TIBCO LogLogic Universal Collector Release Notes Software Release 2.3.0 November 2012
Important Information SOME TIBCO SOFTWARE EMBEDS OR BUNDLES OTHER TIBCO SOFTWARE. USE OF SUCH EMBEDDED OR BUNDLED TIBCO SOFTWARE IS SOLELY TO ENABLE THE FUNCTIONALITY (OR PROVIDE LIMITED ADD-ON FUNCTIONALITY) OF THE LICENSED TIBCO SOFTWARE. THE EMBEDDED OR BUNDLED SOFTWARE IS NOT LICENSED TO BE USED OR ACCESSED BY ANY OTHER TIBCO SOFTWARE OR FOR ANY OTHER PURPOSE. USE OF TIBCO SOFTWARE AND THIS DOCUMENTIS SUBJECTTO THE TERMS AND CONDITIONSOFA LICENSE AGREEMENT FOUNDIN EITHERASEPARATELY EXECUTED SOFTWARE LICENSE AGREEMENT, OR, IF THERE IS NO SUCH SEPARATE AGREEMENT, THE CLICKWRAP END USER LICENSE AGREEMENT WHICH IS DISPLAYED DURING DOWNLOAD OR INSTALLATION OF THE SOFTWARE (AND WHICH IS DUPLICATED IN THE LICENSE FILE) OR IF THERE IS NO SUCH SOFTWARE LICENSE AGREEMENT OR CLICKWRAP END USER LICENSE AGREEMENT, THE LICENSE(S) LOCATED IN THE LICENSE FILE(S) OF THE SOFTWARE. USE OF THIS DOCUMENT IS SUBJECT TO THOSE TERMS AND CONDITIONS, AND YOUR USE HEREOF SHALL CONSTITUTE ACCEPTANCE OF AND AN AGREEMENT TO BE BOUND BY THE SAME. This document contains confidential information that is subject to U.S. and international copyright laws and treaties. No part of this document may be reproduced in any form without the written authorization of TIBCO Software Inc. TIBCO, Two-Second Advantage and LogLogic are either registered trademarks or trademarks of TIBCO Software Inc. in the United States and/or other countries. All other product and company names and marks mentioned in this document are the property of their respective owners and are mentioned for identification purposes only. THIS SOFTWARE MAY BE AVAILABLE ON MULTIPLE OPERATING SYSTEMS. HOWEVER, NOT ALL OPERATING SYSTEM PLATFORMSFORASPECIFIC SOFTWARE VERSIONARE RELEASEDATTHESAME TIME. SEE THE README FILE FOR THE AVAILABILITYOF THIS SOFTWARE VERSIONONASPECIFIC OPERATING SYSTEM PLATFORM. THIS DOCUMENT IS PROVIDED AS IS WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FORAPARTICULAR PURPOSE,OR NON-INFRINGEMENT. THIS DOCUMENT COULD INCLUDE TECHNICAL INACCURACIES OR TYPOGRAPHICAL ERRORS. CHANGES ARE PERIODICALLY ADDED TO THE INFORMATION HEREIN; THESE CHANGES WILL BE INCORPORATED IN NEW EDITIONS OF THIS DOCUMENT. TIBCO SOFTWARE INC. MAY MAKE IMPROVEMENTS AND/OR CHANGES IN THE PRODUCT(S) AND/OR THE PROGRAM(S) DESCRIBED IN THIS DOCUMENT AT ANY TIME. THE CONTENTS OF THIS DOCUMENT MAY BE MODIFIED AND/OR QUALIFIED, DIRECTLY OR INDIRECTLY, BY OTHER DOCUMENTATION WHICH ACCOMPANIES THIS SOFTWARE, INCLUDING BUT NOT LIMITED TO ANY RELEASE NOTES AND "READ ME" FILES. Copyright 2002-2012 TIBCO Software Inc. ALL RIGHTS RESERVED. TIBCO Software Inc. Confidential Information - 2 -
Release Notes for TIBCO LogLogic Universal Collector v2.3.0 GA The Universal Collector (UC) is a software device that collects logs from log sources and forwards them to an LMI server. Three types of log sources are supported: Syslog, Windows Event Logs, and Real Time Files. UC forwarding features include security, compression, messages buffering and messages delivery guaranty. Several UCs can be deployed on dedicated or shared appliances, or on physical or virtual hardware to remotely collect hundreds of log sources located on the same site. This document lists the functionalities available in Universal Collector 2.3.0 GA. Note: For changes to the Release Notes after the initial release, see https://download.tibco.com/tibco/ New Features... 4 UC 2.3 Compatibility... 4 Known Issues... 5 Requirements... 6 Supported Platforms... 6 UC Performances... 8 Upgrade... 9 Documentation... 9 Technical Support... 10-3 -
New Features Collection Added Remote File collection capability. This feature allows the UC to collect remote files through FTP, SFTP, and CIFS. It supports file rotation and directory pulling. The files are sent to LMI 5.4 or above as pulled files instead of syslog through ULDP. Forwarding Added TCP and UDP syslog forwarders. This enables UC to forward to any syslog server. The TCP syslog forwarder also supports SSL. Both forwarders support custom headers. Test connection - The UC Console added test connection feature for remote file log sources and TCP syslog forwarders. UC Monitoring Added real-time metrics information for syslog forwarders. Supported Operating Systems UC now supports Solaris in addition to Windows and various Linux distributions. MC Agent - A software component which communicates with Tibco LogLogic Management Center (MC 2.1 or above). MC is a software solution that allows you to manage Assets ie. Log Management Intelligence (LMI) and Universal Collector (UC 2.3 or above), schedule batch upgrade for Assets, monitor system health check, and backup and restore Asset data. Custom components installer - During the installation, you will be asked whether to install UC Console, UC Service or both. UC 2.3 Compatibility UC 2.3 no longer supports Lasso Extractor UC 2.3 CLI tools cover the same features as UC 2.2 ones as well as new additional commands UC 2.3 still allows manual XML edition of configuration files. - 4 -
Known Issues Changing the configuration of Remote File Collection log sources when the files are still being downloaded or transferred will cause the UC to restart the file transfer process. Editing the UC configurations when the Applying Changes... Please Wait information is visible on the UI will cause errors in saving the configurations. It is recommended to wait for the Applying Changes... Please Wait message to disappear before making changes. The VALIDATE_UCC_FILE silent install property has been removed from UC 2.3.0. After installing UC in silent mode, you will need to select a configuration file you want to work with using either the UC Console or the uc_switchto command in the tools directory. The scheduled forwarding option in the ULDP forwarder will cause the LMI to parse the message time stamps incorrectly. When this feature is enabled, if the log message does not have a timezone in the timestamp, the receiving LMI will parse the message time stamps as UTC time stamps. - 5 -
Requirements Supported Platforms Version 32-bit 64-bit Redhat Enterprise Linux (RHEL) 5 X X 6 X X SUSE Linux Enterprise Server (SLES) 11 X X Microsoft Windows 2003 R2 X X 2008 X X 2008 R2 - X 7 X X Solaris 10 x86 X 10 Sparc X 11 x84_64 X 11 Sparc X Supported LMI Version Universal Collector is compatible with Loglogic LMI version 5.0 or higher. LMI Version LMI 5.4 LMI 5.3 LMI 5.2 LMI 5.1 LMI 5.0 LMI 4.x Description Up to 2,500 UCs (LMI 5.4 is required to support remote file collection) Up to 2,500 UCs Up to 2,500 UCs Up to 300 UCs Up to 300 UCs UC not supported - 6 -
Minimum Hardware Configuration Component Type CPU RAM Minimum Multi-core, minimum 2GHz CPU frequency: increase sustained MPS value does not increase sustained Log Source number Multi-core CPU: does not increase sustained MPS value increase sustained Log Source number minimum 2 GB recommended 2 GB dedicated to UC Service HDD Minimum 5 GB disk space Minimum Java Required for Installation To install UC 2.3, you must have JRE 7 or later already installed on your computer. For performance reasons, we recommend using JRE version 7u5 or above. - 7 -
UC Performances Max MPS* Collection Max LS RedHat / Comment Windows SuSE Real Time File 3000 10,000 13,000 Same for single and multi lines logs. Size of messages impact max MPS. Remote File 10 N/A N/A Recommended max file size is 4 GB. Syslog 750 25,000 40,000 Size of UC message buffer impact max MPS. Size of messages does not impact max MPS. Windows Event Log 500 5,000 1,000 Size of messages does not impact max MPS. Total Collection 4,250 25,000 40,000 Forwarding Max LMI Max MPS* (All OS) Comment LMI 10 40,000 Compression gain: 90% Total Forwarding 10 40,000 * Max MPS conditions: UC running on a dedicated collector server: 1x Quad Core CPU @ 2.26 GHz 6 GB RAM Only one log source Real Time File: messages size is 800 bytes Syslog: messages size is 800 bytes Windows Event logs Messages size is 250 bytes 10 event logs 100 MB per event logs 10 sec polling interval - 8 -
Upgrade When upgrading from UC 2.2 to UC 2.3.0: To work with an existing Lasso Enterprise configuration, you must use a tool called Lasso Enterprise Configuration Extractor available only in UC v2.2. Therefore, prior to using your Lasso configuration in UC 2.3.0, you will have to install UC 2.2 and extract the Lasso Enterprise configuration as described in the documentation. Then upgrade your UC 2.2 to UC 2.3 as usual and work with your migrated configuration. Documentation The User Guide is available in the Universal Collector Installation folder. - 9 -
Technical Support LogLogic is committed to the success of our customers and to ensuring our products improve customers' ability to maintain secure, reliable networks. Although LogLogic products are easy to use and maintain, occasional assistance might be necessary. LogLogic provides timely and comprehensive customer support and technical assistance from highly knowledgeable, experienced engineers that can help you maximize the performance of your UC 2.2 solution. To reach the LogLogic Support team: Telephone: Toll Free 1-800-957-LOGS Local 1-408-834-7480 Europe, Middle East, Africa (EMEA) or Asia Pacific (APAC): Toll Free: 00 800 0330 4444 Toll: +44 1480 479391 Email: support@loglogic.com Support Website http://www.loglogic.com/contact/customer-support/ When contacting LogLogic Support, be prepared to provide the following information: Your name, email address, phone number, and fax number Your company name and company address Your UC release version Serial number located on the back of the Log Appliance or the eth0 MAC address A description of the problem and the content of pertinent error messages (if any) - 10 -