Having problems with your account or logging in?
A lot of changes are happening in the community right now. Some may affect you. READ MORE HERE
marab Absent Member.
Absent Member.
529 views

kasper DB connector and sql server 2014

Hi

Can anyone help me about installing kasper DB connector for Antivirus server with sql server 2014?

when connector installing , returns following error:

AV connector error.png

soc user is a sql user and kasper DB (SQL server) administrator can login with soc user but my connector can not login to sql server

Labels (1)
0 Likes
9 Replies
marab Absent Member.
Absent Member.

Re: kasper DB connector and sql server 2014

Is it possible that SQL version 2014 is not supported by smartconnctor 7.4.0.7963.0?

0 Likes
raptraj1 Honored Contributor.
Honored Contributor.

Re: kasper DB connector and sql server 2014

did you checked the agent.log for further insight.......

Raj
0 Likes
pbrettle Acclaimed Contributor.
Acclaimed Contributor.

Re: kasper DB connector and sql server 2014

There are a number of things that I would check:

1) That you have external access to the database - MSSQL (and others) have the ability to prevent access from external systems and devices. Confirm with the Kaspersky admin that the database actually allows external connections and that you have the correct details.

2) That the username and password are correct - while you might think they are, its always worth checking. I would download the following application and actually test it! Its free, its easy to use and its cross platform. Download it, make sure you have the correct DB drivers selected and then go through the wizard to connect to the Kaspersky DB. If its successful then you hare in a good position, if not, you know there is a problem. I like DBVis because it actually generates the URL that you would need and its a copy / paste from DBVis into the connection string for the connector.

Database Management Software Tools - DbVisualizer

3) As mentioned, double check the agent.log file - always check the agent.log file for a connector. While you might get an error message displayed, the log file will always show more and what the context is. Always check the agent.log file and see what it says in there. If you can, please post the error messages that you are getting.

0 Likes
marab Absent Member.
Absent Member.

Re: kasper DB connector and sql server 2014

Hi

agent.log contains these lines:

[2017-04-13 11:46:12,033][WARN ][default.com.arcsight.agent.loadable.agent._KasperskyDatabaseAgent][decrypt] Could not decrypt the value using new method, trying the older methods

[2017-04-13 11:46:12,033][ERROR][default.com.arcsight.agent.loadable.agent._KasperskyDatabaseAgent][decryptOld] Unable to decrypt the obfuscated value using the older mechanisms...trying the oldest method

[2017-04-13 11:46:12,033][WARN ][default.com.arcsight.agent.loadable.agent._KasperskyDatabaseAgent][setAgentProperty] Unable to properly set the property, Agent Not registered

[2017-04-13 11:46:12,033][WARN ][default.com.arcsight.agent.loadable.agent._KasperskyDatabaseAgent][decrypt] The value could not be decrypted successfully. Tried both new and old methods. The original value may be a plain text value or encrypted using a different method. Returning the original value without decrypting it

[2017-04-13 11:46:12,033][WARN ][default.com.arcsight.agent.loadable.agent._KasperskyDatabaseAgent][decrypt] Could not decrypt the value using new method, trying the older methods

[2017-04-13 11:46:12,033][ERROR][default.com.arcsight.agent.loadable.agent._KasperskyDatabaseAgent][decryptOld] Unable to decrypt the obfuscated value using the older mechanisms...trying the oldest method

[2017-04-13 11:46:12,033][WARN ][default.com.arcsight.agent.loadable.agent._KasperskyDatabaseAgent][setAgentProperty] Unable to properly set the property, Agent Not registered

[2017-04-13 11:46:12,033][WARN ][default.com.arcsight.agent.loadable.agent._KasperskyDatabaseAgent][decrypt] The value could not be decrypted successfully. Tried both new and old methods. The original value may be a plain text value or encrypted using a different method. Returning the original value without decrypting it

[2017-04-13 11:46:12,033][INFO ][default.com.arcsight.agent.loadable._AuthenticationHandler][invoke] Processing request from [127.0.0.1] for service method [getCounterSnapshot]

[2017-04-13 11:46:12,033][INFO ][default.com.arcsight.agent.loadable.agent._KasperskyDatabaseAgent][createConnectionPool] Creating database connection pool for [jdbc:sqlserver://192.168.1.1:1433;DatabaseName=kav] with alias [null].

[2017-04-13 11:46:15,071][ERROR][default.com.arcsight.agent.loadable.agent._KasperskyDatabaseAgent][verifyParameters]

  1. com.microsoft.sqlserver.jdbc.SQLServerException: Login failed for user 'soc'. ClientConnectionId:66b2d49f-6f1d-41b8-a18d-699b0048516b

                at com.microsoft.sqlserver.jdbc.SQLServerException.makeFromDatabaseError(SQLServerException.java:216)

                at com.microsoft.sqlserver.jdbc.TDSTokenHandler.onEOF(tdsparser.java:254)

                at com.microsoft.sqlserver.jdbc.TDSParser.parse(tdsparser.java:84)

                at com.microsoft.sqlserver.jdbc.SQLServerConnection.sendLogon(SQLServerConnection.java:2908)

                at com.microsoft.sqlserver.jdbc.SQLServerConnection.logon(SQLServerConnection.java:2234)

                at com.microsoft.sqlserver.jdbc.SQLServerConnection.access$000(SQLServerConnection.java:41)

                at com.microsoft.sqlserver.jdbc.SQLServerConnection$LogonCommand.doExecute(SQLServerConnection.java:2220)

                at com.microsoft.sqlserver.jdbc.TDSCommand.execute(IOBuffer.java:5696)

                at com.microsoft.sqlserver.jdbc.SQLServerConnection.executeCommand(SQLServerConnection.java:1715)

                at com.microsoft.sqlserver.jdbc.SQLServerConnection.connectHelper(SQLServerConnection.java:1326)

                at com.microsoft.sqlserver.jdbc.SQLServerConnection.login(SQLServerConnection.java:991)

                at com.microsoft.sqlserver.jdbc.SQLServerConnection.connect(SQLServerConnection.java:827)

                at com.microsoft.sqlserver.jdbc.SQLServerDriver.connect(SQLServerDriver.java:1012)

                at org.apache.tomcat.jdbc.pool.PooledConnection.connectUsingDriver(PooledConnection.java:278)

                at org.apache.tomcat.jdbc.pool.PooledConnection.connect(PooledConnection.java:182)

                at org.apache.tomcat.jdbc.pool.ConnectionPool.createConnection(ConnectionPool.java:701)

                at org.apache.tomcat.jdbc.pool.ConnectionPool.borrowConnection(ConnectionPool.java:635)

                at org.apache.tomcat.jdbc.pool.ConnectionPool.init(ConnectionPool.java:486)

                at org.apache.tomcat.jdbc.pool.ConnectionPool.<init>(ConnectionPool.java:144)

                at org.apache.tomcat.jdbc.pool.DataSourceProxy.pCreatePool(DataSourceProxy.java:116)

                at org.apache.tomcat.jdbc.pool.DataSourceProxy.createPool(DataSourceProxy.java:103)

                at org.apache.tomcat.jdbc.pool.DataSourceProxy.getConnection(DataSourceProxy.java:127)

                at com.arcsight.agent.sdk.c.c.e.a(e.java:298)

                at com.arcsight.agent.de.a.a(a.java:111)

                at com.arcsight.loadable.soap.v1.CWSAPIBase.verifyTableParameter(CWSAPIBase.java:711)

                at sun.reflect.GeneratedMethodAccessor42.invoke(Unknown Source)

                at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)

                at java.lang.reflect.Method.invoke(Method.java:498)

                at org.apache.axis.providers.java.RPCProvider.invokeMethod(RPCProvider.java:397)

                at org.apache.axis.providers.java.RPCProvider.processMessage(RPCProvider.java:186)

                at org.apache.axis.providers.java.JavaProvider.invoke(JavaProvider.java:323)

                at org.apache.axis.strategies.InvocationStrategy.visit(InvocationStrategy.java:32)

                at org.apache.axis.SimpleChain.doVisiting(SimpleChain.java:118)

                at org.apache.axis.SimpleChain.invoke(SimpleChain.java:83)

                at org.apache.axis.handlers.soap.SOAPService.invoke(SOAPService.java:454)

                at org.apache.axis.server.AxisServer.invoke(AxisServer.java:281)

                at org.apache.axis.transport.http.AxisServlet.doPost(AxisServlet.java:699)

                at javax.servlet.http.HttpServlet.service(HttpServlet.java:646)

                at org.apache.axis.transport.http.AxisServletBase.service(AxisServletBase.java:327)

                at javax.servlet.http.HttpServlet.service(HttpServlet.java:727)

                at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:303)

                at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)

                at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)

                at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)

                at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)

                at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:220)

                at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:122)

                at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:503)

                at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:170)

                at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)

                at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)

                at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:421)

                at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1070)

                at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:611)

                at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:314)

                at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)

                at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)

                at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)

                at java.lang.Thread.run(Thread.java:745)

[2017-04-13 11:46:15,071][ERROR][default.com.arcsight.loadable.soap.v1.CWSAPIImpl][toResult] Parameter Verification Result [

Total Errors [1]:

Error[1]: [Unable to open a connection to [jdbc:sqlserver://192.168.1.1:1433;DatabaseName=kav].

                (Login failed for user 'soc'. ClientConnectionId:66b2d49f-6f1d-41b8-a18d-699b0048516b)]

]

0 Likes
pbrettle Acclaimed Contributor.
Acclaimed Contributor.

Re: kasper DB connector and sql server 2014

Ok, so the failure is simple - the system is getting a login failure for the user. You need to fix this.

Take a look at my comments above about DBVis and download it and test the connection to the SQL database from there - this will show you what is happening and if it is connecting. Do this, report back.

0 Likes
marab Absent Member.
Absent Member.

Re: kasper DB connector and sql server 2014

Hi Paul,

output of DBvis:

Product: DbVisualizer Free 9.5.7 [Build #2611]

OS: Windows Server 2012 R2

OS Version: 6.3

OS Arch: amd64

Java Version: 1.8.0_121

Java VM: Java HotSpot(TM) 64-Bit Server VM

Java Vendor: Oracle Corporation

Java Home: c:\program files\java\jre1.8.0_121

DbVis Home: C:\Program Files\DbVisualizer

User Home: C:\Users\user1

PrefsDir: C:\Users\user1\.dbvis

SessionId: 451

BindDir: null

An error occurred while establishing the connection:

Long Message:

Login failed for user 'soc'. ClientConnectionId:1efdc782-e808-482a-bfce-

f12865da99c8

Details:

   Type: com.microsoft.sqlserver.jdbc.SQLServerException

   Error Code: 18456

   SQL State: S0001

0 Likes
pbrettle Acclaimed Contributor.
Acclaimed Contributor.

Re: kasper DB connector and sql server 2014

Sorry, I didnt see this!

A quick Google search shows this:

Microsoft SQL Server Error 18456 Login Failed for User

Basically its an authentication failure that you need to dig into. You need to figure out what the problem is with the DB. Check on the link above and work through the options. Once you get this fixed and you can connect through DBvis then you can use the connector.

0 Likes
Highlighted
salvatore.alba@ Super Contributor.
Super Contributor.

Re: kasper DB connector and sql server 2014

Hi, 

The error points to connection issues, check the network port is open, that the User the Connector uses is configured with the appropriate rights and privileges on the Database and that possibly the same User is configured for the OS service used by Kaspersky, if that is the case.

Also make sure to use the correct JDBC driver and that you have followed all the steps in the ArcSight SmartConnector Config Guide for Kaspersky.

Check this KB article: https://softwaresupport.softwaregrp.com/doc/KM1406943

I put some other details here too: https://community.softwaregrp.com/t5/ArcSight-User-Discussions/Unable-to-detect-dat-abase-version/m-p/1677816

 

Regards,

Salvatore

0 Likes
salvatore.alba@ Super Contributor.
Super Contributor.

Re: kasper DB connector and sql server 2014

In addition, ensure to check the section in the Guide about the JDBC driver and the authentication, in your screenshot I do not see the part about 'integratedSecurity=true at the end of the URL string.

Some other KB artcile that will be good to check are these:

SQL User Privileges: KM1271057 - KM1271571

Best Practices and Troubleshooting: KM1271860

and the main one as in my previous comment, Error: Unable to detect DB: KM1406943

 

A simple test is to use an SQL client in the same network segment of the Connector and try to connecto to the DB, if that fails then the Connector will fail too, review the KB articles and Config Guide :)


Hope these helps.

Salvatore

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.