Environment
Novell Sentinel 6.0 Support Pack 2
Novell Sentinel 6.1
Situation
In the das_binary or das_query logs various Oracle or mssql error
messages may be returned. Typically these must be handled by
the database administrator working with the Sentinel
administrator. In this case ORA-01841 means that a date is
attempting to be written to a column defined for dates and the date
being written is not being written in a valid format or within a
valid time range.
Resolution
The key to resolution of this issue lays in finding what is
attempting to write the invalid date to the column in the
database. Enabling verbose logging for the process attempting
to write this value is a good first step. For example in
$ESEC_HOME/config are various properties (.prop) files that control
logging, including:
das_binary_log.prop
das_query_log.prop
In these files are default logging levels set to INFO:
.level=INFO
Changing this line to 'ALL' will usually show the actual database insertions taking place from the process. Keep in mind that at this level of verbosity it is likely the available log files will fill up quickly and could rotate the needed data out to allow for new data. The changes to these files is applied within ten seconds without a restart of any service or process so be sure that once the error is identified the log files are quickly copied or the properties file is quickly modified back to the lower logging level to prevent data loss in the rotating logs. The log files can also be configured to have more rotating files or larger rotating files as disk space permits.
In some cases this error has resulted when a collector has tried to write an invalid data format to a particular field. In other cases this results because Sentinel was not properly shutdown completely after flushing out all previous data before a patch that modified Sentinel application components or the Sentinel database. Be sure to follow instructions included for patches very carefully to prevent these types of situations.
Once a query is identified as one that fails with the error above have the Database Administrator (DBA) check the values with the columns being written to identify why the failure takes place. If changes to the database were recently made verify that they all completed properly. Check the ESEC_DB_VERSION and ESEC_DB_PATCHES tables in the Sentinel database to ensure that the latest patches that were attempted actually completed properly.
das_binary_log.prop
das_query_log.prop
In these files are default logging levels set to INFO:
.level=INFO
Changing this line to 'ALL' will usually show the actual database insertions taking place from the process. Keep in mind that at this level of verbosity it is likely the available log files will fill up quickly and could rotate the needed data out to allow for new data. The changes to these files is applied within ten seconds without a restart of any service or process so be sure that once the error is identified the log files are quickly copied or the properties file is quickly modified back to the lower logging level to prevent data loss in the rotating logs. The log files can also be configured to have more rotating files or larger rotating files as disk space permits.
In some cases this error has resulted when a collector has tried to write an invalid data format to a particular field. In other cases this results because Sentinel was not properly shutdown completely after flushing out all previous data before a patch that modified Sentinel application components or the Sentinel database. Be sure to follow instructions included for patches very carefully to prevent these types of situations.
Once a query is identified as one that fails with the error above have the Database Administrator (DBA) check the values with the columns being written to identify why the failure takes place. If changes to the database were recently made verify that they all completed properly. Check the ESEC_DB_VERSION and ESEC_DB_PATCHES tables in the Sentinel database to ensure that the latest patches that were attempted actually completed properly.