SQL command not properly ended error in ODBC Event Source Integration

[socuser]

Hi all,

we are facing issue in Integrating ODBC eventsource  such as oracleauditvault version 12 

Connectivity is fine , ports are opened and test connection is also successful. 

But some issue in ODBC Collection it always throwing error like  SQL command not properly ended.

and WHERE ALERT_ID > 2020-02-01 01:46:02.837016, this time is used in query , we don'tknow why this query takes this time  2020-02-01 01:46:02.837016 always for  these ODBC EventSource of Oracleauditvault.

please look throw the below logs , if we can solve these error this would much usefully for us in finding the root cause.

logs

Mar 16 13:33:32 VLCcollector NwLogCollector[21586]: [OdbcCollection] [failure] [odbc:WrkUnit[3]:18760] [doWork:197] [oracleauditvault_12x.AVDF] [processing] [AVDF] [processing] An error occurred collecting ODBC events using query tag ORACLE_AuditVault. Error: Unable to execute statement: Statement: "SELECT ALERT_ID, AV_ALERT_TIMESTAMP, COALESCE(TO_CHAR(CLEARED_TIMESTAMP),' ') AS CLEARED_TIMESTAMP, ALERT_NAME, ALERT_SEVERITY, ALERT_STATUS FROM AVSYS.ALERT_STORE ASTORE WHERE ALERT_ID > 2020-02-01 01:46:02.837016"; Reason: state: 51; error-code: 933; description: [RSA][ODBC 20101 driver][Oracle]ORA-00933: SQL command not properly ended

Thanks & Regards

Prabhudeva S

SOC TEAM

[DaveGlover]

Are you able to run this in Toad or Oracle Client?  

SELECT ALERT_ID, AV_ALERT_TIMESTAMP, COALESCE(TO_CHAR(CLEARED_TIMESTAMP),' ') AS CLEARED_TIMESTAMP, ALERT_NAME, ALERT_SEVERITY, ALERT_STATUS FROM AVSYS.ALERT_STORE ASTORE WHERE ALERT_ID > 2020-02-01 01:46:02.837016

Also is the table named-->AVSYS.ALERT_STORE?  

[DaveGlover]

Also try running this as well..

SELECT ALERT_ID, AV_ALERT_TIMESTAMP, COALESCE(TO_CHAR(CLEARED_TIMESTAMP),' ') AS CLEARED_TIMESTAMP, ALERT_NAME, ALERT_SEVERITY, ALERT_STATUS FROM AVSYS.ALERT_STORE WHERE ALERT_ID > 2020-02-01 01:46:02.837016

[socuser]

Hi DaveGlover,

Our Database team has run the mentioned sql command on that server,

Our team stating that "The value given for ALERT_ID in the query “WHERE ALERT_ID > 2020-02-01 01:46:02.837016" seems to be wrong. " 

we don't know were is the issue and we also check the OracleAuditvault_12x.xml ODBC log collection file and compare with other vlc's their is no change , all OracleAuditvault_12x.xml files has same content.

please help us on this issue.

Thanks  & regards,

Prabhudeva S

SOC TEAM