.field=
uniqueid.fields=

 

Regards,

Marijo

Super Contributor.. Per Bejder Super Contributor..
Super Contributor..

Re: Timebased flexconnector only collects the first event

Jump to solution

Thanks 

It was the lastdate.query that was missing. 

I was looking under Configuration Properties for a Time-based Database FlexConnector on page 82 and there are no references to that line. 

0 Likes
Marijo Mandic Acclaimed Contributor.
Acclaimed Contributor.

Re: Timebased flexconnector only collects the first event

Jump to solution

You are welcome, glad that you managed to resolve the issue 🙂

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.