Migrating Time-Based Flex to Connapp - A PS Document from Dave Empringham

Summary:

This document provides a step-by-step guide for migrating an MS SQL Time-Based FlexConnector from another system to the Connector Appliance in ArcSight. The steps include uploading the JDBC driver, necessary properties and categorizer CSV files, running the connector setup, and verifying its functionality. Key points are highlighted below: 1. **Upload the JDBC Driver:** - Navigate to `Setup/Repositories/JDBC Drivers` and upload `sqljdbc4.jar`. Name it as `msjdbcv4` and apply it to the repository. 2. **Upload Properties and Categorizer Files:** - Go to `Setup/Repositories/Flex Connector Files`, specify a subfolder, and upload `.sdktbdatabase.properties` and categorizer CSV files under `acp/categorizer/current/microsoft`. Ensure filenames are in lowercase with underscores for spaces. 3. **Run the Connector Setup:** - Follow any additional setup instructions or default configurations to complete the installation. 4. **Verify Functionality:** - Test the FlexConnector on the Connector Appliance by ensuring it connects to MS SQL databases and processes data correctly. By following these steps, you can successfully migrate your existing FlexConnector to the Connector Appliance, maintaining seamless integration within your ArcSight environment.

Details:

To move an MS SQL Time-Based FlexConnector to the Connector Appliance, follow these steps after ensuring you have downloaded the appropriate driver (sqljdbc4.jar for MS SQL 2005 - 2012), selected a suitable container, and developed your FlexConnector on another system which is functioning correctly: 1. **Upload the JDBC Driver:**

• Go to `Setup/Repositories/JDBC Drivers`.

• Click `Upload to Repository` then select "individual files".

• Keep the default subfolder as `lib`.

• Upload the `sqljdbc4.jar` file by browsing and submitting it.

• Name it, for example, `msjdbcv4`, and apply it to your chosen repository using the "up" arrow.

2. **Upload the .sdktbdatabase.properties and Categorizer CSV Files:**

• Go to `Setup/Repositories/Flex Connector Files`.

• Click `Upload to Repository` then choose "individual files".

• Specify the subfolder, for example, `flexagent/AuthAndAudit`.

• Upload the `.sdktbdatabase.properties` file (e.g., `$ARCSIGHT_HOME/user/agent/flexagent/AuthAndAudit/AuditAndLogging.sdktbdatabase.properties`).

• For the categorizer CSV files, select "Yes, I would like to add more files to a different folder" and proceed by entering the path `acp/categorizer/current/microsoft`.

• Ensure all file names are in lowercase with underscores for spaces if necessary. Click next and confirm that you have added all required files.

3. **Run the Connector Setup:**

• Follow any additional setup instructions provided or default configurations to complete the installation process.

4. **Verify Functionality:**

• Test the FlexConnector on the Connector Appliance to ensure it is functioning as expected, connecting to MS SQL databases and processing data according to your requirements.

By following these steps, you will successfully migrate your existing MS SQL Time-Based FlexConnector to the Connector Appliance, allowing for seamless integration and continued functionality within your ArcSight environment. To set up an Arcsight FlexConnector for MS SQL with a container, follow these steps: 1. **Confirm Settings**: Make sure all settings are correct in the connector setup interface. 2. **Run Connector Setup**: Select your container from the list and choose "Add" > "Arcsight FlexConnector Time-Based DB". Click "Next" to proceed. 3. **Database Connection Details**:

• Choose the com.microsoft.sqlserver.jdbc.SQLServerDriver as the driver.

• Use the format jdbc:sqlserver://hostname_or_IP:port;databaseName=your database name for the connection string.

• Enter your user ID, password, and the Configuration folder that was created when you uploaded the properties file.

4. **Resolve Errors**: If errors occur, check the following potential issues:

• Ensure the correct hostname or IP is used. For hostnames, try using the fully qualified domain name.

• Verify that the flex code in the properties file is functioning correctly by reviewing it and ensuring it has been uploaded to the right location. Test it on your development system if necessary.

5. **Complete Setup**: If everything goes well, you will reach a screen where you can specify your destination. Click "Next" to finish the setup. 6. **Verify Functionality**: After installation, verify that events are being received correctly by examining them in Logger or ESM. Check categorization and field parsing as expected. Allow several minutes for this process. 7. **Troubleshoot No Events**: If no events are received:

• Restart the container housing the connector using the "Send Container Command" icon > "Restart".

8. **Check Categorization**: If categorization issues arise, verify that the name of the categorization file and directory in the properties file match those specified in your setup. The text describes a situation where certain words, such as "rectory" and "housing," are written in lowercase letters without any spaces between them. This could be referring to the formatting of labels or filenames within a specific context.

Disclaimer:

The content in this post is for informational and educational purposes only. It may reference technologies, configurations, or products that are outdated or no longer supported. If there are any comments or feedback, kindly leave a message and will be responded.