How to configure multiple drivers for database in Splunk DB Connect?

[christal1989]

Hi,

I'm using splunk DB connect v3 for capturing data from various applications. Our applications have Oracle database from Oracle 8i to 12c (yeah, thats a wide range). At present I have ojdbc7.jar driver configured and its only letting me pull data from databases with version 10 or above. As part of testing I noticed ojdbc6.jar is having no compatibility problem with lower version databased

Is there a way to configure both ojdbc6.jar and ojdbc7.jar in splunk db connect, so that we can cover all the versions of databases safely.

Regards, Chris.

[arun_kant_sharm]

Hi @christal1989 and @jplumsdaine22 ,

I also get same problem I need to monitor many Oracle DB instances, that have different version of Oracle.
My Splunk db connect app only connect to Oracle 12c instances.
I am facing same problem for lower version of oracle such as 11g it require ojdbc6 drivers.

Please suggest how we get rid of such problem.

[jplumsdaine22]

While I haven't done this myself, the solution is most likely to create a new db connection type. Try copying the [oracle] stanza from $SPLUNK_HOME/etc/apps/splunk_app_db_connect/default/db_connection_types.conf into $SPLUNK_HOME/etc/apps/splunk_app_db_connect/local/db_connection_types.conf. Then change the stanza name and modify the supportedVersions key

 [oracle_ojdbc6]
supportedVersions = 11.2
displayName = Oracle
serviceClass = com.splunk.dbx2.OracleJDBC
jdbcUrlFormat = jdbc:oracle:thin:@<host>:<port>:<database>jdbcUrlSSLFormat = jdbc:oracle:thin:@(DESCRIPTION=(ADDRESS(PROTOCOL=tcps)(HOST=<host>)(PORT=<port>))(    CONNECT_DATA=(SERVICE_NAME=<database>)))
jdbcDriverClass = oracle.jdbc.OracleDriver
database = XE
port = 1521
connection_properties = {"oracle.net.authentication_services":"(TCPS)","oracle.net.ssl_cipher_suites":"(    SSL_DH_anon_WITH_3DES_EDE_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA)"}

Then create another stanza in /local/db_connection_types.conf for [oracle] and to stop the original connection type using the older driver like so:

[oracle]
supportedVersions = 12.0

See https://docs.splunk.com/Documentation/DBX/3.1.3/DeployDBX/databasespec for more details, and check out #dbconnect on the slack for more help

Another alternative would be to have a separate heavy forwarder instance running dbconnect.

[christal1989]

Hi,

Thanks for the suggestion. I tried this, but it is not working unfortunately. Also deploying dbconnect in another heavy forwarder, we had thought of it and was ruled out as an option. Since we have lots of databases to connect, we want to distribute load evenly across all heavy forwarders with identical configuration across all servers. So thats why, this option was ruled out from the scope. Any other possible methods?

Regards,
Chris.

[christal1989]

Hi All,

I managed to make create one more additional oracle driver which is visible in splunk db connect settings.
1. oracle
2. oracle service
3. oracle ojdbc6 version

I did so by creating 3 subfolders inside drivers directory and restarting splunk instance and added a stanza in db_connections_type.conf file inside local directory. But the problem I'm facing now is, if i place ojdbc7.jar in any one of these subfolders under drivers directory, supported versions of remaining 2 drivers which are still pointing to ojdbc6.jar are getting updated. Is there a way to prevent it?

Ideally with ojdc7.jar, im expecting to see 12.1 as supported and ojdbc6.jar im expecting 11.1. Is there a way to ensure drivers are looking only into the jar files present in the subfolder associated to it rather than highest version across any of oracle related.?

Below is the chunk of of db_connections_types.conf file.

[oracle_ojdbc6]
displayName = Oracle OJDBC 6
serviceClass = com.splunk.dbx2.OracleJDBC
jdbcUrlFormat = jdbc:oracle:thin:@::
jdbcUrlSSLFormat = jdbc:oracle:thin:@(DESCRIPTION=(ADDRESS=(PROTOCOL=tcps)(HOST=)(PORT=))(CONNECT_DATA=(SERVICE_NAME=)))
jdbcDriverClass = oracle.jdbc.OracleDriver
supportedVersions = 11.2
database = XE
port = 1521
connection_properties = {"oracle.net.authentication_services":"(TCPS)","oracle.net.ssl_cipher_suites":"(SSL_DH_anon_WITH_3DES_EDE_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA)"}

[oracle]
displayName = Oracle
serviceClass = com.splunk.dbx2.OracleJDBC
jdbcUrlFormat = jdbc:oracle:thin:@::
jdbcUrlSSLFormat = jdbc:oracle:thin:@(DESCRIPTION=(ADDRESS=(PROTOCOL=tcps)(HOST=)(PORT=))(CONNECT_DATA=(SERVICE_NAME=)))
jdbcDriverClass = oracle.jdbc.OracleDriver
supportedVersions = 12.0
database = XE
port = 1521
connection_properties = {"oracle.net.authentication_services":"(TCPS)","oracle.net.ssl_cipher_suites":"(SSL_DH_anon_WITH_3DES_EDE_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA)"}

[oracle_service]
displayName = Oracle Service
serviceClass = com.splunk.dbx2.OracleJDBC
jdbcUrlFormat = jdbc:oracle:thin:@//:/
jdbcUrlSSLFormat = jdbc:oracle:thin:@(DESCRIPTION=(ADDRESS=(PROTOCOL=tcps)(HOST=)(PORT=))(CONNECT_DATA=(SERVICE_NAME=)))
jdbcDriverClass = oracle.jdbc.OracleDriver
supportedVersions = 12.0
database = XE
port = 1521
connection_properties = {"oracle.net.authentication_services":"(TCPS)","oracle.net.ssl_cipher_suites":"(SSL_DH_anon_WITH_3DES_EDE_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA)"}

Below is how I have placed jar files
C:\Program Files\Splunk\etc\apps\splunk_app_db_connect\drivers\oracle\ojdbc7.jar
C:\Program Files\Splunk\etc\apps\splunk_app_db_connect\drivers\oracle_ojdbc6\ojdbc6.jar
C:\Program Files\Splunk\etc\apps\splunk_app_db_connect\drivers\oracle_service\ojdbc6.jar

No other jar files under C:\Program Files\Splunk\etc\apps\splunk_app_db_connect\drivers.

Regards,
Chris.

[jplumsdaine22]

I was hoping that was going to work. I suppose what is happening is that because ojdbc7 is 12.2, and ojdbc6 is 11.2, that because you can specify a max version ojdbc7 is getting used for both connections.

I suppose the only way this is going to work is if you could hack the serviceclass name in the driver. I'm not sure if you can open up the jar file to do so - if you know a friendly java dev they might be able to help you?

[christal1989]

Even I had the feeling that, due to the same Driver class in both jar files, max version was taking effect. The whole thing with different ojdbc jar files started because we are unable to retrieve data from our databases with versions oracle 9i and lower when we use ojdbc7 and works properly if we use ojdbc6. If there is any method to retrieve data without the need of multiple jar fils, that would also help.

[jplumsdaine22]

How many databases are you talking about? Running a separate HF should be a feasible workaround, even as a separate splunk instance on the same host. EG, a virtualised HF with 4GB of ram and 2 cpus can pull from a 1000 db inputs with no trouble.