Skip to content
  • There are no suggestions because the search field is empty.

ODBC Collection Fails to Start Post Upgrade to 12.5.x

Issue

After upgrading to NetWitness Platform 12.5.x, ODBC collection fails to start.


Cause

The ODBC collections fail to start due to the phasing out of the ODBC driver for JDBC/ElasticSearch. As of 12.5.0, NetWitness no longer has the license to use the ODBC driver. Due to this all customers with ODBC collections must migrate to JDBC/ElasticSearch collections. 

When the upgrade into 12.5.x is completed, the ODBC collections have been moved to /var/netwitness/logcollector/odbc_backup for safe keeping. With these collections moved to this location, the ODBC collections are will no longer function.


Workaround

This article will provide instructions for temporarily reactivating the ODBC collection method to allow customers time to migrate to JDBC. As there is currently no automatic way to migrate these connections, customers will have to manually rebuild all ODBC connections into JDBC ones. The JDBC configuration guides can be found on the NetWitness Community when searching for JDBC. The mention of this transition can be found in the Release Notes for 12.5.1.0 under section New JDBC Integrations for Log Collection.

It is important that we let customers know that the reactivation of the ODBC collections is only a temporary fix and they MUST migrate these event sources to JDBC. On the next NetWitness upgrade the same process of shutting down the ODBC event sources will happen again and there may be no way to reactivate them as all ODBC sources are no longer officially supported in NetWitness 12.5.x.


To temporarily reactivate the ODBC Collections, follow the below steps.

  1. SSH into the Log Collector/Log Decoder where the ODBC event sources were configured.

  2. Go to /opt/netwitness and create a odbc directory.
    # cd /opt/netwitness
    # mkdir odbc
  3. Copy all the content from /var/netwitness/logcollector/odbc_backup to /opt/netwitness/odbc.
    # cp -r /var/netwitness/logcollector/odbc_backup /opt/netwitness/odbc
  4. Restart the Log Collector service to reactivate the ODBC event sources.
    # systemctl restart nwlogcollector
  5. Check the NetWitness UI to confirm that the ODBC sources are collecting again.

Important Note:

  • NetWitness Platform no longer supports the bundling of any ODBC drivers in the Log Collector RPM due to the expiration of the license agreement with Progress. However, the backed-up ODBC files are retained only to support the existing ODBC collection for customers that are upgrading to 12.5.x from lower versions of NetWitness. This is a stop gap method to allow these customers time to migrate their ODBC collections to JDBC collections. 
  • Fresh installations must use the JDBC for database log collection. The option to create new ODBC collections is not available or supported.
  • As of 12.5.x ODBC drivers are deprecated. Do not redistribute or share ODBC drivers for any new implementations. Unauthorized distribution of these drivers may lead to compliance violations for NetWitness.

Product Details

NetWitness Product Set: NetWitness Platform
NetWitness Product/Service Type: Log Collector
NetWitness Version/Condition:12.5.x
Platform: AlmaLinux


Summary

Customer upgrades to 12.5.x and all ODBC collections are failing. This is due to the switching from ODBC to JDBC as the collection method. This article provides instructions for how to temporally reactivate the ODBC collections to allow the customer to migrate.


Approval Reviewer Queue

Technical approval queue