IBM Support

QRadar: How to replace missing JAR files for JDBC Protocol

Troubleshooting


Problem

Missing jar files related to JDBC protocols can lead to issue while pulling events from JDBC logsources.

Symptom

When multiple or all JDBC log sources are not able to send event to QRadar and notice similar error with jdbc.SharedSocket, then the issue could likely be due to missing jar files.
Below error can be shown on QRadar SSH session:
Jul  1 13:46:10 ::ffff:127.0.0.1 [ecs-ec-ingress.ecs-ec-ingress] [MSDE//master@xx.xx.x.xx Protocol Provider Thread: class com.q1labs.semsources.sources.jdbc.JdbcEventConnector81577] com.q1labs.semsources.sources.jdbc.JdbcEventConnector: [INFO] [NOT:0000006000][xx.xx.x.xx/- -] [-/- -]disconnected
Jul  1 13:46:10 ::ffff:127.0.0.1 [ecs-ec-ingress.ecs-ec-ingress] [MSDE//master@xx.xx.x.xx Protocol Provider Thread: class com.q1labs.semsources.sources.jdbc.JdbcEventConnector81577] com.q1labs.semsources.sources.jdbc.JdbcEventConnector: [INFO] [NOT:0000006000][xx.xx.x.xx/- -] [-/- -]Following message suppressed 2 times in 300000 milliseconds
Jul  1 13:46:10 ::ffff:127.0.0.1 [ecs-ec-ingress.ecs-ec-ingress] [MSDE//master@xx.xx.x.xx Protocol Provider Thread: class com.q1labs.semsources.sources.jdbc.JdbcEventConnector81577] com.q1labs.semsources.sources.jdbc.JdbcEventConnector: [ERROR] Chained SQL Exception [1/1]: Network error IOException: Connection refused (Connection refused)
Jul  1 13:46:10 ::ffff:127.0.0.1 [ecs-ec-ingress.ecs-ec-ingress] [MSDE//master@xx.xx.x.xx Protocol Provider Thread: class com.q1labs.semsources.sources.jdbc.JdbcEventConnector81577] com.q1labs.semsources.sources.jdbc.JdbcEventConnector: [WARN] [NOT:0000004000][xx.xx.x.xx/- -] [-/- -]Network error IOException: Connection refused (Connection refused) on MSDE//master@192.168.1.73
Jul  1 13:46:10 ::ffff:127.0.0.1 [ecs-ec-ingress.ecs-ec-ingress] [MSDE//master@xx.xx.x.xx Protocol Provider Thread: class com.q1labs.semsources.sources.jdbc.JdbcEventConnector81577] java.sql.SQLException: Network error IOException: Connection refused (Connection refused)
Jul  1 13:46:10 ::ffff:127.0.0.1 [ecs-ec-ingress.ecs-ec-ingress] [MSDE//master@xx.xx.x.xx Protocol Provider Thread: class com.q1labs.semsources.sources.jdbc.JdbcEventConnector81577]    at net.sourceforge.jtds.jdbc.JtdsConnection.<init>(JtdsConnection.java:437)
Jul  1 13:46:10 ::ffff:127.0.0.1 [ecs-ec-ingress.ecs-ec-ingress] [MSDE//master@xx.xx.x.xx Protocol Provider Thread: class com.q1labs.semsources.sources.jdbc.JdbcEventConnector81577]    at net.sourceforge.jtds.jdbc.Driver.connect(Driver.java:184)
Jul  1 13:46:10 ::ffff:127.0.0.1 [ecs-ec-ingress.ecs-ec-ingress] [MSDE//master@xx.xx.x.xx Protocol Provider Thread: class com.q1labs.semsources.sources.jdbc.JdbcEventConnector81577]    at java.sql.DriverManager.getConnection(DriverManager.java:675)
Jul  1 13:46:10 ::ffff:127.0.0.1 [ecs-ec-ingress.ecs-ec-ingress] [MSDE//master@xx.xx.x.xx Protocol Provider Thread: class com.q1labs.semsources.sources.jdbc.JdbcEventConnector81577]    at java.sql.DriverManager.getConnection(DriverManager.java:258)
Jul  1 13:46:10 ::ffff:127.0.0.1 [ecs-ec-ingress.ecs-ec-ingress] [MSDE//master@xx.xx.x.xx Protocol Provider Thread: class com.q1labs.semsources.sources.jdbc.JdbcEventConnector81577]    at com.q1labs.semsources.sources.jdbc.JdbcEventConnector.connect(JdbcEventConnector.java:536)
Jul  1 13:46:10 ::ffff:127.0.0.1 [ecs-ec-ingress.ecs-ec-ingress] [MSDE//master@xx.xx.x.xx Protocol Provider Thread: class com.q1labs.semsources.sources.jdbc.JdbcEventConnector81577]    at com.q1labs.semsources.sources.jdbc.JdbcEventConnector.execute(JdbcEventConnector.java:947)
Jul  1 13:46:10 ::ffff:127.0.0.1 [ecs-ec-ingress.ecs-ec-ingress] [MSDE//master@xx.xx.x.xx Protocol Provider Thread: class com.q1labs.semsources.sources.jdbc.JdbcEventConnector81577]    at com.q1labs.semsources.sources.base.SourceProvider.run(SourceProvider.java:195)
Jul  1 13:46:10 ::ffff:127.0.0.1 [ecs-ec-ingress.ecs-ec-ingress] [MSDE//master@xx.xx.x.xx Protocol Provider Thread: class com.q1labs.semsources.sources.jdbc.JdbcEventConnector81577] Caused by:
Jul  1 13:46:10 ::ffff:127.0.0.1 [ecs-ec-ingress.ecs-ec-ingress] [MSDE//master@xx.xx.x.xx Protocol Provider Thread: class com.q1labs.semsources.sources.jdbc.JdbcEventConnector81577]    java.net.ConnectException: Connection refused (Connection refused)
Jul  1 13:46:10 ::ffff:127.0.0.1 [ecs-ec-ingress.ecs-ec-ingress] [MSDE//master@xx.xx.x.xx Protocol Provider Thread: class com.q1labs.semsources.sources.jdbc.JdbcEventConnector81577]    at java.net.Socket.connect(Socket.java:682)
Jul  1 13:46:10 ::ffff:127.0.0.1 [ecs-ec-ingress.ecs-ec-ingress] [MSDE//master@xx.xx.x.xx Protocol Provider Thread: class com.q1labs.semsources.sources.jdbc.JdbcEventConnector81577]    at net.sourceforge.jtds.jdbc.SharedSocket.createSocketForJDBC3(SharedSocket.java:288)
Jul  1 13:46:10 ::ffff:127.0.0.1 [ecs-ec-ingress.ecs-ec-ingress] [MSDE//master@xx.xx.x.xx Protocol Provider Thread: class com.q1labs.semsources.sources.jdbc.JdbcEventConnector81577]    at net.sourceforge.jtds.jdbc.SharedSocket.<init>(SharedSocket.java:251)
Jul  1 13:46:10 ::ffff:127.0.0.1 [ecs-ec-ingress.ecs-ec-ingress] [MSDE//master@xx.xx.x.xx Protocol Provider Thread: class com.q1labs.semsources.sources.jdbc.JdbcEventConnector81577]    at net.sourceforge.jtds.jdbc.JtdsConnection.<init>(JtdsConnection.java:331)
Jul  1 13:46:10 ::ffff:127.0.0.1 [ecs-ec-ingress.ecs-ec-ingress] [MSDE//master@xx.xx.x.xx Protocol Provider Thread: class com.q1labs.semsources.sources.jdbc.JdbcEventConnector81577]    ... 6 more

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB77","label":"Automation Platform"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwt0AAA","label":"Log Source"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Versions"}]

Log InLog in to view more of this document

This document has the abstract of a technical article that is available to authorized users once you have logged on. Please use Log in button above to access the full document. After log in, if you do not have the right authorization for this document, there will be instructions on what to do next.

Document Information

Modified date:
05 December 2024

UID

ibm17124770

Page Feedback