Skip to content
  • There are no suggestions because the search field is empty.

ODBC event collection fails with message Unable to execute statement: Statement: exec nic_aud_swap_trace in Netwitness

Issue

ODBC Log Collection to a Microsoft SQL Database fails due to a trace file becoming corrupted. The Trace File directory on the SQL Server will continue filling with logs until this situation is resolved.

  • In the /var/log/messages file on the Log Collector, messages similar to the following will be seen:
    Jun 5 07:59:45 REMOTELOGCOL nw[1955]: [OdbcCollection] [failure] [mssql.MSSQL] [processing] [MSSQL] [processing] An error occurred collecting ODBC events using query tag MSSQL. Error: Unable to execute statement: Statement: "exec nic_aud_swap_trace 30, 'c:\MyTraceFiles\', 1, 'WHERE StartTime > 2015-06-04 17:04:42.110'"; Reason: state: S1000; error-code: 140071768425015; description: [RSA][ODBC SQL Server Wire Protocol driver][Microsoft SQL Server]File 'c:\MyTraceFiles\-4.trc' either does not exist or is not a recognizable trace file. Or there was an error opening the file.
  • The important error to observe is below:
    Error: Unable to execute statement: Statement: "exec nic_aud_swap_trace 30, 'c:\MyTraceFiles\',
  • In this example, c:\MyTraceFiles is the directory where the Tracefiles are being stored on the MS SQL Server.

Cause

A trace file has become corrupted which prevents the Log Collector from collecting further files.
Ensure that the trace file directory is excluded from any software that may also lock files in this directory.
Examples of such software include anti-virus or third-party backup software.

Resolution

To resolve the issue:
  1. Obtain access to the Microsoft SQL Server with Microsoft SQL Server Management Studio
  2. Navigate to the Master Database
  3. Run the db.nic_aud_init_trace stored procedure. To preserve data, make sure that a NULL value is parsed. Otherwise, trace files will be deleted and not processed.
The screenshots below illustrate this process
image.png
image.png image.pngThe Trace files will then be processed correctly.

Notes

All screenshots come from an internal test machine and contain no sensitive information.


Product Details

NetWitness Product Set: NetWitness Logs & Network
NetWitness Product/Service Type: Log Collector
NetWitness Version/Condition: 11.x , 12.x
Platform: CentOS , AlmaLinux


Approval Reviewer Queue

Technical approval queue