The Oracle DB Event Collector logs "OAUTH marshaling failure" and does not collect events

book

Article ID: 156521

calendar_today

Updated On:

Products

Security Information Manager

Issue/Introduction

You have installed and configured the Oracle DB event collector but no events are collected.  When you view the collector logs it shows an Oracle error for OAUTH marshaling failure.

Cause

The JDBC drivers used with the Oracle DB Event Collector is a higher version than the Oracle Database you are attempting to collect from.

Resolution

Add -Doracle.jdbc.thinLogonCapability\=o3 to the System.AgentParams in the ses_work.properties file to prevent this error.

In Windows

  1. Navigate to the C:\Program Files (x86)\Common Files\Symantec Shared\SES directory.
    For 32bit systems it is C:\Program Files\Common Files\Symantec Shared\SES
  2. Open ses_work.properties with Notepad.
  3. Find the line System.AgentParams
  4. Add -Doracle.jdbc.thinLogonCapability\=o3 to the end of that line.
  5. Restart the Symantec Event Agent.

In Linux

  1. Navigate to the /etc/symantec/ses directory.
  2. Open ses_work.properties with vi.
  3. Find the line System.AgentParams
  4. Press i to enter Insert mode.
  5. Add -Doracle.jdbc.thinLogonCapability\=o3 to the end of that line.
  6. Press Esc to exit Insert mode.
  7. Type :wq to save and quite.
  8. Restart the Symantec Event Agent.

Example of line after modification:

System.AgentParams=-server -XX\:NewRatio\=3 -Xmx512m -Dnetworkaddress.cache.ttl\=300 -Doracle.jdbc.thinLogonCapability\=o3