Control Compliance Suite

Hello everyone,

I'm running into some trouble using a new CIS standard. We have a bunch of Oracle 11.2.0.2.0 (Oracle 11gR2) in our environment. They were currently assessed via a modified "CIS ORACLE DATABASE SERVER 11 Security Benchmark 1.0.1" standard and it worked. 

We are collecting this via agents 11.1 deployed on the system (Solaris 10 on sparc)

I've now updated the product with the latest SCU (SCU-2016-1) which also includes CIS standards for 11gR2 and I want to use them on those hosts.

So, I update the content of the agent via a agent content update job which works. I see that the raw collection is now on 2016 while the message is still in 2011. 

When I launch the job, it fails with the following error:

Failed to retrieve collected data from SQL. Asset XXX, Standar Oracle 11gr2 This can be because of SQLconnection issue or data is not collected for given asset and standard pair.

Any ideas?

Thanks

Paul

 

 

Hi Paulo,

that message "Failed to retrieve collected data from SQL" should be warning message, not an error, can you confirm? And actually means that evaluation job was not able to evaluate anything since no data was collected which you can verify by right-click on job and selecting "Data Colleciton Details".

Is there any other error message there?

Also ensure you upgraded your products (infrastructure and agents) to 11.5 and SCU2016-1 as there were lot of changes in the Oracle modules.

thx vladx, Indeed, nothing is collected at all. I should have added that precison as well. I'll probably habe to update the infrastructure, sym support also points to that... thx for your help

I'll post the error i have in the collection... you never know (once i access the infra)

So the error I got when I run a collection job is:

oracle data collector: query returned with message(s). The parameter is incorrect

Details: "The parameter is incorrect.=0D=0A. Scope is server 'XXX'"

There are three DB assets on that solaris box and I get the same error for each one of the assets.

0D 0A is CR LF but not sure that it helps :/

Thanks for your help

Paulo

 

Hi Paulo,

Oracle is one of the more problematic assets to set-up scanning as there is so much that can go wrong. From experience, I found that following these steps provide better chance of configuring the scanning correctly (I asume agent-less here, in case of agent-based it's a bit didderent):

1. Have latest PU/SCU installed on Application Server and CCS Manager

2. Install Oracle Instant Client (latest version) on CCS Manager

3. Download also Instant Client Package - SQL*Plus package which will be useful for troubleshooting

4. Open ports between CCS Manager and target server

5. Ensure CCS Manager properly resolved the target server

6. Obtain proper credentials for data collection (both for the OS and DB)

   • ensure you test the credentials by trying connecting to db via sqlplus you installed in step 3

7. Ensure credentials have proper access to the resources being scanned

8. Add Unix asset into CCS

9. Add OS asset credentials

10. Import Oracle asset from OS asset

11. Add Oracle asset credentials

12. Run some simple query against DB asset to verify

 

For some general troubleshooting you can try:

- Troubleshooting Oracle credentials

<path to\instantclient_12_1>sqlplus <user name>/<password>@server.domain.com:1521/<SID>

- on Unix server where DB is running, run (as Oracle user) "lsnrctl status" and compare the information with the oracle asset in CCS

 

Note that above is from my experience setting up Oracle monitoring for simple (default) installation of Oracle, not RAC or some highly complex set-up and I'm not Oracle expert. If above does not help, provide me following info:

- Oracle DB version along with host OS name and versions (uname –a output in case of Unix systems).
- Export all messages received for data collection job run.
- Export all messages received during asset import job.
- Provide any screenshots or assets which may illustrate the issue or provide additional information.

 

Hello Vladx,

After some digging around, we found that by deleting some (4) checks in the new CIS policy (§2.1) it works.

I thought the data collection was being done before any of the checks are evaluated and as such I didn't even think about finetuning the policy. 

I would have expected some errors telling me which checks generated the error...

So, not cool. And I'm sure I'll run into some trouble later on.

Thanks for your help.

Paulo

 

Hi Paulo,

I have seen this behaviour where some checks from the standard caused issues with data collection without giving any detailed error messages. However when using latest PU/SCU and CIS standard, this should not happen and the best is to contact Symantec support in this case.