3
responses

Hi ,

Trying to create an ODBC connect for NXLog to connect to.   NXLog is installed on the same Windows 2012 server as the SQL Server 2008R2 instance.

 

Scenario 1:

32-bit ODBC is setup as a System DSN with a SQL Server account that has DBO access to the desired database

NXLog service is setup to run under the System account.   

 

- I've tried both drivers available on the system ("SQL Server Native Client 10.0"  and "SQL Server")

- get the same result in the error log for each:

  • ERROR im_odbc couldn't connect to the database, 28000:2:18456:[Microsoft][SQL Server Native Client 10.0][SQL Server]Login failed for user ''. (odbc error code: -1)and
  • ERROR im_odbc couldn't connect to the database, 28000:2:18456:[Microsoft][ODBC SQL Server Driver][SQL Server]Login failed for user ''. (odbc error code: -1)

 

Scenario 2:

Same ODBC, but with a Windows account that has full Admin access to the desired databases, and is the same account logged into Windows

NXLog service is setup to run under this same account.

Goal is to have the same user account accessing everything, in the hope of getting it to connect.

 

Same error messages as above.   Login failed for user ' '.

 

 

Since the error messages don't show the user that is failing to login, I'm having trouble narrowing down where the failure is at.

 

NXLOG.conf file:

<Input call_logs>
Module im_odbc
ConnectionString DSN=SIEM_NXLog;database=recorder;

SQL SELECT ident as id ,at.audit_time as EventTime ,am.audit_module_name as Message FROM mytables...  WHERE at.ident>?

SavePos TRUE

</Input>

 

There's one line in the documentation that has me scratching my head:

SECTION 6.2.18 (ODBC)

The data source must be accessible by the user which nxlog is running under.

 

I'm not sure if this means that the NTService account needs database access?

Or, if the service must be under a Windows account user that has database access?

Or, by using a ODBC->System DSN , shouldn't the ODBC already be accessible to all users on the system?

 

Any thoughts or insight would be helpful. Thanks in advance.

 

Cheers, 
Peter

 

 

 

 

 

AskedOctober 11, 2017 - 9:54pm

Answers (2)

The error message comes from the odbc driver, can't help you there. Otherwise I don't see anything wrong with the setup. Using a system DSN should work with the system account.

The source of this problem is usually the 32 bit vs 64 bit data source setup. Please make sure you are configuring this correctly for the 32 bit DSN since nxlog.exe is a 32 bit executable. This may help: https://support.microsoft.com/en-us/help/942976/odbc-administrator-tool-...

Comments (1)

  • pbechard's picture

    Thanks for the quick reply.

    I initially tried 64-bit, but the log errors indicated I was probably on the wrong path:

    • ERROR im_odbc couldn't connect to the database, IM014:2:0:[Microsoft][ODBC Driver Manager] The specified DSN contains an architecture mismatch between the Driver and Application (odbc error code: -1)

     

    All of my info in the original post is based on the 32-bit ODBC driver.

     

The system DSN does not store the user and password for the connection. You can see the stored DSN details by looking in the registry at HKEY_LOCAL_MACHINE\SOFTWARE\ODBC\ODBC.INI\<name> (or under HKEY_CURRENT_USER for user DSNs). Try adding UID=myuser;PWD=mypassword to the connection string.

Also, it may be better to use one of the currently supported ODBC drivers instead ("ODBC Driver for SQL Server"); see Download ODBC Driver for SQL Server on Microsoft Docs.