Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

SSIM 4.8 Critical System Protection JDBC Issue

Created: 26 Nov 2012 • Updated: 11 Jan 2013 | 5 comments
Rodrigo Calvo's picture
This issue has been solved. See solution.

Hi

The following is my situation:

- SSIM 4.8

- MS SQL 2005

- Symantec Critical System Protection Collector v 4.3 id 3137 --Onbox--

The following error appears:

Error while initializing the sensor SCSPdb. Cannot find JDBC driver class "com.microsoft.sqlserver.jdbc.SQLServerDriver". It is possible an incorrect "JDBC Drivers Directory" was specified.
 

I'm using the same DB for SEP and SCSP, with SEP it works fine the JDBC driver but not with SCSP.

Config.xml from SCSP showed a possible bad reference: "sqljdbc.jar" , I updated to sqljdbc4.jar, but the issue remains.

I appreciate a lot your help about it.

Rodrigo

 

PD.

Config.xml

<bean class="com.symantec.cas.ucf.util.SESAEventFieldType" id="fieldTypes" />
  <bean class="com.symantec.cas.ucf.sender.CollectorEventSender" id="sender">
    <constructor-arg index="0">
      <ref local="fieldTypes" />
    </constructor-arg>
  </bean>
  <bean class="com.symantec.cas.ucf.queues.EventSenderQueueImpl" id="senderqueue">
    <constructor-arg index="0">
      <ref local="sender" />
    </constructor-arg>
  </bean>
  <bean class="com.symantec.cas.ucf.aggregator.EventAggregatorImpl" id="aggregator">
    <constructor-arg index="0">
      <ref local="senderqueue" />
    </constructor-arg>
    <constructor-arg index="1">
      <ref local="fieldTypes" />
    </constructor-arg>
  </bean>
  <bean class="com.symantec.cas.ucf.queues.AggregatorQueueImpl" id="aggregatorqueue">
    <constructor-arg index="0">
      <ref local="aggregator" />
    </constructor-arg>
  </bean>
  <bean class="com.symantec.cas.ucf.filter.EventFilterImpl" id="filter">
    <constructor-arg index="0">
      <ref local="aggregatorqueue" />
    </constructor-arg>
    <constructor-arg index="1">
      <ref local="fieldTypes" />
    </constructor-arg>
  </bean>
  <bean class="com.symantec.cas.ucf.queues.FilterQueueImpl" id="filterqueue">
    <constructor-arg index="0">
      <ref local="filter" />
    </constructor-arg>
  </bean>
  <bean class="com.symantec.cas.ucf.translator.Translator" id="translator_workinggroup0" />
  <bean class="com.symantec.cas.ucf.collector.SESProcessor" id="sesprocessor_workinggroup0" />
  <bean class="com.symantec.cas.ucf.sensors.SensorsProperties" id="sensorsProperties0">
    <property name="props">
      <props>
        <prop key="ResultStringDelimiter">|</prop>
        <prop key="JdbcDriverFiles">sqljdbc4.jar</prop>
        <prop key="DatabaseDriver">com.microsoft.sqlserver.jdbc.SQLServerDriver</prop>
        <prop key="LastPositionUpdateFrequency">300000</prop>
        <prop key="QuerySet.1.Name">SCSPRealTimeEvents</prop>
 

Comments 5 CommentsJump to latest comment

Laurent_c's picture

Hey Orion,

 

I had no time to check but I think you need to update the second line :

 

<prop key="DatabaseDriver">com.microsoft.sqlserver.jdbc.SQLServerDriver</prop>

To something like :

<prop key="DatabaseDriver">com.microsoft.sqlserver.jdbc4.SQLServerDriver</prop>

At least it i slike that for the Sybase drivers:

       <prop key="JdbcDriverFiles"><![CDATA[jconn4.jar]]></prop>
       <prop key="DatabaseDriver"><![CDATA[com.sybase.jdbc4.jdbc.SybDriver]]></prop>
 

Rodrigo Calvo's picture

Thanks Laurent

It appears that didn't work.

I reviewed the document from MSDN "Working with Connection" and it appears that the connection string is right .

http://msdn.microsoft.com/en-us/library/ms378956(v=sql.90).aspx

The following is the DB Sensor Configuration

antilles's picture

Hi,

For SSIM 4.8, and SCSP with MS SQL 2005, config.xml part should be as follows:

sqljdbc4.jar
com.microsoft.sqlserver.jdbc.SQLServerDriver

Also in DB Sensor property "JDBC Drivers Directory" you should provide following path: /opt/Symantec/simserver/collectors/drivers/sqljdbc_4.0/enu/

If you changed config.xml then you need to restart the agent.

Regards

Rodrigo Calvo's picture

With the SSIM 4.8 that I have it looks like your recommendations were followed up but it doesn't work.

LoneSecAdmin's picture

I am running SSIM 4.8.0 as well and I have experienced the same issue and have resolved it by updating the noted driver file name to sqljdbc4.jar

(note this is line 48 in the config.xml)

    48         <prop key="JdbcDriverFiles">sqljdbc4.jar</prop>
 

However I did have to take the additional steps after having changed the config to stop the DB sensor by unchecking the sensor

system ->Product Configurations ->Symantec Critical System Protection Event Collector 4.3 -> Symantec Critical System Protection Event Collector -> Config -> DB Sensor

I saved , deployed , re-enabled, and re-deployed

After I completed this series of operations my sensor is up and recieving logs.

 

Final Note-

When I ran live update my change the the configuration file was overwritten and I had to re-apply the steps above.

 

I hope this helps someone.

 

 

SOLUTION