MSSQL integration

[Anonymous]

I am trying to integrate MSsql with my test lab and did all the setting as per device configuration guide, added dsn in SA and restarted the odbc but getting an error like :- tail -f /var/log/messages

Feb  4 17:53:42 NWAPPLIANCE10318 nw[1526]: [OdbcCollection] [failure] [mssql.MSSQL] [processing] [MSSQL] An error occurred creating an ODBC connection.#011 The DSN for this connection is: MSSQL  The trapped error is: Unable to create an ODBC connection. DSN: MSSQL; username: audit_reader; reason: state: IM003; error-code: 2842

Feb  4 17:53:42 NWAPPLIANCE10318 nw[1526]: [OdbcCollection] [failure] [mssql.MSSQL] [processing] [MSSQL]  odbc:WrkUnit[2] Processing failed.

DSN:-

[MSSQL]

Driver=/opt/netwitness/odbc/lib/R3sqls.26.so

Port=1433

hostname=192.168.1.94

database=MSSQL

[AdamRasnick]

Make sure you have pointed at the right driver, I have made that mistake before since you have a whole list to choose from.

[huanzhou1]

database=MSSQL  = need to be master db

did you run the script to enable the trace? please follow the envision mssql event source guide.

[Anonymous]

hi Adam,

which driver we have to use, there is lots of driver. i just select as per sadocs.emc.com device configuration for mssql(attaching screen shot). can you please guide?

[Anonymous]

Hi patriot,

i tried to run that script on sql server but didn't find any utility program or tab to run that script from sql managment studio. i also created a UPC but then too couldn't find a option to run that scrip, can you please help me on this?

[Anonymous]

I noticed that sometimes its picky on the capitalization on the ODBC connection. We also had a case where MSSQL doesnt like the query, so you have to edit the event source XML parser and remove the DIRECT database name calls. Which may be why you connect directly to the master DB instead of the DB itself.

hostName

database

port

Driver = /opt/netwitness/odbc/lib/R3sqls26.so

[huanzhou1 · Accepted solution]

you need to download from SCOL.

https://knowledge.rsasecurity.com/scolcms/set.aspx?id=182

Additional Files: sqlServerAudit2000.sql | sqlServerAudit2005.sql | sqlServerAudit2008.sql | sqlServerAudit2012.sql |RSA_MSSQLAuditStoredProcedures.dll | uninstallSqlServerAudit.sql | sftpagent.conf.mssql