LogLogic 5.3 Release Notes

Transcription

1 LogLogic 5.3 Release Notes LogLogic Appliance Release 5.3 is a feature update to previous releases. You can upgrade to Release 5.3 directly from Release 5.1.x and 5.2 using instructions in the LogLogic Installation and Upgrade Guide, which is included with the Supplemental CD, or available for download from the LogLogic Customer Support website. If you are running a prior release, the upgrade path is > 5.1.x > 5.3. Log Source Package 23 is bundled and installed with new Appliances, and downloadable from the LogLogic Customer Support website. Table 1 LMI Upgrade Matrix LMI 5.1.x x 5.2 Table 2 LMI LSP Compatibility Matrix LSP 5.1.x Before updating your Appliance software, please read these Release Notes to learn: What s New in Release 5.3 Supported Platforms, Browsers, and Settings LogLogic Documentation Fixed Issues Known Issues LogLogic Support PART NUMBER LL E March

2 What s New in Release 5.3 What s New in Release 5.3 LogLogic Release 5.3 contains the following noteworthy improvements and updates since the previous feature release: Message Routing Formatted Forwarding This new feature allows log messages to be formatted prior to forwarding them to another destination. This feature allows changes to the format and extraction of unwanted strings. Dashboard Dashboard Widget drill-down Widget drill-down enables a user to click through a widget and go directly into it search or report interactive views. Archive Storage widget This new feature permits users to create a dashboard widget to Display available space on attached NAS/SAN volumes. Alert Schedule Alert Functionality for LogLogic Alerts The new schedule alert feature provides the users with a way to enable/disable alerts based on one hour time blocks. Administration New Find capability A find interface has been added to pages where needed. Consolidation of report recipients and System Users This new feature combines both lists removing the need to create duplicate entries for a System User and a Report recipient. Index Search and Real-Time Reports Device Picker Enhancement for Index Search This new capability sets the default sources to an All Sources rule that excludes LogLogic Appliances. LogLogic appliance can be added manually. Improved warning indicator message When a report or search is missing data due to an unreachable Remote Appliance, the UI now displays a larger warning indicator with a tooltip that shows detailed information about the failure. That same information is now included in printed reports. Enterprise Virtual Appliance License control of parsing (EVA) Customers will now be able to purchase a high ingest rate EVA. This boost in ingest is achieved by disabling parsing using a license key. Enable HA Support for EVA The Enterprise Virtual Appliance (EVA) now supports High Availability (HA). EVA only - Increased RAW data retention The maximum RAW data retention value for the Enterprise Virtual Appliance (EVA) has been extended to 7 years. EVA only - The maximum available storage value for the Enterprise Virtual Appliance (EVA) has been extended to 14,500 GB. 2

3 Supported Platforms, Browsers, and Settings License Consumption Alert This new system alert monitors limits for remaining disk space and number of devices allocated. Browser New browser support Chrome has been added to the supported browser list. Note: For changes to the Release Notes after the initial release, see the LogLogic Customer Support website. Supported Platforms, Browsers, and Settings This LogLogic release supports specific LogLogic Appliance models, and can be used with supported web browsers on systems using the recommended display settings. Table 3 Platforms Supported LX Appliances ST Appliances MX Appliances LX 820 ST 1020 MX 2010 LX 1010 ST 2010 MX 3020 LX 1020 ST 2020-SAN MX 4020 LX 2010 ST 3010 LX 4020 ST 4020 Note: Upgrades to LogLogic 5.3 are not available for LX 510 and LX 2010N. Note: The use of advanced features on second-generation hardware Apliances may cause performance degradation. Table 4 Browsers Supported Browser Version Google Chrome 14.x Microsoft Internet Explorer 7.x, 8.x Mozilla Firefox 3.6.x Table 5 Display Settings Monitor Recommended settings Minimum settings Display Resolution 1280 x 1024 pixels or higher 1024 x 768 pixels Colors 32-bit colors 16-bit colors LogLogic Documentation This release includes the following documentation, available both on the LogLogic Customer Support website and on the Solutions CD that ships with the Appliance: LogLogic Hardware Installation Guide Describes how to get started with the LogLogic Appliance, and includes details about the Appliance hardware. LogLogic Installation and Upgrade Guide Describes how to upgrade a LogLogic Appliance. 3

4 LogLogic Documentation LogLogic Administration Guide Describes how to administer the LogLogic solution including managing users, managing log data storage, and managing new log sources (devices). LogLogic Management Appliance Guide Describes how to manage multiple distributed Appliances using the LogLogic Management Appliance. LogLogic User Guide Describes how to use the LogLogic solution, including for managing reports, managing alerts, and performing searches. LogLogic Enterprise Virtual Appliance Quick Start Guide Describes how to install the LogLogic Enterprise Virtual Appliance (EVA) in the VMware environment. LogLogic Log Source Configuration Guides Describe how to support log data from various log sources. There is a separate manual for each supported log source. These documents include documentation on LogLogic Collectors as well as documentation on how to configure log sources to work with the LogLogic solution. LogLogic Collector Guides Describe how to implement support for using a LogLogic Collector for specific log sources such as IBM i5/os and ISS SiteProtector. LogLogic Log Source Report Mapping Guidebook This guide provides a set of tables listing Log Source Reports by Device Type, sorted by UI Categories: Access Control, Database Activity, Enterprise Content Management, HP NonStop Audit, IBM i5/os Activity, Mail Activity, Network Activity, Operational, Policy Reports, Storage Systems Activity, and Threat Management. LogLogic Web Services API Implementation Guide Describes how to implement the LogLogic Web Services APIs to manage reports, manage alerts, perform searches, and administrate the system. LogLogic Syslog Alert Message Format Quick Reference Guide Describes the LogLogic Syslog alert message format. XML Import Guide Describes how to manually import, export, and edit XML files into and from the Appliance when not using the Appliance UI. LogLogic Online Help Describes the Appliance user interface, including descriptions for each screen, tab, and element in the Appliance. 4

5 Fixed Issues Fixed Issues The following are the most significant issues resolved in Release 5.3: Administration: Resolved an issue with system UTC time that caused incorrect Pacific Daylight Time after upgrading from Release 5.1 to 5.2. (27814) Resolved a problem that caused Message Routing Create Rule to time out when filtering devices by Type. (31087) Resolved a problem that caused a one-to-one forwarding rule creation for every source device, resulting in too many forwarding rules. (28967) Resolved a problem that caused File Pull Test to terminate with an incorrect error message. (29598) Resolved a problem that caused SNMP alerts to not match the defined LogLogic MIB. (30593) Resolved a problem that caused Configuration settings to not be saved when exporting the database devices. (23378). Resolved a problem that caused user defined device groups to not show in Manage User Device without a Dynamic Device Group. (30407) Resolved a problem with CIFS where a password is not mandatory when adding a CIFS file transfer rule. (15855) Enterprise Virtual Appliance Resolved an issue that caused the Network Setting for the Enterprise Virtual Appliance to display fewer options in the drop-down list of 'Interfaces/Speed' than the UI in the hardware Appliance. (28475) Resolved an issue on the Enterprise Virtual Appliance UI that caused "Network Connection Speed" and "Network Interface" alerts to appear, these alerts have been suppressed. (28458) Browser Resolved a problem that prevented the IE browser from returning to the summarized results page after clicking "back to summarize results". (25787) Resolved a problem that caused "Error on page" when trying to edit message signatures in IE 8. (29034) Archiving Resolved an issue that caused the Appliance to reboot if the NFS server is down during NAS archiving. (22661) Resolved a problem that caused a failed path to appear on the ST2020-SAN (standby) Appliance. (29887) Resolved a problem that caused data corruption while writing the data to disk. (27884) Resolved a problem that caused SAN archiving to fail to use alternate mount points. (30159) Resolved a problem with Data files seen as exported to a Centera archive when no Centera archive is configured. (28799) 5

6 Fixed Issues Index Search and Real-Time Reports Resolved an issue that prevented RegEx Search and Index Search from returning data from a real-time Blue Coat device when local time zone was set to PST. (25394) Resolved a problem with permissions that prevented a user from opening a saved Regex Search Report. (30416) Resolved a problem with MySQL that caused slow indexing. (30682) Resolved a problem that caused Indexing retention settings to be ignored when set in a custom retention rule. (30795) Resolved a problem that caused Indexing retention settings to be ignored when set in the default retention rule. (30033) Resolved a problem that caused Index Search page to display "Page request is out of range" message when trying to jump directly to a specific result page. (28037) Resolved an issue that caused Index Search against the All Linux Group to contain data from Other Unix type devices. (22431) Resolved a problem that caused slow Access Control reports when drilling down on data. (28427) Resolved a problem that caused Index Search to be initiated more than once within same session while saving results in CSV. (26213) Resolved a problem that caused Index report to time out after 15 minutes. (29418) Resolved a problem where failed archive volumes unmount would cause index search to fail. (29926) Alerts Resolved a problem with Alerts that could not be acknowledged and were not displaying with the proper filter. (24495) Failover and Data Migration Resolved a problem with corrupted tables getting repaired on slave node but not on the master. (21656) Resolved a problem with archiving when an HA pair goes from degraded to normal High Availability. (29813) Miscellaneous Resolved a problem that caused out of memory errors. (28845) Resolved a ULDP collector segmentation fault. (29066) Resolved a problem that caused ULDP ports to not be opened on the LMI firewall. (29507) Resolved an issue that caused unwanted sys.log errors after upgrade. (26395) Resolved a problem that caused the API client to stop working after a password reset. (27586) Resolved a problem that caused.csv and.gz file download speed to decrease substantially after upgrade. (30333) 6

7 Known Issues Known Issues This list includes known Release 5.3 issues: Data Retention Cisco Content Engine can not get search results in RegEx search if the wait is more than 8 hours. (27764) Cause: In Release 5.3 retention is based on the message times, not the collect time. If all messages have dates that are outside the retention period (more than 8 hrs) they are deleted by the retention policy aging process. Formated Forwarding Display issues with Firefox browsers older than (29817) Forwarding User Defined Types All Syslog Sources will be no longer be selectable from Message Routing Log Source Picker. (29710) Security "All Syslog Sources" Only users with "Access all devices" privilege should be given the "Message Routing Configuration" privilege. Prior to Release 5.3 the LMI allowed forwarding messages from devices in the All Syslog Sources group even when the user creating the rule has not been given access to the specific devices in the group. This is a potential security leak because it allows a user without specific device privileges to forward messages from that device. This potential security issue has been fixed in Release 5.3. New Behavior: A message routing rule using the All Syslog Sources group from previous versions of LMI will be migrated when upgrading to Release 5.3. The migrated rule will continue to work in Release 5.3. It will appear in the list of selected log sources as All Syslog Sources in the Message Routing Log Source Picker. To protect against this potential message leak the administrator must delete the All Syslog Sources group from the routing rule and replace it with the appropriate All DeviceType X groups represented by All Syslog Sources. The All Syslog Sources group represents all devices whose messages are received via the network. These device types have a collection type of Network as seen on the Manage Device Types page. To replace All Syslog Sources include every All DeviceType X group for all of the device types that have a collection type of Network. User Defined Groups Message Routing: The available options could be different when selecting log sources from a user-defined Group containing mixed log types. (31205) When creating a Message Routing rule that includes mixed log types from a user-defined Group, the available options such as Protocols and Settings can be different compared to a rule that contains only a single log type. 7

8 Known Issues Message Routing: LMI does not support sending duplicate logs to the same destination when the same protocol is selected even with different ports. (31206) Workaround: If the user wants to send the same set of data twice to the same destination, he/she must use different protocols. Selecting A Large Number of Log Sources Log Source Picker: To avoid problems when adding a large number of devices, use the options listed below. (31216) Option 1: When creating a Message Routing rule for a large number of devices of the same log type, use the system-defined Group option. After entering the name of an Outbound Message Routing rule, go to the next page 1) Filter by Name, enter All* 2) Select one of more Groups as long as they are the same log type 3) Click All selected log sources Option 2: Choose user-defined Group when selecting particular devices. 1) Create a user-defined Group and select the devices that you want to add to the Message Routing rule 2) Create a Message Routing rule and enter any name; go to the next page 3) Filter by Type 4) Select the log type that you added in the user-defined Group 5) That user-defined Group will be displayed on the right panel 6) Select that user-defined Group 7) Click All selected log sources Option 3: For Log Source picker in Report and Index Search Go to the Log Source Picker widget 1) Filter by Type or Name to retrieve the list of devices 2) Click on "Add filters as rule..." button 3) It will create a dynamic rule which contains all listed devices on the right panel Clear Log Data Cluster membership keeps failing and the UI throws exceptions repeatedly during clear log data. (23836) If the Appliance accumulates a significant amount of data, Clear Log Data (Administration > Clear Log Data) will temporarily lock up the MySQL server for an extended period of time, potentially causing some background tasks in the Appliance that accesses the MySQL database to fail. This may cause erroneous log entries in sys.log. This is expected behavior, and will not affect the action of Clear Log Data or any Appliance functions after the completion of Clear Log Data. 8

9 Known Issues Import/Export After importing an InserOrUpdate mode XML file, the changed data is not updated properly. (26102) Workaround: Delete the XML file and then re-import it. Browser Online WebHelp does not function properly in Chrome 14.x. (29013) Workaround: WebHelp functions properly in Chrome 16.x. Workaround for Chrome 14.x: Launch Chrome 14.x with the command line option --allow-file-access-from-files and WebHelp will work properly. You can add this option to your Desktop shortcut and/or Start Menu shortcut for Google Chrome by right-clicking on the icon, choosing Properties, putting your cursor at the end of the Target box, then adding a space followed by --allow-file-access-from-files. Using the browser Back button in IE 8 can cause errors in the Device Management interface. The error does not occur in Firefox. (25323) Browser may hang during running reports or index search with configuration of 1000 rows per page. (26108) Workaround: Set the rows per page to a lower number. Enterprise Virtual Apliance VMware's Workstation 8 on Windows platform cannot display the EULA page correctly. (31187) Workaround: Use the command line tool, ovftool, to import the EVA OVA package. The ovftool binary comes with WorkStation installation and can be found in C:\Program Files (x86)\vmware\vmware Workstation\OVFTool\ovftool.exe, or other Workstation installation path. The Windows command "ovftool.exe eva_package_name.ova virtual\machines\dir\target_eva_machine_name.vmx" can deploy the EVA OVA package to WorkStation 8 on Windows. GUI HTTP error (Please contact your Admin) occurs when showing Timeline during searching a large amount of data. (18110) This issue does not occur if checking the Show Timeline before or after running the search; it occurs only when checking the Timeline check box while searching a large amount of data. Index Search timeline doesn't refresh with repeated searches. (29268) Following an index search, the Next Page button and the Last Page button appear, even when there is only one page of data returned. After clicking the Last Page button, "Page request is out of range" overlay window will display. Upon clicking the Previous Page button, the returned Index Search results disappear. (28342) Workaround: Click OK when "Page request is out of range" overlay window displays, and the previous index search results will return. 9

10 Known Issues Management Station When using Management Station, messages from a specific MX or LX Appliance may not be included in the detailed report when All LX/MX is selected in "Appliance". (30028) Devices with the same name from different Appliances have different device IDs. In aggregating summary results, only one device ID is kept. When this ID is later used to get drill-down results, only one Appliance can contain this ID, so drill-down results contain logs from only one Appliance. (Management Station only): Password Control > Enforce Password Length Rules are not strictly enforced if the length field is NULL. (20742) Performance Slow performance when running the detailed Network Activity - Application Distribution. (31059) When "Enable Accept Detail" is turned on, the LMI will begin aggregation starting with oldest data collected. The reports will take a longer while the aggregator is "catching up". The amount of time is dependent the 1) amount of un-aggregated data collected prior to enabling Accept Detail and 2) the current collection rate. Once the aggregator has caught up reports should appear more quickly. Index Report Drill-down on index report results does not work when more than 16 devices are selected. (29746) Workaround: Select fewer devices, or create a device group to include all devices needed. Upgrade All Release 5.1 indexes will be deleted after upgrade to Release 5.2 or 5.3 because they are not compatible. Data will be re-indexed automatically. (28421) Archiving In active-passive SAN system, the SAN device listing won't get updated if SAN controller failover occurs. (23197) In certain circumstances, the same archive and backup paths to NAS can be configured from the same or different Appliances, resulting in incorrect backup data being stored in the indexfiles table. (28505) Workaround: Use a clean directory as a mount point when configuring the NAS server. 1) The same NAS path should not be shared between backup and archive on the same Appliance. 2) The same NAS path should not be shared between backup and archive on different Appliances. 10

11 Known Issues After upgrade from Release 5.1 to 5.2, the IPS report displays nothing in the drill-down report if the filters for Threat Value, Risk Value, and Reputation columns are set to --null-- (28535) Workaround: a) Click on Filter hyperlink on top to modify the value of those three columns b) Delete "--null"-- from Threat Value, Risk Value and Reputation columns c) Click Apply and Run the report again. When updating Dashboard widgets, the displayed information is not updated imediately. (31333) Workaround: Update and save changes twice. This will force an update of the display. Dashboard The dropped message counter on the Appliance Dashboard fails to update properly for messages dropped by the kernel. (21947) Time Fall back to the next available ntpserver fails when the NTP server name is specified in /etc/hosts. (24625) Workaround: Avoid using /etc/hosts to specify the host name for NTP server. Backup In certain circumstances the Backup Status log displays some invalid errors following a Backup and Restore operation. (31195) Upon successful Restore from a full backup that either is the very first full backup of the Appliance, or was backed up with the Backup Now checkbox selected, the Backup Status may erroneously show that particular backup entry with "failure" status. This can be ignored. Widgets NAS/SAN Widget Disk Space calculation may be inaccurate when using multiple NAS export mount points under the same partition. (31243) 11

12 LogLogic Support LogLogic Support LogLogic Technical Support is available to resolve issues that might arise. The LogLogic Documentation Team is eager to receive your feedback to help ensure the documentation helps everyone as much as possible. Technical Support LogLogic is committed to the success of our customers and to ensuring our products improve customers' ability to maintain secure, reliable networks. Although LogLogic products are easy to use and maintain, occasional assistance might be necessary. LogLogic provides timely and comprehensive customer support and technical assistance from highly knowledgeable, experienced engineers who can help you maximize the performance of your LogLogic Appliances. To reach the LogLogic Support team by telephone: Toll Free, US LOGS (5647) Toll Toll Free, Canada LOGS (5647) Toll Toll Free, Mexico LOGS (5647) Toll Toll Free, United Kingdom Toll Toll Free, Mainland Europe Toll Toll Free, Japan IDC Toll Not Available Toll Free, Japan KDD Toll Not Available Toll Free, Brazil Toll Not Available support@loglogic.com Customer Support website: When contacting LogLogic Support, be prepared to provide the following information: Your name, address, phone number, and fax number Your company name and company address Your appliance model and release version Serial number located on the back of the Appliance or the eth0 MAC address A description of the problem and the content of pertinent error messages (if any) Documentation Support Your feedback on LogLogic documentation is important to us. Send to DocComments@loglogic.com if you have questions or comments. Your comments will be reviewed and addressed by the LogLogic technical writing team. In your message, please indicate the software name and version you are using, as well as the title and document date of your documentation. 12