000017234 - Error message basic_string::_S_create is seen when collecting ODBC events in RSA Security Analytics

Document created by RSA Customer Support Employee on Jun 16, 2016•Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • Comment • 0
  • View in full screen mode

Article Content

Article Number000017234
Applies ToRSA Security Analytics
RSA Security Analytics 10.1 and above
RSA Security Analytics Log Collector
RSA Security Analytics Virtual Log Collector
RSA Security Analytics ODBC Collection
IssueError message basic_string::_S_create is seen when collecting ODBC events in RSA Security Analytics.
The error marked in red below will be seen in the /var/log/messages on the Log Collector or Virtual Log Collector.

Jun 10 09:18:09 NWAPPLIANCE2932 nw[1409]: [OdbcCollection] [failure] [mcafeedlp3000.ePO] [processing] [ePO] [processing] An error occurred collecting ODBC events using query tag MCAFEEDLP. Error: basic_string::_S_create
Cause

The issue appears to be a column (field) in the data query that is extremely long or longer than the defined max in the field buffer in Log Collector for ODBC data processing. Once the column (field) length was limited to 255 by adding SUBSTR to SQL select clause there are no issues.

 

The basic_string::_S_create error points to a buffer overflow.

Resolution

Below are the steps that you need to run on the Log Collector or Virtual Log Collector in order to fix the issue.

  1. Stop the nwlogcollector service.
    #stop nwlogcollector
  2. Create a backup of the NwLogCollector.cfg file.
    # cp /etc/netwitness/ng/NwLogcollector.cfg /etc/netwitness/ng/NwLogcollector.cfg_bkp
  3. Open the NwLogCollector.cfg file using the VI editor.
    # vi /etc/netwitness/ng/NwLogcollector.cfg
  4. Search for the DSN that you had configured for the data collection.
  5. In the attribute tree under the dsn, you should see the parameter max_cell_size which is set to 2048.
  6. Change it to 8192.
  7. Save the file and start the service
    # start nwlogcollector
    # status nwlogcollector
  8. Check the /var/log/messages and you should not find this error and the log collection will begin to occur normally.

 

If you are unsure of any of the steps above or experience any issues, contact RSA Support and quote this article ID for further assistance.

Legacy Article IDa66354

Attachments

    Outcomes