Troubleshooting
Problem
JDBC protocol can stop collecting events from Oracle database.
Cause
Error - java.lang.NoClassDefFoundError: oracle.xdb.XMLType
Diagnosing The Problem
In order to check for qradar logs for affected JDBC log source, its spconfig must be obtained:
- Get the name of the log source from log source management window.
- Enter the name in below command that will provide its spconfig.
psql -U qradar -c "select spconfig from sensordevice where devicename like '<log source name>';"
Based on it, check qradar logs for the error message.
less qradar.log | grep JdbcEventConnector<spconfig value> | less
The error message seen is as:
Jan 31 13:37:00 ::ffff:x.x.x.x [ecs-ec-ingress.ecs-ec-ingress] [Oracle//xxxx Protocol Provider Thread: class com.q1labs.semsources.sources.jdbc.JdbcEventConnector47606] com.q1labs.semsources.sources.jdbc.JdbcEventConnector: [DEBUG] error in event collection
Jan 31 13:37:00 ::ffff:x.x.x.x [ecs-ec-ingress.ecs-ec-ingress] [Oracle//xxxx Protocol Provider Thread: class com.q1labs.semsources.sources.jdbc.JdbcEventConnector47606] java.lang.NoClassDefFoundError: oracle.xdb.XMLType
Resolving The Problem
The error here highlights issue on Oracle database side.
This represents that some column in Oracle table or view has data in xml format that is not supported.
Oracle admin must check Oracle table and create new table or view with data in supported format - alphanumeric.
Document Location
Worldwide
[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwt0AAA","label":"Log Source"}],"ARM Case Number":"TS011982892","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]
Was this topic helpful?
Document Information
Modified date:
22 May 2023
UID
ibm16991247