Symantec Enterprise Security Manager Security Update (SU 36) Release Notes

Transcription

1 Symantec Enterprise Security Manager Security Update (SU 36) Release Notes

2 Security Update (SU 36) Release Notes The software described in this book is furnished under a license agreement and may be used only in accordance with the terms of the agreement. Documentation version SU (SU 36) Legal Notice Copyright 2008 Symantec Corporation. All rights reserved. Symantec, the Symantec Logo, LiveUpdate, Symantec Enterprise Security Architecture, Enterprise Security Manager, and NetRecon are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. The product described in this document is distributed under licenses restricting its use, copying, distribution, and decompilation/reverse engineering. No part of this document may be reproduced in any form by any means without prior written authorization of Symantec Corporation and its licensors, if any. THE DOCUMENTATION IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE. The Licensed Software and Documentation are deemed to be commercial computer software as defined in FAR and subject to restricted rights as defined in FAR Section "Commercial Computer Software - Restricted Rights" and DFARS , "Rights in Commercial Computer Software or Commercial Computer Software Documentation", as applicable, and any successor regulations. Any use, modification, reproduction release, performance, display or disclosure of the Licensed Software and Documentation by the U.S. Government shall be solely in accordance with the terms of this Agreement.

3 Symantec Corporation Stevens Creek Blvd. Cupertino, CA

4 Technical Support Symantec Technical Support maintains support centers globally. Technical Support s primary role is to respond to specific queries about product features and functionality. The Technical Support group also creates content for our online Knowledge Base. The Technical Support group works collaboratively with the other functional areas within Symantec to answer your questions in a timely fashion. For example, the Technical Support group works with Product Engineering and Symantec Security Response to provide alerting services and virus definition updates. Symantec s maintenance offerings include the following: A range of support options that give you the flexibility to select the right amount of service for any size organization Telephone and Web-based support that provides rapid response and up-to-the-minute information Upgrade assurance that delivers automatic software upgrade protection Global support that is available 24 hours a day, 7 days a week Advanced features, including Account Management Services For information about Symantec s Maintenance Programs, you can visit our Web site at the following URL: Contacting Technical Support Customers with a current maintenance agreement may access Technical Support information at the following URL: Before contacting Technical Support, make sure you have satisfied the system requirements that are listed in your product documentation. Also, you should be at the computer on which the problem occurred, in case it is necessary to replicate the problem. When you contact Technical Support, please have the following information available: Product release level Hardware information Available memory, disk space, and NIC information Operating system

5 Version and patch level Network topology Licensing and registration Customer service Router, gateway, and IP address information Problem description: Error messages and log files Troubleshooting that was performed before contacting Symantec Recent software configuration changes and network changes If your Symantec product requires registration or a license key, access our technical support Web page at the following URL: Customer service information is available at the following URL: Customer Service is available to assist with the following types of issues: Questions regarding product licensing or serialization Product registration updates, such as address or name changes General product information (features, language availability, local dealers) Latest information about product updates and upgrades Information about upgrade assurance and maintenance contracts Information about the Symantec Buying Programs Advice about Symantec's technical support options Nontechnical presales questions Issues that are related to CD-ROMs or manuals

6 Maintenance agreement resources If you want to contact Symantec regarding an existing maintenance agreement, please contact the maintenance agreement administration team for your region as follows: Asia-Pacific and Japan Europe, Middle-East, and Africa North America and Latin America Additional enterprise services Symantec offers a comprehensive set of services that allow you to maximize your investment in Symantec products and to develop your knowledge, expertise, and global insight, which enable you to manage your business risks proactively. Enterprise services that are available include the following: Symantec Early Warning Solutions Managed Security Services Consulting Services Educational Services These solutions provide early warning of cyber attacks, comprehensive threat analysis, and countermeasures to prevent attacks before they occur. These services remove the burden of managing and monitoring security devices and events, ensuring rapid response to real threats. Symantec Consulting Services provide on-site technical expertise from Symantec and its trusted partners. Symantec Consulting Services offer a variety of prepackaged and customizable options that include assessment, design, implementation, monitoring, and management capabilities. Each is focused on establishing and maintaining the integrity and availability of your IT resources. Educational Services provide a full array of technical training, security education, security certification, and awareness communication programs. To access more information about Enterprise services, please visit our Web site at the following URL: Select your country or language from the site index.

7 Introducing Security Update (SU 36) This document includes the following topics: What is new in Security Update About the new operating systems support About executing multiple modules in parallel New checks Modified checks New messages Enhancements Resolved issues Known issues System requirements About the logging feature What is new in Security Update The following are new in Security Update (SU) : Support for AIX 6.1 on AIX VIO client vesrion 1.5 Support for SUSE Linux 9 SP4 on IBM zseries (s390x) Support for SUSE Linux 10 SP1 on IBM zseries (s390x)

8 8 Introducing Security Update (SU 36) About the new operating systems support Support for ESX server 3.5 Support for Windows Vista SP1 Support for SUSE Linux Enterprise server 9 SP4 Support for SUSE Linux Enterprise server 10 SP2 Support for parallel execution of the modules 1 new check in the Windows Agent Information module 2 new checks in the Windows Symantec Product Info module 2 new checks in the Windows XP and Vista Password Strength module 1 new check in the Windows Vista Network module 1 new check in the UNIX File Watch module Logging feature for the (Windows) Registry, Account Integrity, and Login Parameters modules Enhancements in the Account Information, File System Entitlement, File Attribute and File Watch, File Find, OS Patch, Password Strength, Startup Files, and User Files modules. Note: On the LiveUpdate wizard, the SU version will now be visible in the following format: SU<YYYY><MM><Release_Version>. Where, YYYY is the year of release, MM is the month of release, and Release_Version is the release version of the SU. For example, SU 36 is displayed as SU on the LiveUpdate wizard. About the new operating systems support SU provides support for the following operating systems: AIX 6.1 on AIX VIO client version 1.5 The ESM and later AIX-PPC64 agents are now certified on AIX 6.1 on AIX VIO client. To use this agent, install the existing AIX-PPC64 agent and apply SU to it. Support for ESX server 3.5 The ESM and later Linux -x86 agent is certified on ESX server 3.5. SUSE Linux 9 SP4 on IBM zseries(s390x) ESM 9.0 Linux-s390x agent has been certified on SUSE Linux 9 SP4 on IBM zseries (s390x)

9 Introducing Security Update (SU 36) About executing multiple modules in parallel 9 SUSE Linux 10 SP1 on IBM zseries (s390x) ESM 9.0 Linux-s390x agent has been certified on SUSE Linux 10 SP1 on IBM zseries (s390x) Support for Windows Vista SP1 ESM 9.0 Windows Vista agent has been certified on x86, Opteron and EM64T Support for SUSE Linux Enterprise server 9 SP4 ESM 9.0 agent on SUSE Linux Enterprise server 9 SP4 has been certified on x86, Itanium, PPC64, and Opteron and EM64T Support for SUSE Linux Enterprise server 10 SP2 ESM 9.0 agent on SUSE Linux Enterprise server 10 SP2 has been certified on x86, Itanium, PPC64, and Opteron and EM64T For more information on the agents, refer to ESM Agent Downloads section on the following Symantec Security Response Web site: About executing multiple modules in parallel SU introduces a new feature that enables multiple modules to run in parallel. When you initiate a policy run, each module is sequentially executed against the target agents. This functionality has been enhanced and now you can configure multiple modules to be executed simultaneously. The execution of multiple modules in parallel lets you collect data from the target agents within a shorter span of time. The number of modules that you can configure to be run in parallel depends on the resources available on the agent computer. This feature is supported on ESM 9.0. The AGENT_MODULE_PARALLEL_POOL_SIZE parameter relates to multiple module execution in parallel, which is present in agent.conf. The agent.conf file resides in the computer where you have the agent installed. To configure the parameter 1 On the agent computer, go to #esm\config\agent.conf 2 In the agent.conf file, specify a value for the AGENT_MODULE_PARALLEL_POOL_SIZE parameter. The minimum value is 1. The maximum that you can specify is 10. The default value is 1.

10 10 Introducing Security Update (SU 36) New checks Note: This functionality is not supported for the Application modules and the Network Assessment module. New checks New checks have been added in the following modules: Agent Information (Windows) File Watch (UNIX) Network (Windows Vista) Password Strength (Windows XP and Vista) Symantec Product Info (Windows) Agent Information (Windows) The following new check has been added to the Agent Information (Windows) module: Installed Applications Installed Applications This check reports the applications that are installed on the ESM agent computers. Table 1-1 includes information on the messages that Installed Applications check reports. Table 1-1 Message ID Message for the Installed Applications check Message Title Severity ESM_INSTALLED_APPLICATION Application installed green-0 File Watch (UNIX) The following new check has been added to the File Watch (UNIX) module: Ignore symbolic links Ignore symbolic links This check enables the module to ignore the symbolic links that are on the directory tree.

11 Introducing Security Update (SU 36) New checks 11 Network (Windows Vista) The following new check has been added to the Network (Windows Vista) module: Automatically update snapshot Automatically update snapshot This check automatically updates the snapshot with the following information: New and deleted TCP/UPD ports Network share information When the Network module is run for the first time, the module takes a snapshot of your computer even if you do not enable the Automatically update snapshot check. When you enable the Automatically update snapshot check on the subsequent runs, the Network module automatically updates the snapshots with the changes that are related to the above-mentioned information. Password Strength (Windows XP and Vista) The following new checks have been added to the Password Strength (Windows XP and Vista) module: Passwords must meet complexity requirements Passwords stored using reversible encryption Passwords must meet complexity requirements This check reports when the passwords must meet complexity requirements setting is disabled in the Password policy. Table 1-2 includes information on the messages that Passwords must meet complexity requirements check reports. Table 1-2 Message for Passwords must meet complexity requirements check Message ID ESM_PASSWORD_COMPLEXITY ESM_PASSWORD_COMPLEXITY_NOT DEFINED Message Title Passwords must meet complexity requirements Passwords must meet complexity requirements Not Defined Message Severity yellow-2 yellow-2

12 12 Introducing Security Update (SU 36) New checks Password stored using reversible encryption This check reports when the store password using reversible encryption setting is enabled in the Password policy. Table 1-3 includes information on the messages that Password stored using reversible encryption check reports. Table 1-3 Message for Passwords stored using reversible encryption check Message ID ESM_REVERSIBLE_ENCRYPTION_ ENABLED Message Title Reversible Encryption enabled in Password Policy Message Severity yellow-2 Symantec Product Info (Windows) The following new checks have been added to the Symantec Product Info (Windows) module under the Symantec Endpoint Protection (SEP) group: Minimum version Either Symantec Endpoint Protection or Symantec AntiVirus CE Minimum version This check verifies whether the installed Symantec Endpoint Protection client version is less than the specified version. This check also reports if the Symantec Endpoint Protection client is not installed on the agent computer. This check does not apply to 32-bit Windows 2000 SP2 and earlier as SEP client installation does not support the mentioned platforms. Table 1-4 includes information on the messages that Minimum version check reports. Table 1-4 Message for the Minimum version check Message ID ESM_SEP_VERSION_VIOLATION ESM_SEP_NOT_INSTALLED Message Title Symantec Endpoint Protection version outdated Symantec Endpoint Protection not installed Message Severity

13 Introducing Security Update (SU 36) Modified checks 13 Table 1-4 Message for the Minimum version check (continued) Message ID ESM_SEP_VERSION_ERROR Message Title Error Getting Symantec Endpoint Protection Version Information Message Severity Either Symantec Endpoint Protection or Symantec AntiVirus CE This check does not report any security violation message if either the Symantec Endpoint Protection (SEP) or the Symantec AntiVirus Corporate Edition (SAV) is installed on the agent computer. Table 1-5 includes information on the messages that Either Symantec Endpoint Protection or Symantec AntiVirus CE check reports. Table 1-5 Message for the Either Symantec Endpoint Protection or Symantec AntiVirus CE check Message ID ESM_SAV_NOR_SEP_NOT_INSTALLED Message Title Either SAVCE or SEP not installed Message Severity Modified checks The following checks have been modified: Disallowed services cont. (Windows Startup Files) Registered to Manager (Windows and UNIX Agent Information) Disallowed services cont. (Windows Startup Files) The Disallowed services cont. check in the Startup Files (Windows) module when enabled now reports a new message if the Startup module runs without any template files. Table 1-6 includes information on the modified message

14 14 Introducing Security Update (SU 36) New messages Table 1-6 Modified message for the Disallowed services cont. check Message ID ESM_FILE_MISSING Message Title No template files specified Message Severity Registered to Manager (Windows and UNIX Agent Information) New messages The Registered to Manager check in the Agent Information module has been modified to report the host names of all the ESM managers to which the agent is registered. New messages have been added to the following checks: Audit Log Info (UNIX File Attributes) Audit Log Info (UNIX File Watch) System Generated Passwords(UNIX Password Strength) Audit Log Info (UNIX File Attributes) There are 15 new messages added to the following checks that work in combination with the Audit Log Info check in the File Attributes module: User ownership Group ownership Permissions Changed files (change time) Changed files (modification time) Changed files (size) Changed files (signature) Table 1-7 includes information on the new messages Table 1-7 New messages for the Audit Log Info and the above-mentioned checks Message ID STKU_DIFFATTRIB_ R_ Message Title File attributes have changed Message Severity

15 Introducing Security Update (SU 36) New messages 15 Table 1-7 New messages for the Audit Log Info and the above-mentioned checks (continued) Message ID STKU_DIFFATTRIB_ Y_ STKU_DIFFATTRIB_ G_ STKU_DIFFOWN_R_ STKU_DIFFOWN_Y_ STKU_DIFFOWN_ G_ STKU_DIFFOWN_DIR_ R_ STKU_DIFFOWN_DIR_ Y_ STKU_DIFFOWN_DIR_ G_ STKU_DIFFPERM_ R_ STKU_DIFFPERM_ Y_ STKU_DIFFPERM_ G_ STKU_DIFFPERM_DIR_ R_ STKU_DIFFPERM_DIR_ Y_ STKU_DIFFPERM_DIR_ G_ Message Title File attributes have changed File attributes have changed Different file ownership Different file ownership Different file ownership Different directory ownership Different directory ownership Different directory ownership Different file permissions Different file permissions Different file permissions Different directory permissions Different directory permissions Different directory permissions Message Severity yellow-1 green-0 yellow-1 green-0 yellow-1 green-0 yellow-1 green-0 yellow-1 green-0 See Resolved issues on page 21.

16 16 Introducing Security Update (SU 36) New messages Audit Log Info (UNIX File Watch) There are 18 new messages added to the following checks that work in combination with the Audit Log Info check in the File Attributes module: Changed files (ownership) Changed files (permissions) Changed files(signature) New files Removed files Table 1-8 includes information on the new message Table 1-8 New messages for the Audit Log Info and the above-mentioned checks Message ID ESMM_REMOVED_GREEN_ ESMM_REMOVED_YELLOW_ ESMM_REMOVED_RED_ ESMM_NEW_GREEN_ ESMM_NEW_YELLOW_ ESMM_NEW_RED_ ESMM_MODIFIED_GREEN_ ESMM_MODIFIED_YELLOW_ ESMM_MODIFIED_RED_ ESMM_DIFF_PERM_GREEN_ Message Title Directory or file removed Directory or file removed Directory or file removed New directory or file New directory or file New directory or file File modified File modified File modified Directory or file permissions changed Message Severity green-0 yellow-2 green-0 yellow-2 green-0 yellow-2 green-0

17 Introducing Security Update (SU 36) New messages 17 Table 1-8 New messages for the Audit Log Info and the above-mentioned checks (continued) Message ID ESMM_DIFF_PERM_YELLOW_ ESMM_DIFF_PERM_RED_ ESMM_EXP_PERM_GREEN_ ESMM_EXP_PERM_YELLOW_ ESMM_EXP_PERM_RED_ ESMM_DIFF_OWN_GREEN_ ESMM_DIFF_OWN_YELLOW_ ESMM_DIFF_OWN_RED_ Message Title Directory or file permissions changed Directory or file permissions changed Directory or file permissions expanded Directory or file permissions expanded Directory or file permissions expanded File ownership modified File ownership modified File ownership modified Message Severity yellow-2 green-0 yellow-2 green-0 yellow-2 See Resolved issues on page 21. System generated passwords (UNIX Password Strength) A new message has been added to the System generated password check in the Password Strength module. This message is reported when the agent does not support the check for the passwords that the system generates. The check is supported only on HP-UX trusted mode. Table 1-9 includes information on the new message. Table 1-9 New message for the System Generated Passwords check Message ID STKU_NOTSUPPORT_SYSTEM GENERATED Message Title Account with system-generated password not supported Message Severity green-0

18 18 Introducing Security Update (SU 36) Enhancements Enhancements The following enhancements have been made in SU : Account Information (Windows) The following new key is added to the User Information (cont'd) check: Full/Display name When this key is enabled, the module reports the full name of the user account. File System Entitlement (Windows) The Prevent group expansion check now reports only the groups recursively and not the individual users. For example, the check now reports only groups when the user changes the default value in the Display Recursive Groups field from 0 to 1. If the value is 0, then the module does not report any member groups and the users of the group that are added in the name list. File Find (Solaris) The following checks in the File Find module have been enhanced to support the exclusion of the ctfs files: Directories/files/types excluded Sticky files World writable files Group writable files Uneven file permissions Unowned directories/files Note: You can exclude the ctfs files by entering CTFS in the file list of the mentioned checks. File Find (UNIX) The FileContentSearchTemplate now supports the keyword %ORACLE_HOME%. If this keyword exists, then the ESM agent reads from #esm\config\oracle.dat file and identifies all the Oracle homes that are present on the agent computer.

19 Introducing Security Update (SU 36) Enhancements 19 File Attribute, File Watch (Red Hat and SUSE Linux) The Audit Log Info check is now supported on Red Hat Enterprise Linux 4 or later and SUSE Linux 10 or later. Note: The Directory Auditing Support is from Audit version or later. OS Patch (AIX) The Condition column in the OS Patch template is now supported on AIX. Password Strength (Red Hat Linux 4 or later) If the package name is specified in the Condition column for a particular patch, then the OS Patch module checks for that patch only if the package is present on the Agent computer. The following checks are now enhanced to support on Red Hat Linux 4 or later agent computers: Minimum digits Minimum lower case characters Minimum special characters Minimum upper case characters Minimum different characters Minimum password history Password Strength (Windows) The following checks are now supported on Windows 64 bit Opteron and EM64T agent computers: Password = user name Password = any user name Password = wordlist word Reverse order Double occurrences Plural Suffix Prefix Accounts with passwords MD4 hashes

20 20 Introducing Security Update (SU 36) Enhancements Registry, Account Integrity, and Login Parameters (Windows) The logging feature in SU is now enhanced to include the following: Create a directory to store the log file of the modules if the directory that the user specifies does not exist. Modified the default log level from ESMCRITICALFAILURE to ESMCRITICALFAILURE ESMERROR ESMEXCEPTION See About the logging feature on page 28. Startup Files (Windows) User Files (UNIX) The Exclude List option has been added to the 'Services using system account to run' check of the Startup Files module. The Group writable directories in PATH check is now enhanced to display the user name in the Information column. Note: The suppressed messages reappear if you have suppressed the "Group writable directories in user path" message on the information field in an earlier SU. User Files (UNIX) The following checks have been enhanced to support symbolic umask values: Umask (using su) Umask (modifying startup script) Umask (parsing startup scripts) Umask You can now enter either octal or symbolic umask values in the Minimum umask value field of the Umask check. User Files (UNIX) The umask - parsing startup scripts check is now enhanced to parse multiple file entries that are separated by a comma in a single line in the name list. Now, it also reports the file name and line number where umask is detected. Note: The suppressed messages reappear if you have suppressed the "Unsafe Umask" message on the Information field in an earlier SU.

21 Introducing Security Update (SU 36) Resolved issues 21 Resolved issues The following issues are resolved in SU : Account Integrity (Windows) File Attributes (UNIX) File Attributes (UNIX) Earlier, the Account Integrity module used to take longer time if the user did not select any check in the policy that was executed on the domain controller that had a large number of users. This issue has been resolved and now the module completes in less time. In SU , the File Attributes module used to take longer time to execute if you enabled the "Detect extended attribute" check. This issue has been resolved and the performance of the check has been drastically improved. The obsolete messages that were removed from SU 32 and later have been added again to support backward compatibility. See Table 1-10 on page 22. Login Parameters (AIX) Password Strength (UNIX) Startup Files (Windows) Previously, the Login failures check did not report the logon failure attempts from event log on the AIX agent computers which were not in the expected format. This issue is resolved and the check now correctly reports on AIX agents. The Password module now skips the locked accounts for the checks that guess passwords. Earlier, the Remote registry access check could not report all the deleted users that had an entry in the Registry permissions. This issue has been resolved and now the module displays Account Unknown <SID of the account> in the Name column for every account that is deleted. See Known issues on page 23.

22 22 Introducing Security Update (SU 36) Resolved issues Startup Files (Windows) Startup Files (UNIX) Earlier the Startup Files module did not display any error message if the user did not specify the correct template or did not specify any template. Now the module displays the No template files specified message if the user does not specify the correct template or does not specify any template. Earlier, it was not possible to specify multiple actions in the Action field of the syslog template. This issue has been resolved and now the syslog template supports multiple actions in the Action field separated by semi colon. The Detect Extended Attributes check reports the following messages if the user is using an SU 31 or earlier agent and an SU (SU 36) manager. Table 1-10 includes information on the obsolete messages that File Attributes module reports Table 1-10 Obsolete messages for the File Attributes module Message ID STKU_DIFFATTRIB STKU_NFS_EXPORTED STKU_DIFFOWN STKU_DIFFOWN_DIR STKU_DIFFPERM STKU_DIFFPERM_DIR STKU_NOEXIST STKU_FORBID STKU_FORBIDWC Message Title File attributes have changed File or directory is being exported Different file ownership Different directory ownership Different file permissions Different directory permissions Mandatory file does not exist Forbidden file exists Forbidden wild card file exists Message Severity yellow-1 yellow-1 yellow-1 yellow-1 yellow-1 yellow-1

23 Introducing Security Update (SU 36) Known issues 23 Known issues The following issues are known in SU : ESM modules (Linux) File Attribute (UNIX) The ESM modules require libpam.so (32-bit) to be installed on Linux operating systems for successful execution on the AMD64 and EM64T platforms. The message IDs for the following messages have been changed: STKU_FILE_EXT_ATTR_SET_R STKU_FILE_EXT_ATTR_SET_Y STKU_FILE_EXT_ATTR_SET_G The above messages reappear if you supressed them in File Watch (UNIX) Password Strength (SUSE Linux) If a Symbolic file is deleted after the snapshot has been taken in SU or prior, the Removed Files option of File Watch module reports that the link file is removed even though the Ignore symbolic links check is enabled. This issue can be resolved if you enable the Automatically update snapshot check before you run the File Watch module. If the passwords on the agent computer are encrypted using the blowfish algorithm, the password module takes more time to execute if you run it on SUSE Linux. Considerable performance improvement has been observed when the user account passwords are set using the DES encryption algorithm.

24 24 Introducing Security Update (SU 36) System requirements Startup Files (Windows) The message format of the Remote registry access check has been changed. The module now displays Account Unknown<SID of the account> in the Name column for every account that is deleted. Note: The suppressed messages reappear if you have suppressed the "Users/groups found with remote registry permissions" message on the Name field in earlier SU. See Resolved issues on page 21. System requirements Symantec reserves the right to certify the Security Update on the new versions of these operating systems before officially supporting them. Note: Per End of Life product support policy, ESM Content Updates on ESM 6.0 is not supported from SU Table 1-11 includes the supported operating systems for SU Table 1-11 Supported operating systems for SU Agent operating system AIX AIX AIX ESX Server HP-UX Platform AIX PPC64 VIO client version 1.5 RS 6000 PPC64 x86, Opteron and EM64T PA-RISC Supported versions on 6.5.x, (64-bit) (supported on and later) 5.2 (32-bit and 64-bit) 5.3 (32-bit only) 5.3 (64-bit only) 6.1 (64-bit) (supported on and later) (supported on and later) 3.5 (supported on and later) 11.11

25 Introducing Security Update (SU 36) System requirements 25 Table 1-11 Supported operating systems for SU (continued) Agent operating system HP-UX HP-UX Red Hat Enterprise Linux Red Hat Enterprise Linux ES Red Hat Enterprise Linux ES Red Hat Enterprise Linux WS and AS Red Hat Enterprise Linux AS Sun Solaris Sun Solaris SUSE Linux SUSE Linux Standard Server SUSE Linux Enterprise Server SUSE Linux Enterprise Server SUSE Linux Enterprise Server Platform PA-RISC Itanium IBM zseries (s390x) x86, Opteron and EM64T x86, Opteron and EM64T, and Itanium x86, Opteron and EM64T Itanium SPARC x86, Opteron and EM64T IBM zseries (s390x) x86 x86 Itanium Opteron and EM64T Supported versions on 6.5.x, , (supported on and later) (supported on and later) 5.0 (supported on and later) 3.0, , , , , 2.9, Local zone (supported on SP2 and later) SP4 (supported on ESM 9.0) 10 SP1 (supported on ESM 9.0) 9, 9 SP4 9, 9 SP4 10, 10 SP2 9, 9 SP4 10, 10 SP2 9, 9 SP4 (supported on and later) 10, 10 SP2 (supported on and later)

26 26 Introducing Security Update (SU 36) System requirements Table 1-11 Supported operating systems for SU (continued) Agent operating system SUSE Linux Enterprise Server SUSE Linux Windows 2000 Professional and Server Windows Server 2003 Windows Server 2003 Windows Server 2003 Enterprise Windows Vista Windows Vista Windows XP Professional Windows Server 2008 Windows Server 2008 Windows Server 2008 Windows Server 2008 Core Installation Platform IBM PPC e-server IBM zseries x86 x86 Itanium Opteron and EM64T x86 Opteron and EM64T x86 x86 Opteron and EM64T Itanium x86 Supported versions on 6.5.x, 9.0 9, 9 SP4 10, 10 SP2 9, 9 SP4 10, 10 SP1 All All All All Enterprise and Business editions (supported on and later) SP1 (supported on ESM 9.0) Enterprise and Business editions (supported on and later) SP1 (supported on ESM 9.0) SP2 SP3 (supported on and later) All (supported on and later) All (supported on and later) All (supported on and later) All (supported on and later)

27 Introducing Security Update (SU 36) System requirements 27 Table 1-11 Supported operating systems for SU (continued) Agent operating system Windows Server 2008 Core Installation Platform Opteron and EM64T Supported versions on 6.5.x, 9.0 All (supported on and later) Table 1-12 lists the disk space usage for an ESM 9.0 agent with SU applied. The amount of disk space required by each agent depends on its operating system. Table 1-12 Agent disk space requirements for SU Agent operating system AIX /RS 6000 AIX (PPC64) HP-UX (PA-RISC) HP-UX (Itanium ) Red Hat Enterprise Linux ES (x86) Red Hat Enterprise Linux WS and AS (AMD64) Red Hat Enterprise Linux AS (Itanium ) Red Hat Enterprise Linux WS and AS (EM64T) Red Hat Enterprise Linux on IBM zseries (s390x) Sun Solaris 2.8/2.9 (SPARC) Sun Solaris 10 (SPARC) Sun Solaris 10 (x86, Opteron and EM64T) SUSE Linux Enterprise Server 9 (x86) SUSE Linux Enterprise Server 9 (Itanium ) SUSE Linux Enterprise Server on IBM PPC e-server SUSE Linux Enterprise Server (Opteron and EM64T) Disk space required (in MB)

28 28 Introducing Security Update (SU 36) About the logging feature Table 1-12 Agent disk space requirements for SU (continued) Agent operating system SUSE Linux 9 SP4 on IBM zseries (s390x) SUSE Linux 10 SP4 on IBM zseries (s390x) Windows 2000 Professional and Server (x86) Windows Server 2003 (x86) Windows Server 2003 (Itanium ) Windows Server 2003 Enterprise (Opteron and EM64T) Windows XP Professional (x86) Windows Vista (x86) Windows Vista (Opteron and EM64T) Windows Server 2008 (x86) Windows Server 2008 (Itanium ) Windows Server 2008 (Opteron and EM64T) Windows Server 2008 Core Installation (x86) Windows Server 2008 Core Installation (Opteron and EM64T) Disk space required (in MB) About the logging feature A new logging feature was introduced in SU This feature enables ESM to log the information, such as errors and exceptions that a module generates at the runtime. This feature is currently enabled for the Windows Password Strength, Registry, Account Integrity, and Login Parameters modules. About the log levels of the messages The log level specifies the type and criticality of a message. You can manually create a configuration file and specify the log level of the messages that you want to be logged. ESM checks the log level that you set in the configuration file and stores only the qualifying messages in the log file.

29 Introducing Security Update (SU 36) About the logging feature 29 See Creating the configuration file on page 30. You can specify the following log levels: ESMNOLOG ESMCRITICALFAILURES Disable logging for the module All critical failures are logged. ESM always logs all critical failures irrespective of the log level that you specify in the configuration file. However, if ESMNOLOG is specified in the configuration file, ESM does not log the critical failures. ESMCRITICALFAILURE ESMERROR ESMEXCEPTION is the default log level and you need not explicitly specify it in the configuration file. ESMERRORS All errors are logged. The following are some examples of the errors: Template file not found Configuration file not found ESMEXCEPTIONS ESMWARNINGS ESMINFORMATION All exceptions are logged. All warnings are logged. All information messages are logged. The information that is gathered during a policy run is also logged at this level. Note: When you enable the ESMINFORMATION level, the performance of the module may be affected since all the information messages get logged. ESMTRACE ESMPERFMANCETIMING ESMAUDIT All debug information is logged. All time-consuming operations are logged. All audit information is logged. This level covers the data modification operations such as Correction and Update. ESMMAXIMUM Includes all log levels except ESMNOLOG. You specify the log level in the LogLevel parameter of the configuration file. For example, to log the messages that are related to critical failures, specify the log level as follows: [<module>_loglevel]= ESMCRITICALFAILURES

30 30 Introducing Security Update (SU 36) About the logging feature You can also specify multiple log levels by separating them with a pipe ( ) character as follows: [<module>_loglevel]= ESMCRITICALFAILURES ESMPERFMANCETIMING You can use log levels for specific operations as follows: For regular policy runs To generate detailed logs for policy failure ESMCRITICALFAILURES and ESMERRORS ESMCRITICALFAILURES, ESMERRORS, ESMTRACE, and ESMINFORMATION Creating the configuration file You can create a configuration file named esmlog.conf in the <esm_install_dir>/config folder and specify the values that ESM uses to store the logs of a module. To create the configuration file 1 Change to the <esm_install_dir>/config folder. 2 Create a new text file and specify the parameters and their values. 3 Save the text file as esmlog.conf. See Parameters of the configuration file on page 30. The following is an example of the entries in the configuration file: [MaxFileSize] = 1024 [NoOfBackupFile] = 20 [LogFileDirectory] = c:\program files\symantec\esm\system\agentname\logs [password_loglevel] = ESMINFORMATION ESMTRACE [pwdll_loglevel] = ESMMAXIMUM Note: No default configuration file is shipped with the Security Update. You need to manually create the file and specify the parameters in it. Parameters of the configuration file Table 1-13 lists the parameters that you need to specify in the configuration file.

31 Introducing Security Update (SU 36) About the logging feature 31 Table 1-13 Configuration file parameters Parameter name Description Range of values Default value [MaxFileSize] Specify the maximum file size for the log file in MB 1 MB to 1024 MB (1 GB) 1 MB [NoOfBackupFile] Specify the number of backup files of logs that can be stored per module. 0 to 20 1 For example, if the value of NOOFBACKUPFILE is 3, then ESM stores a maximum of 3 backup files for the module. [LogFileDirectory] Specify the absolute path to store the log file and backup log files. N/A The %systemroot%\temp directory is used on the Windows operating systems. [<module>_loglevel] Specify the log level along with the short name of the module. N/A ESMCRITICALFAILURE ESMERROR ESMEXCEPTION For example, to log all error messages for the Password Strength module, specify the following: [password_loglevel] =ESMERRORS About the log file If the configuration file is not present, ESM considers the default values of all the parameters to store the logs. The ESM application now stores the log file of the modules in the directory that the user specifies. If the directory that the user specifies does not exist, then the modules first creates the directory and then stores the log files in it.

32 32 Introducing Security Update (SU 36) About the logging feature The log file has the following format: <module_name>.log The <module_name> is the short name of the module. For example, the log file of the Password Strength module is named password.log. The backup file name for password strength module is named password.log_1.bak and so on. Note: During the process of logging, ESM locks the log file to store the logging information. If the log file is open at that time, the information about the logs may be lost. Format of the log file A log file contains the following fields: Serial Number Serial number of the log file entry The serial number is displayed in hexadecimal format. The serial number gets reset in the next policy run on the module. Thread ID Source File Name Line Number Date Time Message Thread identifier of the process that generated the message Name of the source file that caused the message to be generated Line number in the source file from where the message was generated Date on which the log was created Time at which the log was created The actual message that was generated along with the log level of that message About the backup of logs When the log file reaches a specified size limit, ESM backs up the log file. This size limit is configurable and you can specify it in the MaxFileSize parameter of the configuration file. If the log file reaches the MaxFileSize value, ESM creates a backup of the log file depending on the No of BackupFile value that is specified in configuration file. For example, if the No of BackupFile value is 0, ESM overwrites the existing log file, if any, for the module.