Hello,

We integrated 10 tables of 1 DB (total 10 log source) with Oracle RDBMS Audit Record log source type (Oracle) with QRadar and often get "ORA-02391: exceeded simultaneous SESSIONS_PER_USER limit" error. As we know already, session limit defined by DBA and QRadar exceeded this limit.

We discussed this issue with DBA and they said that in the past QRadar simultaneously connected to DB and run queries on it and this resulted in problem in critical DB, that is why they had to set limit for user session.

They asked how Qradar connects to DB, which query it runs, does qradar close session after connection or create a session for each connection?

We ask these questions because we don't want any problem occur in our critical DBs. How many sessions for user are enough in DB side if we added 10 tables of 1 DB to QRadar?

Can you clarify the connection process of QRadar to Oracle RDBMS Audit Record?

@Tahir Yagubov I'm not aware of any documents on this issue. What you'll likely need to do is get your DBA to confirm the sessions created, then see how many sessions are allowed.

https://dbaclass.com/article/ora-02391-exceeded-simultaneous-sessions_per_user-limit/ 

As this is more of a tuning question, the support reps likely sent you here for advice from the Community. I think there are two things that could happen:

1. Ask your DBA to see how many sessions are being used. I think if you can show that over a connection, that X sessions are used and it is excessive, then we have something we can try and replicate. However, not knowing your threshold for performance makes this hard to troubleshoot. As technically, the session limit could be set as UNLIMITED, but this is not typically recommended
2. You might try to wireshark the connection to ensure that sessions are being closed and not left open and that events are retrieved when the session is opened. If a session is open and no data is retrieved, does it need to time out and does that timeout last longer than the next polling interval in the log source configuration. 

I'm not aware of any documentation that defines how the JDBC protocol closes connections, but start with checking how many sessions are created for the user in the log source and ask your DBA team what they consider excessive. I'll see if I can find any more information on this issue, but I'll likely need to talk with dev to get context around how the JDBC prot works. 

You might also see about extending the polling interval in 5 of the 10 log sources to reduce the chance that they are all polling at the same time. As the same user (qradar) could be opening 10 connections, with each having two sessions running, they might stack up. So, you also might consider adjusting the polling intervals too and lengthen the time between polls and it might help.

------------------------------
Jonathan Pechta
QRadar Support Content Lead
Support forums: ibm.biz/qradarforums
jonathan.pechta1@ibm.com
------------------------------