Connecting to an ODBC database fails on an NetWitness Log Collector
Issue
When doing the configuration for oracle database in Security Analytics and the default template is selected with the driver value /opt/netwitness/odbc/lib/R3or826.so, the following errors are reported:
Nov 28 18:47:44 logdecoder nw[30294]: [OdbcCollection] [failure] [OracleEMV.Test] [processing] [Test] [processing] An error occurred creating an ODBC connection.#011 The DSN for this connection is: Test The trapped error is: Unable to create an ODBC connection. DSN: Test; username: test; reason: state: IM003; error-code: 139693811302400; description: [DataDirect][ODBC lib] Specified driver could not be loaded
Nov 28 18:47:44 logdecoder nw[30294]: [OdbcCollection] [failure] [OracleEMV.Test] [processing] [Test] [processing failure] odbc:WrkUnit[1] Processing failed.
[root@logdecoder lib]# ldd R3or826.so
ldd: warning: you do not have execution permission for `./R3or826.so'
./R3or826.so: /usr/lib64/libodbcinst.so: no version information available (required by ./R3or826.so)
linux-vdso.so.1 => (0x00007fff8d1ff000)
libpthread.so.0 => /lib64/libpthread.so.0 (0x00007fd3631d1000)
librt.so.1 => /lib64/librt.so.1 (0x00007fd362fc9000)
libR3icu26.so => not found
libclntsh.so => not found
libodbcinst.so => /usr/lib64/libodbcinst.so (0x00007fd362db7000)
libdl.so.2 => /lib64/libdl.so.2 (0x00007fd362bb2000)
libstdc++.so.6 => /usr/lib64/libstdc++.so.6 (0x00007fd3628ac000)
libm.so.6 => /lib64/libm.so.6 (0x00007fd362628000)
libc.so.6 => /lib64/libc.so.6 (0x00007fd362293000)
libgcc_s.so.1 => /lib64/libgcc_s.so.1 (0x00007fd36207d000)
/lib64/ld-linux-x86-64.so.2 (0x00007fd363754000)
libltdl.so.7 => /usr/lib64/libltdl.so.7 (0x00007fd361e74000)
Nov 28 18:47:44 logdecoder nw[30294]: [OdbcCollection] [failure] [OracleEMV.Test] [processing] [Test] [processing failure] odbc:WrkUnit[1] Processing failed.
[root@logdecoder lib]# ldd R3or826.so
ldd: warning: you do not have execution permission for `./R3or826.so'
./R3or826.so: /usr/lib64/libodbcinst.so: no version information available (required by ./R3or826.so)
linux-vdso.so.1 => (0x00007fff8d1ff000)
libpthread.so.0 => /lib64/libpthread.so.0 (0x00007fd3631d1000)
librt.so.1 => /lib64/librt.so.1 (0x00007fd362fc9000)
libR3icu26.so => not found
libclntsh.so => not found
libodbcinst.so => /usr/lib64/libodbcinst.so (0x00007fd362db7000)
libdl.so.2 => /lib64/libdl.so.2 (0x00007fd362bb2000)
libstdc++.so.6 => /usr/lib64/libstdc++.so.6 (0x00007fd3628ac000)
libm.so.6 => /lib64/libm.so.6 (0x00007fd362628000)
libc.so.6 => /lib64/libc.so.6 (0x00007fd362293000)
libgcc_s.so.1 => /lib64/libgcc_s.so.1 (0x00007fd36207d000)
/lib64/ld-linux-x86-64.so.2 (0x00007fd363754000)
libltdl.so.7 => /usr/lib64/libltdl.so.7 (0x00007fd361e74000)
Resolution
The workaround is to use the following driver value: /opt/netwitness/odbc/lib/R3ora26.so
Product Details
NetWitness Product Set: NetWitness PlatformNetWitness Product/Service Type: Log Collector
Platform: Windows
Platform (Other): v9.6 without SPx, 2008 R2 Express is running on EM
O/S Version: 2008 Server R2 x64
Approval Reviewer Queue
Technical approval queue