Configure ODBC Event Sources in NetWitness

This topic tells you how to configure ODBC collection protocol which collects events from event sources that store audit data in a database using the Open Database Connectivity (ODBC) software interface.

Deployment Scenario

The following figure illustrates how you deploy the ODBC Collection Protocol in NetWitness.

netwitness_odbc_deployment.png

Configure an ODBC Event Source

To configure an ODBC event source, you need to configure an event source type, and also choose a DSN template.

Configure a DSN

The following procedure describes how to add a DSN from an existing DSN template. For other procedures related to DSNs, see Configure Data Source Names (DSNs).

Configure a DSN (Data Source Name):

  1. Go to netwitness_adminicon_25x22.png (Admin) > Services.
  2. In the Services grid, select a Log Collector service.
  3. Click netwitness_ic-actns.png under Actions and select View > Config.
  4. In the Log Collector Event Sources tab, select ODBC/DSNs from the drop-down menu.
  5. The DSNs panel is displayed with the existing DSNs, if any.
  6. Click netwitness_ic-add.png to open the Add DSN dialog.
  7. Choose a DSN Template from the drop down menu and enter a name for the DSN. (You use the name when you set up the ODBC event source type.) If required, click netwitness_managedsntemplates_119x22.png to add or delete DSN templates.
  8. Fill in the parameters and click Save.

Add an Event Source Type

For details on parameters used in the following procedure, see ODBC Event Source Configuration Parameters.

To configure an ODBC Event Source Type:

  1. Go to netwitness_adminicon_25x22.png (Admin) > Services.
  2. Select a Log Collection service.
  3. Under Actions, select netwitness_ic-actns.png > View > Config to display the Log Collection configuration parameter tabs.

  4. Click the Event Sources tab.

    12.1_chooseCollectionMethod_1122.png

  1. In the Event Sources tab, select ODBC/Config from the drop-down menu.

  2. In the Event Categories panel toolbar, click netwitness_ic-add.png.

    The Available Event Source Types dialog is displayed.

    netwitness_odbcevsrctypes.png

  3. Select an event source category (for example mssql and click OK.

    The newly added event source type is displayed in the Event Categories panel.

  4. Select the new type in the Event Categories panel and click netwitness_ic-add.png in the Sources toolbar.

    The Add Source dialog is displayed.

    netwitness_odbcevsrcadd.png

  5. Select a DSN from the drop down list, specify or modify the other parameters as required, and click OK.

  6. Click Test Connection.

    The result of the test is displayed in the dialog box. If the test is unsuccessful, edit the DSN information and retry.

    Note: Log Collector takes approximately 60 seconds to return the test results. If it exceeds the time limit, the test times out and the NetWitness server displays an error message.

  7. If the test is successful, click OK.

The newly defined DSN is displayed in the Sources panel.