IBM Support

QRadar: Log source displays "No MySQL JDBC Driver present" error in the user interface

Troubleshooting


Problem

Log Sources that use JDBC protocol display the following error when you try to create or update a log source: No MySQL JDBC Driver present. This issue is caused by a missing MySQL JDBC driver. This technical note provides a procedure for administrators to install the MySQL JDBC driver and set the correct permissions on the files.

Symptom

An error similar to the following image is displayed on the user interface when an administrator tries to create or update a log source that uses JDBC protocol:
sql-error
Figure 1: MySQL error on log source that uses the JDBC protocol.

Cause

When a log source that uses JDBC protocol is created, QRadar checks the ingress path (/opt/ibm/si/services/ecs-ec-ingress/eventgnosis/lib/q1labs/) to confirm whether the JAR file for that JDBC is present. If this file is missing, then QRadar displays the "driver not found" error on the managed host that attempts to connect to the MySQL database.

Diagnosing The Problem

When an administrator attempts to create, then test a JDBC log source configuration, the following procedure can generate a 'No MySQL JDBC Driver present' error.

Procedure
  1. Log in to the QRadar console as administrator.
  2. Click the Admin tab.
  3. Open the Log Source Management app.
  4. Click the New Log Source icon.
  5. Select the Single Log Source option.
  6. Select the log source type that you need.
  7. Select JDBC as the protocol type.
  8. Configure the Log Source parameters.
  9. Click Test Protocol Parameters.

    Result
    The error message "No MySQL JDBC Driver present" is displayed. If you experience this issue, you can you update the mysql-connector-java JAR files to the latest version.

Resolving The Problem

Important: The following steps are considered advanced for users. If you are uncomfortable installing the required files to resolve this issue or are unsure of any steps in the procedure, contact QRadar Support for assistance.

Procedure
  1. Download the driver by going to MySQL Downloads.
  2. From the download options, select:
    • Product Version: 5.1.48
    • Operating System: Platform independent
  3. Click Download for Platform Independent (Architecture Independent), ZIP Archive (mysql-connector-java-5.1.48.zip).
  4. Extract the compressed ZIP file. 
    Important: The contents of the extract file contains two JAR files. Do not copy the -bin file to QRadar.
  5. Copy the mysql-connector-java-5.1.48.jar file to the following paths on the collector that is used to connect to the DB server.
     This collector is the Target Event Collector in the log source configuration: 
    /opt/qradar/jars/
/opt/ibm/si/services/ecs-ec-ingress/eventgnosis/lib/q1labs/
  6. Remove any older versions present in the directory. For example, remove mysql-connector-java-5.1.30.jar, and any files with -bin in the name.
    For example, remove mysql-connector-java-5.1.30-bin.jar as the old files are not required.
  7. Restart ecs-ec-ingress on each event collector where you put the JAR file. For more information about restarting ecs-ec-ingress, see Core services and the impact of restarting services. 
    systemctl restart ecs-ec-ingress
  8. Confirm that the JAR file has the correct permissions and ownership: 
    ll /opt/qradar/jars/mysql-connector-java-*.jar
    For example, the correct permission must display with the following permissions and nobody:nobody as the file owner: 
    ​​​​​​​rw-r--r– nobody:nobody
  9. Optional. If the permissions are not set correctly, type the following commands: 
    chmod 644 /opt/qradar/jars/mysql-connector-java-*.jar
chown nobody:nobody /opt/qradar/jars/mysql-connector-java-*.jar
  10. Log in to the QRadar user interface.
  11. Click the Admin tab.
  12. Click the Log Source icon.
  13. Create a JDBC log source.

    Result
    The administrator is able to create a new log source by using the JDBC protocol without receiving the driver not found error. If the problem persists, contact QRadar Support for assistance.

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwt0AAA","label":"Log Source"}],"ARM Case Number":"TS013049938","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Versions"}]

Document Information

Modified date:
31 May 2023

UID

ibm16995261

Page Feedback