Oracle 18c ODBC data source

[lukaszczerwonka]

Hi guys, which driver should I use to connect with 18c? Tried with:

R3or827r.so
R3or827.so
R3or827s.so
R3ora27r.so
R3ora27.so
R3ora28r.so
R3ora28.so

With similar effect as below:

Test connection failed:Error! An error occurred creating an ODBC connection for DSN: DB_test The trapped error is: Unable to create an ODBC connection. DSN: DB_test; username: audit_reader; reason: state: 60; error-code: 140170552673178; description: [RSA][ODBC 20101 driver][20101]ORA-00922: missing or invalid option

DSN config:

[lukaszczerwonka · Accepted solution]

Solved "missing or invalid option" with https://community.rsa.com/t5/rsa-netwitness-platform/unable-to-create-an-odbc-connection-with-oracle-database-in-rsa/ta-p/3139 but now I have another isssue as below:

An error occurred collecting ODBC events using query tag ORACLE_Unified_Auditing. Error: Unable to execute statement: Statement: "Select TO_CHAR(MAX(cast(("AUDSYS"."UNIFIED_AUDIT_TRAIL"."EVENT_TIMESTAMP" at local) as date)),'yyyy-mm-dd hh24:mi:ss') FROM "AUDSYS"."UNIFIED_AUDIT_TRAIL""; Reason: state: 53; error-code: 140166257705902; description: [RSA][ODBC 20101 driver][Oracle]ORA-00942: table or view does not exist

Error finding any new events. Reason: Unable to execute statement: Statement: "Select TO_CHAR(MAX(cast(("AUDSYS"."UNIFIED_AUDIT_TRAIL"."EVENT_TIMESTAMP" at local) as date)),'yyyy-mm-dd hh24:mi:ss') FROM "AUDSYS"."UNIFIED_AUDIT_TRAIL""; Reason: state: 53; error-code: 140166257705902; description: [RSA][ODBC 20101 driver][Oracle]ORA-00942: table or view does not exist

Probably I need to customize collector xml, anyone have statement for 18c which works?

[lukaszczerwonka · Accepted solution]

Works with the latest oracle_fga.xml

[VincentWareham · Accepted solution]

Hello

The NetWitness Oracle integration guide doesn't show support for Oracle 18c, however I did get it working with the following customizations.

odbc.ini
[ora18c]
ServiceName={service_name}
PortNumber=1521
HostName={IP_address}
Driver=/opt/netwitness/odbc/lib/R3ora27.so

I didn't include the entry for EditionName.

I deployed the new "Oracle Log Collector Configuration" from RSA Live to all Log Collector appliances.

This installed the new /etc/netwitness/ng/logcollection/content/collection/odbc/oracle_19c_auditing.xml file on the Log Collectors.

I copied the /etc/netwitness/ng/logcollection/content/collection/odbc/oracle_19c_auditing.xml file to a new oracle_18c_auditing.xml file.

Edit the oracle_18c_auditing.xml file and changed all all 5 references of "19c" over to "18c".

Then changed the line with "event_timestamp_utc," to "event_timestamp,".

Restarted the Log collector service and in the NW UI configured the Log Collector ODBC configuration to use this custom Oracle18c.

[i_bugti]

Hi Vincent hope you are doing well, can you guide what will be the ServiceName what actually it represent, I am facing invalid login name username and password error. Oracle DB 12C and base os is oracle linux 6.5

[AjmanBank_SOC]

Hi Vincent, 

Thanks it worked for me when I follow the below for Oracle 19c.

I deployed the new "Oracle Log Collector Configuration" from RSA Live to all Log Collector appliances.

This installed the new /etc/netwitness/ng/logcollection/content/collection/odbc/oracle_19c_auditing.xml file on the Log Collectors.