ODBC Event Source Configuration Parameters

Document created by RSA Information Design and Development on Sep 11, 2017Last modified by RSA Information Design and Development on Oct 12, 2017
Version 7Show Document
  • View in full screen mode
  

This topic tells you how to configure ODBC collection protocol which collects events from event sources that store audit data in a database using the Open Database Connectivity (ODBC) software interface.

Access ODBC Configuration Parameters

To access the ODBC Event Source Configuration Parameters:

  1. Go to Administration > Services from the NetWitness Suite menu.
  2. Select a Log Collection service.
  3. Under Actions, select View > Config to display the Log Collection configuration parameter tabs.

    The Service Config view is displayed with the Log Collector General tab open.

  4. Click the Event Sources tab, and select ODBC/Config from the drop-down menu.

Workflow

This workflow illustrates the basic tasks needed to start collecting events through Log Collection.

Log Collection workflow shows the basic tasks for collecting events.

What do you want to do?

                  
RoleI want to...Documentation
Administrator

View or update ODBC parameters.

Configure ODBC Event Sources in NetWitness Suite

Related Topics

Data Source Name (DSN) Parameters

Use the Sources panel to review, add, modify, and delete Data Source Name (DSN) parameters.

Sources Panel

An ODBC DSN tells the Log Collector how to reach an ODBC endpoint. You refer to an ODBC DSN when you configure a data source name with information such as which ODBC driver to use or the host name and port of the ODBC endpoint.

An ODBC DSN is a sequence of name‐value pairs. For information about the valid names for a given ODBC data source type, such as Sybase, Microsoft SQL Server, or Oracle, please download the DataDirect Connect Series for ODBC User's Guide and DataDirect Connect Series for ODBC User's Guide in the Progress DataDirect Document Library.

Toolbar

The following table provides descriptions of the toolbar options.

                                    
OptionDescription

Opens the Add DSN dialog in which you add an event source for the event source type you selected in the Event Categories panel.

Deletes the selected event sources.

Opens the Edit DSN dialog in which you modify the configuration parameters for the selected event source.

When you select multiple event sources, this option opens the Bulk Edit Source dialog in which you can edit the parameters values for the selected file directories. 
Refer to the Log Collection Configuration Guidefor detailed steps on how to import, export, and edit event sources in bulk.

Opens the Bulk Add Option dialog in which you can import DSN parameters in bulk from a comma-separated values (CSV) file.  The Bulk Add Option dialog has the following two options.

Refer to the Log Collection Configuration Guidefor detailed steps on how to import, export, and edit event sources in bulk.

Creates a .csv file that contains the parameters for the selected DSNs.

Refer to the Log Collection Configuration Guidefor detailed steps on how to import, export, and edit event sources in bulk.

Validates the configuration parameters for the selected ODBC database.

Refer to the Log Collection Configuration Guidefor detailed steps on how to test event source connections in bulk.

Add or Edit DSN Dialog

In this dialog, you add or modify an event source for the selected event source.

                                                                              
NameDescription
Basic
DSN*

The data source name (DSN) that defines the database from which to collect events.
Select an existing DSN from the drop-down list. For details, see ODBC DSNs Event Source Configuration Parameters.

Username*

User name that the data source name uses to connect to the database. You must specify a user name when you create the event source.

Password

Password that the data source name uses to connect to the database.

Caution: The password is encrypted internally and is displayed in its encrypted form.

Enabled

Select the checkbox to enable the event source configuration to start collection. The checkbox is selected by default.

Address*

For ODBC, this field is not used.  The Log Collector uses the address in the ODBC.ini file.

Advanced
Max Cell Size

Maximum size in bytes of the data that the Log Collector can pull from one cell in the database. The default value is 2048.

Nil Value

Character string that the Log Collector displays when NIL is returned for a cell in the database. Default value: “” (null).

Polling Interval

Interval (amount of time in seconds) between each poll. The default value is 180.

For example, if you specify 180, the collector schedules a polling of the event source every 180 seconds. If the previous polling cycle is still underway, the collector waits for that cycle to finish. If you have a large number of event sources that you are polling, it may take longer than 180 seconds for the polling to start because the threads are busy.

Max Events Poll

The maximum number of events per polling cycle (how many events collected per polling cycle).

Debug

Caution: Only enable debugging (set this parameter to On or Verbose) if you have a problem with an event source and you need to investigate this problem. Enabling debugging will adversely affect the performance of the Log Collector.

Enables or disables debug logging for the event source. Valid values are:

  • Off = (default) disabled
  • On = enabled
  • Verbose = enabled in verbose mode ‐ adds thread information and source context information to the messages.

This parameter is designed to debug and monitor isolated event source collection issues. If you change this value, the change takes effect immediately (no restart required). The debug logging is verbose, so limit the number of event sources to minimize performance impact.

Initial Tracking Id

Initial identification code that the Log Collector assigns to this event source if collection is not started. If there is no value for this parameter, the Log Collector starts at the end of the table and only pulls rows after the end of the table as they are added. The default value is “” (null).

Filename

For Microsoft SQL Server Event Sources only, the location of the trace files directory  (for example, C:\MyTraceFiles).

Please refer to the RSA Microsoft SQL Server Event Source Configuration Guide, located on RSA Secure Care Online (SCOL) for detailed information on how to create this directory with the correct permissions.

Test Connection

Checks the configuration parameters specified in this dialog to make sure they are correct.

Cancel

Closes the dialog without adding or modifying DSN parameters.

OK

Adds or modifies the parameters for the DSN.

You are here
Table of Contents > Reference > ODBC Parameters

Attachments

    Outcomes