I'm unable to get Splunk DB Connect 1.2.2 (Yes, I know its old) to connect to an instance of MS SQL server where TLS 1.0 has been disabled. When the connection attempt is made I get the error below. When I enable -Djavax.net.debug=all I can clearly see Splunk trying to pass a TLS1.0 handshake over to the database. In fact, I have two database connections configured in the Splunk DB Connect app. One has a database where TLS1.0 is not disabled and the other is a database where we've disabled TLS1.0. As you can imagine the database where we haven't disabled TLS1.0 is working just fine, but the other connection is not. We are running Java 1.7.60. I've tried switching over to Java 1.8.74
2018-02-27 13:27:41.556 dbx9703:ERROR:DatabaseList - Error fetching database catalogs: java.sql.SQLException: Network error IOException: null
java.sql.SQLException: Network error IOException: null
at net.sourceforge.jtds.jdbc.ConnectionJDBC2.<init>(ConnectionJDBC2.java:417)
at net.sourceforge.jtds.jdbc.ConnectionJDBC3.<init>(ConnectionJDBC3.java:50)
at net.sourceforge.jtds.jdbc.Driver.connect(Driver.java:185)
at java.sql.DriverManager.getConnection(Unknown Source)
at java.sql.DriverManager.getConnection(Unknown Source)
at com.splunk.dbx.sql.type.impl.AbstractDatabaseType.connect(AbstractDatabaseType.java:139)
at com.splunk.dbx.sql.type.impl.MicrosoftSqlServer.connect(MicrosoftSqlServer.java:85)
at com.splunk.dbx.sql.type.impl.AbstractJtdsDatabaseType.listCatalogs(AbstractJtdsDatabaseType.java:48)
at com.splunk.dbx.info.DatabaseList.invoke(DatabaseList.java:34)
at com.splunk.bridge.session.BridgeSession.call(BridgeSession.java:92)
at com.splunk.bridge.session.BridgeSession.call(BridgeSession.java:30)
at java.util.concurrent.FutureTask.run(Unknown Source)
at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
at java.lang.Thread.run(Unknown Source)
Caused by: java.io.IOException
at net.sourceforge.jtds.ssl.TdsTlsInputStream.readFully(TdsTlsInputStream.java:137)
at net.sourceforge.jtds.ssl.TdsTlsInputStream.primeBuffer(TdsTlsInputStream.java:100)
at net.sourceforge.jtds.ssl.TdsTlsInputStream.read(TdsTlsInputStream.java:78)
at sun.security.ssl.InputRecord.readFully(Unknown Source)
at sun.security.ssl.InputRecord.read(Unknown Source)
at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source)
at
Have you tried to upgrade to java 7.95 and use the magic ‑Djdk.tls.client.protocols="TLSv1.1,TLSv1.2" system property?
Have you tried to upgrade to java 7.95 and use the magic ‑Djdk.tls.client.protocols="TLSv1.1,TLSv1.2" system property?
Right, so I upgraded to Java 1.7.95 and specified ‑Djdk.tls.client.protocols="TLSv1.1,TLSv1.2" located in the SPLUNK_HOME/apps/dbx/local/java.conf.
My full java.conf is below.
[java]
home = /usr/java/latest/
options = -Xmx1G -Dfile.encoding=UTF-8 -server -Duser.language=en -Duser.region= -Dhttps.protocols=TLSv1.2 -Djdk.tls.client.protocols="TLSv1.1,TLSv1.2"
[logging]
level = DEBUG
file = dbx.log
console = false
logger.com.splunk.dbx = DEBUG