Previous Topic: Set OPSEC Configurations

Next Topic: Set localsyslog Configurations

Set ODBC Configurations

You can control data access settings for integrations using the ODBC sensor. You can use the CA-provided default settings for most event collection purposes, or you can alter these settings for custom integrations.

To set ODBC configurations

  1. Open the integration wizard, select the ODBC sensor, and advance to the Default Configurations step.
  2. Set or edit the following master configuration values to identify and access the event source you want:
    Connection String

    Defines a set of keyword-value pairs that allow the agent to connect to, and collect events from, the event source. The driver string uses the following format:

    DRIVER={attribute-value}; driver-defined-attribute-keyword-value-pairs

    Example: Driver={Oracle_ODBC_Driver_Name};Dbq=myDBName;

    For more detail on specific ODBC connection string settings, see the connector guide for the connector you are configuring.

    UserName

    Defines the name of the user with appropriate event-collection access rights.

    Password

    Defines the password of the user with appropriate event-collection access rights.

    TZ Offset Sign

    Defines whether the event source time zone is ahead of or behind the CA Enterprise Log Manager time zone, using the plus or minus signs.

    TZ Offset Hours

    Defines the difference in hours between the event source time zone and the CA Enterprise Log Manager time zone.

    TZ Offset Minutes

    Defines the difference in minutes between the event source time zone and the CA Enterprise Log Manager time zone.

    EventLogName

    Defines the log name created for this integration. The log name is used to associate any XMP and DM files attached to the integration.

    UpdateAnchorRate

    Defines the threshold, in events, at which an anchor value is created. If event processing is interrupted, the agent refers to the latest anchor to begin reprocessing. Setting a lower anchor rate reduces the chance of lost events, but affects performance because the anchor value is created more often. Setting a high anchor rate increases workload, because many events would be reprocessed in the event of a processing interruption.

    Poll Interval

    Defines the threshold, in seconds, that no event reception causes a pause of the same length in event polling. For example, a setting of 10 means that if 10 seconds elapse without any events being found, the agent waits 10 seconds before resuming polling.

    MaxEventsPerSecond

    Sets the maximum number of events that can be processed.

    Read from beginning

    Controls whether the agent begins reading the file from the beginning if event processing is interrupted. If the check box is not selected, the agent resumes reading events using the anchor rate. If the check box is selected the sensor reads the log file from the beginning when you deploy a connector. Depending on the size of the database and the rate of event generation, the CA Enterprise Log Manager log sensor can take some time to synchronize with real-time events.

  3. Set or edit the following event-collection values:
    SourceName

    Defines the name of the target event source.

    AnchorSQL

    Defines the SQL query used to set the Anchor value. The name or alias of the field that the AnchorSQL references must match the Anchor field value. The AnchorSQL syntax is based on the target database schema. When creating a custom integration, refer to your individual database schema documentation.

    Anchor field

    Identifies the native field to be checked for events. The event collection query targets the Anchor field you specify. The Anchor field value must match the name or alias of the column included in the AnchorSQL and EventSQL statements. For example, if you set the Anchor field to use the alias "NTimestamp", the statements you enter in the AnchorSQL and EventSQL fields must also reference "NTimestamp".

    EventSQL

    Defines the SQL query used to collect events from the log file by identifying the target column. The EventSQL statement must include the Anchor field, and match the name or alias you use in the Anchor field. The EventSQL syntax is based on the target database schema. When creating a custom integration, refer to the database schema documentation for your ODBC database product or application.

    Enable Milliseconds

    Selects whether milliseconds are considered for date fields contained in the event logs collected by the EventSQL query.

  4. (Optional) To add additional event-collection values, click Repeat: Integration value repeat button

    An additional event-collection fields appear, allowing you to enter values for additional event collection from the same source.

  5. Click the appropriate arrow to advance to the wizard step you want to complete next, or click Save and Close.

    If you click Save and Close, the new integration appears in the user folder list, otherwise the step you select appears.