Highlighted
Absent Member.
Absent Member.
450 views

SAP CCMS and SAP XAL


Hi,

I'm configuring Sentinel 7.2 to collect SAP security events.

I've configured SAP CCMS collector (6.1r3), SAP XAL connector (6r2) and
SAP XAL event source according to Sentinel documentation.

Although connector, collector as well as event source have been started
with no errors, no SAP events are collected by Sentinel.

By means of SAP Logon utility (and by using the same user/pass
configured in SAP XAL event source) I can see SAP events in SAP CCMS
Monitor Templates/Security.

Anybody have any tips which could help me to troubleshoot this problem
and get success in collect SAP security events?

Thanks in advance.


--
gleisonbaioco
------------------------------------------------------------------------
gleisonbaioco's Profile: https://forums.netiq.com/member.php?userid=10233
View this thread: https://forums.netiq.com/showthread.php?t=54031

0 Likes
4 Replies
Absent Member.
Absent Member.

Re: SAP CCMS and SAP XAL

gleisonbaioco,

It appears that in the past few days you have not received a response to your
posting. That concerns us, and has triggered this automated reply.

Has your issue been resolved? If not, you might try one of the following options:

- Visit http://www.netiq.com/support and search the knowledgebase and/or check all
the other support options available.
- You could also try posting your message again. Make sure it is posted in the
correct newsgroup. (http://forums.netiq.com)

Be sure to read the forum FAQ about what to expect in the way of responses:
http://forums.netiq.com/faq.php

If this is a reply to a duplicate posting, please ignore and accept our apologies
and rest assured we will issue a stern reprimand to our posting bot.

Good luck!

Your NetIQ Forums Team
http://forums.netiq.com


0 Likes
Highlighted
Absent Member.
Absent Member.

Re: SAP CCMS and SAP XAL


Hi,

You can check what information are in log file, typical location is:

/var/opt/novell/sentinel/data/collector_mgr.cache/CONNECTOR/SAP_XAL_<UUID>/sap.log


Restart event source and check logs, you can also check if SAP is
generating logs, sometimes audit filters are wrongly configured.

--
Arek.


--
arekmacak
------------------------------------------------------------------------
arekmacak's Profile: https://forums.netiq.com/member.php?userid=6080
View this thread: https://forums.netiq.com/showthread.php?t=54031

0 Likes
Highlighted
Absent Member.
Absent Member.

Re: SAP CCMS and SAP XAL


Hi,

I have checked the error messages in
/var/opt/novell/sentinel/log/server0.0.log.

One of them is "[STDERR]: Caused by: java.lang.ClassNotFoundException:
com.sap.conn.jco.util.SyncDateFormat".

I'm using JCO version 3 in my environment.


--
gleisonbaioco
------------------------------------------------------------------------
gleisonbaioco's Profile: https://forums.netiq.com/member.php?userid=10233
View this thread: https://forums.netiq.com/showthread.php?t=54031

0 Likes
Highlighted
Micro Focus Contributor
Micro Focus Contributor

Re: SAP CCMS and SAP XAL


Hi there,

I found another customer reporting the same problem. Upon further
investigation we noticed that the latest version of the sapjco3.jar
library ( SAP Java Connector 3.0.13, dated May 2015) doesn't have the
com.sap.conn.jco.util.SyncDateFormat class. This is what is causing this
error.
As a temporary workaround you can try using an older SAP JCO library. It
still should be version 3. You can unpack the contents of the JAR file
and check that the class SyncDateFormat is indeed in the folder
com/sap/conn/jco/util to make sure it is a valid version.
The issue is currently being investigated by engineering to find a
permanent solution.

Best regards,

Rodrigo


--
rodrigomez
------------------------------------------------------------------------
rodrigomez's Profile: https://forums.netiq.com/member.php?userid=329
View this thread: https://forums.netiq.com/showthread.php?t=54031

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.