NetWitness ODBC Collection errors with “Socket Closed”

Issue

Trying to add the ODBC event Source Microsoft SQL you may hit the following error:

  "Error: Unable to create an ODBC connectioMicn. DSN: xxxxx; username: xx; reason: state: 08S01; error-code: 140501265154048; 
  
description: [RSA][ODBC SQL Server Wire Protocol driver]Socket closed."

Cause

Normally the “Socket error” message in MSSQL indicates a network related issue from MSSQL Instance.
MSSQL 2005 uses Encryption by default which is usually the cause of this error. From MSSQL 2008 onwards, encryption is disabled by default.

Resolution

1. Connect to MSSQL server.
2. Click Start. Browse to the Microsoft SQL Server 2005/2008 program group and expand Configuration Tools.
3. Click SQL Server Configuration Manager.
4. Expand SQL Server Network Configuration, right-click the protocols for the server you want, and then click Properties.

5. On the "Flags" tab, open the drop down menu in front of protocol encryption option and select "No".

6. Restart SQL Server Engine by selecting "SQL Server Services" in right panel and right click on "SQL Server" and select restart.

7. Stop/Start ODBC collection on LogCollector/VLC Device from GUI
8. Follow ODBC collection in /var/log/messages to make sure the errors stopped

Product Details

NetWitness Product Set: NetWitness Platform
NetWitness Product/Service Type: Log Collector
NetWitness Version/Condition: 11.x, 12.x
Platform: CentOS / AlmaLinux
OS Version: 7 / 8.9

Summary

Error Socket Closed when using ODBC collection method to collect from Microsoft SQL

Approval Reviewer Queue

Technical approval queue