ArcSight & Pervasive PSQL v11 How to install and configure an ArcSight FlexConnector for Pervasive’s PSQL v11

Install the Appropriate Client

Add New ODBC System DSN First choose the System DSN Tab (leftmost arrow) Next click on the Add button

Fill in the System DSN Fields Enter Pervasive Server IP for Server Name/IP Transport Hint is Try TCPIP only Select Get List for Data Options Use Dropdown to select Audit DB Click Test to verify connectivity Click OK to save

Testing ODBC Configuration Click the Test Button It appears that the Master User Name must be used for auditing Enter the password for the Master User Name Click OK

ODBC/Pervasive Test Results Results should be a successful connection

FlexConnector Setup Select Install Destination Folder Click Next

Select Installation Type Select Typical Install Set Click Next

Select Desired Shortcut Option

Verify Summary and Install Click Install Button

Select Add a Connector Select Add a Connector Click Next

Select Connector Type Select ArcSight FlexConnector ID-Based DB connector type Click Next

Configure Connector Details Enter Connector Details

Configure Connector Details Database Version is taken care of in properties file

Configure Destination Details Select appropriate destination

Configure Destination Details Enter appropriate information

Configure Destination Details Enter appropriate information

Sample properties file # Custom FlexConnector Developed by Jonathan Naugle and Josh Nacol 12/27/2012 # Pervasive FLEXConnector Configuration # Developed Jan 2013 by Jonathan Naugle and Josh Nacol # For Pervasive SQL version 11.20 # Version Information version.order=1 version.id=11.2 # version.query=select top 1 11.20 from <view_or_table> # Query query=SELECT * \ FROM <view_or_table>\ WHERE rec_id > ? # MaxID maxid.query=select max(rec_id) from <view_or_table> #ID Field id.field=rec_id #timestamp.field=optime timestamp.field=__createTimeStamp(opdate,optime) #Uniqiue ID uniqueid.field=rec_id #Query Limit #query.limit=10 #Token Mapping event.name=optext event.deviceProcessName=process_name event.deviceVendor=__stringConstant("Pervasive Software") event.deviceVersion=dbmsverkey event.message=opcode event.deviceProduct=__stringConstant("Pervasive") event.deviceCustomString1=__stringConstant(“APPNAME") Version info hardcoded. This query retrieves the next set of auditmaster rows. This query retrieves next rec_id to get the next set of auditmaster rows. Query Limit can cause problems When accessing Pervasive Audit Master, so don’t use it. Assigning fields from Pervasive view_or_table to ArcSight Fields.