ODBC Event Source Configuration Parameters

This topic tells you how to configure ODBC collection protocol which collects events from event sources that store audit data in a database using the Open Database Connectivity (ODBC) software interface.

Access ODBC Configuration Parameters

To access the ODBC Event Source Configuration Parameters:

  1. Go to netwitness_adminicon_25x22.png (Admin) > Services from the NetWitness menu.
  2. Select a Log Collection service.

  3. Select netwitness_ic-actns.png > View > Config to display the Log Collection configuration parameter tabs.

    The Service Config view is displayed with the Log Collector General tab open.

  4. Click the Event Sources tab, and select ODBC/Config from the drop-down menu.

Workflow

This workflow illustrates the basic tasks needed to start collecting events through Log Collection.

netwitness_lcwf.png

What do you want to do?

Role I Want to... Documentation

Administrator

Perform basic Log Collection implementation.

Basic Implementation

Administrator

Set up a lockbox to maintain lockbox settings.

Set Up a Lockbox

Administrator

Start Log Collection services.

Start Collection Services

Administrator

*Configure Log Collection protocols and event sources.

Configure Collection Protocols and Event Sources

Administrator

Verify that Log Collection is working.

Verify That Log Collection Is Working

*You can perform this task here.

Related Topics

Data Source Name (DSN) Parameters

Use the Sources panel to review, add, modify, and delete Data Source Name (DSN) parameters.

Sources Panel

An ODBC DSN tells the Log Collector how to reach an ODBC endpoint. You refer to an ODBC DSN when you configure a data source name with information such as which ODBC driver to use or the host name and port of the ODBC endpoint.

An ODBC DSN is a sequence of name‐value pairs. For information about the valid names for a given ODBC data source type, such as Sybase, Microsoft SQL Server, or Oracle, please download the DataDirect Connect Series for ODBC User's Guide and DataDirect Connect Series for ODBC User's Guide in the Progress DataDirect Document Library.

Toolbar

The following table provides descriptions of the toolbar options.

Option Description

netwitness_ic-add.png

Opens the Add DSN dialog in which you add an event source for the event source type you selected in the Event Categories panel.

netwitness_delete_icon.png

Deletes the selected event sources.

netwitness_edit_icon.png

Opens the Edit DSN dialog in which you modify the configuration parameters for the selected event source.

When you select multiple event sources, this option opens the Bulk Edit Source dialog in which you can edit the parameters values for the selected file directories.

netwitness_importdsnicon.png

Opens the Bulk Add Option dialog in which you can import DSN parameters in bulk from a comma-separated values (CSV) file. The Bulk Add Option dialog has the following two options:

  • Import CSV File

  • Paste CSV Content

netwitness_exportdsnicon.png

Creates a .csv file that contains the parameters for the selected DSNs.

netwitness_testconnection.png

Validates the configuration parameters for the selected ODBC database.

Add or Edit DSN Dialog

In this dialog, you add or modify an event source for the selected event source.

Basic Parameters

Note: Required parameters are marked with an asterisk. All other parameters are optional.

Name Description

DSN*

The data source name (DSN) that defines the database from which to collect events.

Select an existing DSN from the drop-down list. For details, see ODBC DSNs Event Source Configuration Parameters.

Username*

User name that the data source name uses to connect to the database. You must specify a user name when you create the event source.

Password

Password that the data source name uses to connect to the database.

Caution: The password is encrypted internally and is displayed in its encrypted form.

Enabled

Select the checkbox to enable the event source configuration to start collection. The checkbox is selected by default.

Address*

For ODBC, this field is not used. The Log Collector uses the address in the ODBC.ini file.

Advanced Parameters

Name Description

Max Cell Size

Maximum size in bytes of the data that the Log Collector can pull from one cell in the database. The default value is 2048.

Nil Value

Character string that the Log Collector displays when NIL is returned for a cell in the database. Default value: “” (null).

Polling Interval

Interval (amount of time in seconds) between each poll. The default value is 180.

For example, if you specify 180, the collector schedules a polling of the event source every 180 seconds. If the previous polling cycle is still underway, the collector waits for that cycle to finish. If you have a large number of event sources that you are polling, it may take longer than 180 seconds for the polling to start because the threads are busy.

Max Events Poll

The maximum number of events per polling cycle (how many events collected per polling cycle).

Debug

Caution: Caution: Only enable debugging (set this parameter to On or Verbose) if you have a problem with an event source and you need to investigate this problem. Enabling debugging will adversely affect the performance of the Log Collector.

Enables or disables debug logging for the event source. Valid values are:

  • Off = (default) disabled

  • On = enabled

  • Verbose = enabled in verbose mode ‐ adds thread information and source context information to the messages.

This parameter is designed to debug and monitor isolated event source collection issues. If you change this value, the change takes effect immediately (no restart required). The debug logging is verbose, so limit the number of event sources to minimize performance impact.

Initial Tracking Id

Initial identification code that the Log Collector assigns to this event source if collection is not started. If there is no value for this parameter, the Log Collector starts at the end of the table and only pulls rows after the end of the table as they are added. The default value is “” (null).

For Example: 2020-11-11 05:05:11

Note: The Initial Tracking ID format varies based on the format of the tracking column used in the data query in the typespec.
For Example: If the tracking column value is in epoch, the Initial Tracking ID must be in the epoch format.

Filename

For Microsoft SQL Server Event Sources only, the location of the trace files directory (for example, C:\MyTraceFiles).

Refer to the NetWitness Microsoft SQL Server Event Source Configuration Guide, located on NetWitness Link.

Test Connection

Checks the configuration parameters specified in this dialog to make sure they are correct.

Cancel

Closes the dialog without adding or modifying DSN parameters.

OK

Adds or modifies the parameters for the DSN.