1. ArcSight & Pervasive PSQL v11
How to install and configure an ArcSight FlexConnector for Pervasive’s PSQL v11

2. Install the Appropriate Client

3. Add New ODBC System DSN
First choose the System DSN Tab (leftmost arrow)
Next click on the Add button

4. Fill in the System DSN Fields
Enter Pervasive Server IP for Server Name/IP
Transport Hint is Try TCPIP only
Select Get List for Data Options
Use Dropdown to select Audit DB
Click Test to verify connectivity
Click OK to save

5. Testing ODBC Configuration
Click the Test Button
It appears that the Master User Name must be used for auditing
Enter the password for the Master User Name
Click OK

6. ODBC/Pervasive Test Results
Results should be a successful connection

7. FlexConnector Setup
Select Install Destination Folder
Click Next

8. Select Installation Type
Select Typical Install Set
Click Next

9. Select Desired Shortcut Option

10. Verify Summary and Install
Click Install Button

11. Select Add a Connector
Select Add a Connector
Click Next

12. Select Connector Type
Select ArcSight FlexConnector ID-Based DB connector type
Click Next

13. Configure Connector Details
Enter Connector Details

14. Configure Connector Details
Database Version is taken care of in properties file

15. Configure Destination Details
Select appropriate destination

16. Configure Destination Details
Enter appropriate information

17. Configure Destination Details
Enter appropriate information

18. Sample properties file
# Custom FlexConnector Developed by Jonathan Naugle and Josh Nacol 12/27/2012
# Pervasive FLEXConnector Configuration
# Developed Jan 2013 by Jonathan Naugle and Josh Nacol
# For Pervasive SQL version 11.20
# Version Information
version.order=1
version.id=11.2
# version.query=select top from <view_or_table>
# Query
query=SELECT * \
FROM <view_or_table>\
WHERE rec_id > ?
# MaxID
maxid.query=select max(rec_id) from <view_or_table>
#ID Field
id.field=rec_id
#timestamp.field=optime
timestamp.field=__createTimeStamp(opdate,optime)
#Uniqiue ID
uniqueid.field=rec_id
#Query Limit
#query.limit=10
#Token Mapping
event.name=optext
event.deviceProcessName=process_name
event.deviceVendor=__stringConstant("Pervasive Software")
event.deviceVersion=dbmsverkey
event.message=opcode
event.deviceProduct=__stringConstant("Pervasive")
event.deviceCustomString1=__stringConstant(“APPNAME")
Version info hardcoded.
This query retrieves the next set of auditmaster rows.
This query retrieves next rec_id to get the next set of auditmaster rows.
Query Limit can cause problems When accessing Pervasive Audit Master, so don’t use it.
Assigning fields from Pervasive view_or_table to ArcSight Fields.