Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 

Configuring JSA to Receive Events from a Sybase ASE Device

 

Configure JSA to collect events from a Sybase ASE device by using the JDBC protocol.

  1. Log in to JSA.
  2. Click the Admin tab.
  3. On the navigation menu, click Data Sources.
  4. Click the Log Sources icon.
  5. Click Add, and then configure the parameters.

    The following table describes the protocol-specific parameters for Sybase when using the JDBC protocol:

    Table 1: Sybase JDBC Protocol Parameters

    Parameter

    Value

    Log Source Name

    Type a unique name for the log source.

    Log Source Description

    Type a description for the log source.

    Log Source type

    Sybase ASE

    Protocol Configuration

    JDBC

    Log Source Identfier

    Type a name for the log source. The name can't contain spaces and must be unique among all log sources of the log source type that is configured to use the JDBC protocol.

    If the log source collects events from a single appliance that has a static IP address or host name, use the IP address or host name of the appliance as all or part of the Log Source Identifier value; for example, 192.168.1.1 or JDBC192.168.1.1. If the log source doesn't collect events from a single appliance that has a static IP address or host name, you can use any unique name for the Log Source Identifier value; for example, JDBC1, JDBC2.

    Database Type

    Sybase

    Database Name

    The name of the database to which you want to connect.

    IP or Hostname

    The IP address or host name of the database server.

    Port

    Enter the JDBC port. The JDBC port must match the listener port that is configured on the remote database. The database must permit incoming TCP connections. The valid range is 1 - 65535.

    The defaults are:

    • MSDE - 1433

    • Postgres - 5432

    • MySQL - 3306

    • Sybase - 1521

    • Oracle - 1521

    • Informix - 9088

    • DB2 - 50000

    If a database instance is used with the MSDE database type, you must leave the Port field blank.

    Username

    A user account for JSA in the database.

    Password

    The password that is required to connect to the database.

    Confirm Password

    The password that is required to connect to the database.

    Predefined Query

    Select a predefined database query for the log source. If a predefined query is not available for the log source type, administrators can select the none option.

    Table Name

    The name of the table or view that includes the event records. The table name can include the following special characters: dollar sign ($), number sign (#), underscore (_), en dash (-), and period (.).

    Select List

    The list of fields to include when the table is polled for events. You can use a comma-separated list or type an asterisk (*) to select all fields from the table or view. If a comma-separated list is defined, the list must contain the field that is defined in the Compare Field.

    Compare Field

    A numeric value or time stamp field from the table or view that identifies new events that are added to the table between queries. Enables the protocol to identify events that were previously polled by the protocol to ensure that duplicate events are not created.

    Use Prepared Statements

    Prepared statements enable the JDBC protocol source to set up the SQL statement, and then run the SQL statement numerous times with different parameters. For security and performance reasons, most JDBC protocol configurations can use prepared statements.

    Start Date and Time

    Type the start date and time for database polling in the following format: yyyy-MM-dd HH:mm with HH specified by using a 24-hour clock. If the start date or time is clear, polling begins immediately and repeats at the specified polling interval.

    Polling Interval

    Enter the amount of time between queries to the event table. To define a longer polling interval, append H for hours or M for minutes to the numeric value.

    The maximum polling interval is one week.

    EPS Throttle

    The number of Events Per Second (EPS) that you do not want this protocol to exceed. The valid range is 100 - 20,000.

    Enabled

    Select this check box to enable the log source. By default, the check box is selected.

    Credibility

    From the list, select the Credibility of the log source. The range is 0 - 10.

    The credibility indicates the integrity of an event or offense as determined by the credibility rating from the source devices. Credibility increases if multiple sources report the same event. The default is 5.

    Target Event Collector

    Select the Target Event Collector to use as the target for the log source.

    Coalescing Events

    Select the Coalescing Events check box to enable the log source to coalesce (bundle) events.

    By default, automatically discovered log sources inherit the value of the Coalescing Events list from the System Settings in JSA. When you create a log source or edit an existing configuration, you can override the default value by configuring this option for each log source.

    Store Event Payload

    Select the Store Event Payload check box to enable the log source to store event payload information.

    By default, automatically discovered log sources inherit the value of the Store Event Payload list from the System Settings in JSA. When you create a log source or edit an existing configuration, you can override the default value by configuring this option for each log source.

  6. Click Save.
  7. On the Admin tab, click Deploy Changes.