Sentinel logs include error ORA-01841, "year must be between -4713 and +9999"

In the das_binary or das_query logs various Oracle or mssql error messages may be returned.  Typically these must be handled by the database administrator working with the Sentinel administrator.  In this case ORA-01841 means that a date is attempting to be written to a column defined for dates and the date being written is not being written in a valid format or within a valid time range.

The key to resolution of this issue lays in finding what is attempting to write the invalid date to the column in the database.  Enabling verbose logging for the process attempting to write this value is a good first step.  For example in $ESEC_HOME/config are various properties (.prop) files that control logging, including:

das_binary_log.prop
das_query_log.prop

In these files are default logging levels set to INFO:

.level=INFO

Changing this line to 'ALL' will usually show the actual database insertions taking place from the process.  Keep in mind that at this level of verbosity it is likely the available log files will fill up quickly and could rotate the needed data out to allow for new data.  The changes to these files is applied within ten seconds without a restart of any service or process so be sure that once the error is identified the log files are quickly copied or the properties file is quickly modified back to the lower logging level to prevent data loss in the rotating logs.  The log files can also be configured to have more rotating files or larger rotating files as disk space permits.

In some cases this error has resulted when a collector has tried to write an invalid data format to a particular field.  In other cases this results because Sentinel was not properly shutdown completely after flushing out all previous data before a patch that modified Sentinel application components or the Sentinel database.  Be sure to follow instructions included for patches very carefully to prevent these types of situations.

Once a query is identified as one that fails with the error above have the Database Administrator (DBA) check the values with the columns being written to identify why the failure takes place.  If changes to the database were recently made verify that they all completed properly.  Check the ESEC_DB_VERSION and ESEC_DB_PATCHES tables in the Sentinel database to ensure that the latest patches that were attempted actually completed properly.