Data Loss Prevention

The vontu incident persister service is not starting and getting stopped automatically.I changed the DB Password but since then everything else working except this vontu incident persister service.I also tried reinstallation but dint work.

The only thing that I fopund suspicious in logs is that  "KeyIgnition failed".Below are the log details :

Jan 4, 2012 3:42:18 PM (INFO) Thread: 10 [com.vontu.logging.operational.api.PropertyFileOperationalLogWriter.<init>] Initializing the localized operational log: com.vontu.incidenthandler.logging.IncidentPersisterOperationalLogHandler

Jan 4, 2012 3:42:18 PM (INFO) Thread: 10 [com.vontu.logging.operational.api.PropertyFileOperationalLogWriter.<init>] Initializing the localized operational log: com.vontu.datainsight.logging.DataInsightOperationalLogHandler

Jan 4, 2012 3:42:18 PM (INFO) Thread: 10 [com.vontu.incidenthandler.IncidentPersister.main] (INCIDENT_PERSISTER.2) The Incident Persister is starting.

Jan 4, 2012 3:42:18 PM (INFO) Thread: 10 [com.vontu.incidenthandler.IncidentPersister.main] Waiting on database and Model initialization...

Jan 4, 2012 3:42:18 PM (INFO) Thread: 10 [com.vontu.model.notification.NotificationModel.<init>] Notification model created using: com.vontu.model.ojb.OJBSystem

Jan 4, 2012 3:42:18 PM (INFO) Thread: 10 [com.vontu.model.ojb.OJBSystem.start] Configuring Model to use custom CLOB Convertor

Jan 4, 2012 3:42:18 PM (INFO) Thread: 10 [com.vontu.model.ojb.OJBSystem.start] Configuring Model to use custom BLOB Convertor

Jan 4, 2012 3:42:19 PM (INFO) Thread: 10 [com.vontu.model.ojb.OJBSystem.start] Default database connection: oracle-thin

Jan 4, 2012 3:42:19 PM (INFO) Thread: 10 [org.apache.ojb.broker.platforms.PlatformOracle9iImpl.<init>] Initializing Vontu Implementation of OJB Oracle Platform for IncidentPersister service

Jan 4, 2012 3:42:19 PM (INFO) Thread: 10 [com.vontu.model.ojb.OJBSystem.start] Opened database: oracle-thin; JDBC connection URL: jdbc:oracle:thin:@(description=(address=(host=127.0.0.1)(protocol=tcp)(port=1521))(connect_data=(sid=protect)))

Jan 4, 2012 3:42:19 PM (INFO) Thread: 10 [com.vontu.model.notification.rmi.RMINotificationModel.start] Created listener proxy: bind address = 127.0.0.1, timeout = DEFAULT, server object host = 127.0.0.1

Jan 4, 2012 3:42:19 PM (INFO) Thread: 11 [com.vontu.model.notification.rmi.ModelListenerProxyImpl.notificationActivated] Listener proxy activated; host: HODLP01.alrajhi.bank, unique ID: 92,001

Jan 4, 2012 3:42:19 PM (INFO) Thread: 10 [com.vontu.model.Model.createInstance] Created Model instance using: com.vontu.model.ojb.OjbAuthorizingModel

Jan 4, 2012 3:42:19 PM (INFO) Thread: 12 [com.vontu.model.ojb.LockServerConnector.getLockServer] Connected to lock server at 127.0.0.1:37328.

Jan 4, 2012 3:42:19 PM (SEVERE) Thread: 12 [com.vontu.model.notification.NotificationModel.downConnection] Unable to connect to: jdbc:oracle:thin:@(description=(address=(host=127.0.0.1)(protocol=tcp)(port=1521))(connect_data=(sid=protect)))

Jan 4, 2012 3:42:19 PM (SEVERE) Thread: 12 [com.vontu.model.notification.NotificationModel.downConnection] Unable to connect to: {0}

com.vontu.model.DatabaseConnectionException: org.apache.ojb.broker.PersistenceBrokerException: Used ConnectionManager instance could not obtain a connection

                at com.vontu.model.ojb.OJBSystem.checkConnectionStatus(OJBSystem.java:1022)

                at com.vontu.model.ojb.OJBSystem.getDataCollectionByExample(OJBSystem.java:667)

                at com.vontu.model.ojb.OJBSystem.getDataObjectByExample(OJBSystem.java:444)

                at com.vontu.model.ModelProxy.getDataObjectByExample(ModelProxy.java:75)

                at com.vontu.model.notification.NotificationModel.getDataObjectByExample(NotificationModel.java:246)

                at com.vontu.model.ModelProxy.getDataObjectByExample(ModelProxy.java:75)

                at com.vontu.model.security.AuthorizingModel.getDataObjectByExample(AuthorizingModel.java:137)

                at com.vontu.incidenthandler.IncidentPersister$AdminUserQueryExecutor.executeModelQuery(IncidentPersister.java:346)

                at com.vontu.incidenthandler.IncidentPersister$AdminUserQueryExecutor.executeModelQuery(IncidentPersister.java:338)

                at com.vontu.model.data.util.DisconnectionAwareQuery$LoadRequest.run(DisconnectionAwareQuery.java:122)

                at com.vontu.util.concurrent.QueueingTask.performWork(QueueingTask.java:41)

                at com.vontu.util.concurrent.WorkerThread.run(WorkerThread.java:57)

Caused by: org.apache.ojb.broker.PersistenceBrokerException: Used ConnectionManager instance could not obtain a connection

                at org.apache.ojb.broker.accesslayer.StatementManager.getPreparedStatement(StatementManager.java:613)

                at org.apache.ojb.broker.accesslayer.JdbcAccessImpl.executeQuery(JdbcAccessImpl.java:269)

                at org.apache.ojb.broker.accesslayer.RsQueryObject.performQuery(RsQueryObject.java:72)

                at org.apache.ojb.broker.accesslayer.RsIterator.<init>(RsIterator.java:187)

                at org.apache.ojb.broker.core.RsIteratorFactoryImpl.createRsIterator(RsIteratorFactoryImpl.java:58)

                at org.apache.ojb.broker.core.PersistenceBrokerImpl.getRsIteratorFromQuery(PersistenceBrokerImpl.java:2073)

                at org.apache.ojb.broker.core.PersistenceBrokerImpl.getIteratorFromQuery(PersistenceBrokerImpl.java:1628)

                at org.apache.ojb.broker.core.QueryReferenceBroker.getCollectionByQuery(QueryReferenceBroker.java:119)

                at org.apache.ojb.broker.core.QueryReferenceBroker.getCollectionByQuery(QueryReferenceBroker.java:263)

                at org.apache.ojb.broker.core.PersistenceBrokerImpl.getCollectionByQuery(PersistenceBrokerImpl.java:1476)

                at org.apache.ojb.broker.core.DelegatingPersistenceBroker.getCollectionByQuery(DelegatingPersistenceBroker.java:373)

                at org.apache.ojb.broker.core.DelegatingPersistenceBroker.getCollectionByQuery(DelegatingPersistenceBroker.java:373)

                at org.apache.ojb.odmg.oql.OQLQueryImpl.execute(OQLQueryImpl.java:254)

                at com.vontu.model.ojb.OJBSystem.getDataCollectionByExample(OJBSystem.java:654)

                ... 10 more

Caused by: org.apache.ojb.broker.accesslayer.LookupException: Could not get connection from DBCP DataSource

                at org.apache.ojb.broker.accesslayer.ConnectionFactoryDBCPImpl.checkOutJdbcConnection(ConnectionFactoryDBCPImpl.java:86)

                at org.apache.ojb.broker.accesslayer.ConnectionFactoryAbstractImpl.lookupConnection(ConnectionFactoryAbstractImpl.java:139)

                at org.apache.ojb.broker.accesslayer.ConnectionManagerImpl.getConnection(ConnectionManagerImpl.java:121)

                at org.apache.ojb.broker.accesslayer.StatementManager.getPreparedStatement(StatementManager.java:609)

                ... 23 more

Caused by: java.sql.SQLException: Listener refused the connection with the following error:

ORA-12505, TNS:listener does not currently know of SID given in connect descriptor

 

                at oracle.jdbc.driver.SQLStateMapping.newSQLException(SQLStateMapping.java:70)

                at oracle.jdbc.driver.DatabaseError.newSQLException(DatabaseError.java:133)

                at oracle.jdbc.driver.DatabaseError.throwSqlException(DatabaseError.java:199)

                at oracle.jdbc.driver.DatabaseError.throwSqlException(DatabaseError.java:480)

                at oracle.jdbc.driver.T4CConnection.logon(T4CConnection.java:413)

                at oracle.jdbc.driver.PhysicalConnection.<init>(PhysicalConnection.java:508)

                at oracle.jdbc.driver.T4CConnection.<init>(T4CConnection.java:203)

                at oracle.jdbc.driver.T4CDriverExtension.getConnection(T4CDriverExtension.java:33)

                at oracle.jdbc.driver.OracleDriver.connect(OracleDriver.java:510)

                at java.sql.DriverManager.getConnection(DriverManager.java:582)

                at java.sql.DriverManager.getConnection(DriverManager.java:154)

                at org.apache.commons.dbcp.DriverManagerConnectionFactory.createConnection(DriverManagerConnectionFactory.java:51)

                at org.apache.ojb.broker.accesslayer.ConnectionFactoryDBCPImpl$ConPoolFactory.createConnection(ConnectionFactoryDBCPImpl.java:414)

                at org.apache.commons.dbcp.PoolableConnectionFactory.makeObject(PoolableConnectionFactory.java:290)

                at org.apache.commons.pool.impl.GenericObjectPool.borrowObject(GenericObjectPool.java:840)

                at org.apache.commons.dbcp.PoolingDataSource.getConnection(PoolingDataSource.java:95)

                at org.apache.ojb.broker.accesslayer.ConnectionFactoryDBCPImpl.checkOutJdbcConnection(ConnectionFactoryDBCPImpl.java:82)

                ... 26 more

Caused by: oracle.net.ns.NetException: Listener refused the connection with the following error:

ORA-12505, TNS:listener does not currently know of SID given in connect descriptor

 

                at oracle.net.ns.NSProtocol.connect(NSProtocol.java:361)

                at oracle.jdbc.driver.T4CConnection.connect(T4CConnection.java:966)

                at oracle.jdbc.driver.T4CConnection.logon(T4CConnection.java:292)

                ... 38 more

Jan 4, 2012 3:42:19 PM (WARNING) Thread: 12 [com.vontu.model.data.util.DisconnectionAwareQuery$LoadRequest.run] Lost connection while executing com.vontu.incidenthandler.IncidentPersister$AdminUserQueryExecutor. Will retry when the connection is restored.

 

Jan 4, 2012 3:42:45 PM (INFO) Thread: 13 [com.vontu.model.notification.NotificationModel.checkDownConnections] Connection reestablished: jdbc:oracle:thin:@(description=(address=(host=127.0.0.1)(protocol=tcp)(port=1521))(connect_data=(sid=protect)))

Jan 4, 2012 3:42:45 PM (INFO) Thread: 10 [com.vontu.keystorehouse.KeyStoreContainer.<init>] Key store provider: Vontu specific Keystore implementation

Jan 4, 2012 3:42:45 PM (INFO) Thread: 10 [com.vontu.keystorehouse.KeyStoreContainer.<init>] Key store provider: Vontu specific Keystore implementation

Jan 4, 2012 3:42:45 PM (SEVERE) Thread: 10 [com.vontu.incidenthandler.keystore.KeyStoreIgniter.igniteKeys] KeyIgnition failed to validate password

Jan 4, 2012 3:42:45 PM (SEVERE) Thread: 10 [com.vontu.incidenthandler.IncidentPersister.main] Incident Persistor was unable to initialize

com.vontu.incidenthandler.PersisterInitializationException: Unable to initialize Model

                at com.vontu.incidenthandler.IncidentPersister.initializeModel(IncidentPersister.java:329)

                at com.vontu.incidenthandler.IncidentPersister.main(IncidentPersister.java:116)

                at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

                at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)

                at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)

                at java.lang.reflect.Method.invoke(Method.java:597)

                at org.tanukisoftware.wrapper.WrapperSimpleApp.run(WrapperSimpleApp.java:244)

                at java.lang.Thread.run(Thread.java:619)

Caused by: com.vontu.incidenthandler.PersisterInitializationException: KeyIgnition failed to validate password

                at com.vontu.incidenthandler.keystore.KeyStoreIgniter.igniteKeys(KeyStoreIgniter.java:37)

                at com.vontu.incidenthandler.IncidentPersister.initializeModel(IncidentPersister.java:317)

                ... 7 more

Jan 4, 2012 3:42:45 PM (SEVERE) Thread: 10 [com.vontu.incidenthandler.IncidentPersister.main] (INCIDENT_PERSISTER.6) An unrecoverable error occurred during the startup of the Incident Persister. The process will be terminated.

com.vontu.incidenthandler.PersisterInitializationException: Unable to initialize Model

                at com.vontu.incidenthandler.IncidentPersister.initializeModel(IncidentPersister.java:329)

                at com.vontu.incidenthandler.IncidentPersister.main(IncidentPersister.java:116)

                at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

                at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)

                at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)

                at java.lang.reflect.Method.invoke(Method.java:597)

                at org.tanukisoftware.wrapper.WrapperSimpleApp.run(WrapperSimpleApp.java:244)

                at java.lang.Thread.run(Thread.java:619)

Caused by: com.vontu.incidenthandler.PersisterInitializationException: KeyIgnition failed to validate password

                at com.vontu.incidenthandler.keystore.KeyStoreIgniter.igniteKeys(KeyStoreIgniter.java:37)

                at com.vontu.incidenthandler.IncidentPersister.initializeModel(IncidentPersister.java:317)

                ... 7 more

Jan 4, 2012 3:42:45 PM (INFO) Thread: 14 [com.vontu.incidenthandler.IncidentPersister$ShutdownHook.run] (INCIDENT_PERSISTER.3) Incident Persister shutdown initiated.

 

Symantec DLP connects to the Oracle database using a Oracle user named protect. The password for this Oracle user is stored in a file located in \Vontu\Protect\config. As a security measure, the contents of the file are encrypted.

DLP ships with a command-line utility to change the encrypted password in the file. The DBPasswordChanger utility is used to change the Oracle database password used by the DLP Enforce Server. DBPasswordChanger is located in \Vontu\Protect\bin.

Summary of password change procedure:

• shutdown all Vontu services
• change the database password within Oracle
• verify the new password
• change the password on the Enforce Server
• start the Vontu services
• login to the Enforce UI

As you'd already changed the password within Oracle, you need to use the DBPasswordChanger on the Enforce Server:

1. Stop the Vontu Services
2. Start a command shell and change to the bin directory: cd \Vontu\Protect\bin
3. The syntax for DBPasswordChanger is:

DBPasswordChanger <PasswordFilePath> <DLP Administrator Password> <Password Property to Change> <New Oracle Password>

For example:

DBPasswordChanger C:\vontu\protect\config\protectpassword.properties <DLPAdministratorPasswrod> jdbc.password.oracle <NewOraclePassword>

DBPasswordChanger C:\vontu\protect\config\protectpassword.properties <DLPAdministratorPasswrod> jdbc.password.oracle-thin <NewOraclePassword>

     4. start the Vontu services

I executed this command as given but it shows the usage as "Usage : DBPasswordChanger [Password FIle] [Vontu Administrator Passsword] [New Oracle Password]"[[[

On executing the command in above syntax it says "Incorrect Administrator password"

But the password is correct as I reinstalled the Enforce Server.

Note : It is a single tier architecture.When I reinstalled I didn't reinstalled the detection.

[[[New [New  [[New [[[[

Issue resolved.

I changed the DBPassword again and then stopped all vontu services and then ran DBPasswordChanger utility to change the Password for DLP. Once restarted the service everything went fine.