Novell SENTINEL LOG MANAGER 1.0.0.5 - S Bedienungsanleitung

Novell Sentinel Log Manager 1.0.0.5 Release Notes 1

novdocx (en) 19 February 2010

Novell®

Novell Sentinel Log Manager 1.0.0.5

Release Notes

March 30, 2010

Novell®SentinelTM Log Manager collects data from a wide variety of devices and applications,

including intrusion detection systems, firewalls, operating systems, routers, Web servers, databases,

switches, mainframes, and antivirus event sources. Novell Sentinel Log Manager provides high

event-rate processing, long-term data retention, regional data aggregation, and simple searching and

reporting functionality for a broad range of applications and devices.

Section 1, “What's New in Novell Sentinel Log Manager,” on page 1

Section 2, “Prerequisite,” on page 3

Section 3, “Installing Novell Sentinel Log Manager 1.0.0.5,” on page 3

Section 4, “Issues Fixed,” on page 5

Section 5, “Known Issues,” on page 14

Section 6, “Documentation Conventions,” on page 19

Section 7, “Legal Notices,” on page 19

1 What's New in Novell Sentinel Log Manager

The following sections list the new and enhanced features of Novell Sentinel Log Manager.

Section 1.1, “What’s New in Novell Sentinel Log Manager 1.0.0.5,” on page 1

Section 1.2, “What’s New in Novell Sentinel Log Manager 1.0.0.4,” on page 2

Section 1.3, “New Plug-Ins,” on page 3

1.1 What’s New in Novell Sentinel Log Manager 1.0.0.5

“500 EPS Version of Sentinel Log Manager” on page 1

“New End User License Agreement” on page 2

1.1.1 500 EPS Version of Sentinel Log Manager

The Novell Sentinel Log Manager is now available in a 500 EPS (events per second) version. The

500 EPS version is suitable for small deployments with only one Sentinel Log Manager server and a

low event rate. It can also be used as a low volume node reporting to another Sentinel or Sentinel

Log Manager server in a large deployment.

2Novell Sentinel Log Manager 1.0.0.5 Release Notes

novdocx (en) 19 February 2010

1.1.2 New End User License Agreement

The end user license agreement (EULA) terms have been updated in this release. You must accept

the new terms before before proceeding to apply the latest patch. Some of the changes in the EULA

are:

Novell Sentinel Log Manager is now available in a 500 EPS version.

Updated definition for

Non-Production Instance

Updated definition for

Type I Device

1.2 What’s New in Novell Sentinel Log Manager 1.0.0.4

“New Data Collection User Interface” on page 2

“LDAP Authentication” on page 2

“Enhancements to the Search Result User Interface” on page 2

“New User Interface for Actions” on page 3

“Enhancement to the Admin User Interface” on page 3

1.2.1 New Data Collection User Interface

The new and enhanced data collection user interface enables you to perform several new tasks:

Refine all the event sources by using the new Event Sources screen.

Start and stop the audit and syslog event source server by using the new Event Source Servers

tab.

Set the time zone for event sources.

Search for events that are coming from one or many event sources.

For more information about data collection configuration, see “Configuring Data Collection” in the

Novell Sentinel Log Manager 1.0.0.4 Administration Guide.

1.2.2 LDAP Authentication

Sentinel Log Manager now supports LDAP authentication in addition to the database authentication.

A new Authentication Type option has been added in the user > Add a user window of the Sentinel

Log Manager, which enables you to create user accounts that use LDAP authentication.

For more information about configuring the Sentinel Log Manager server for LDAP authentication,

see “User Administration” in the Novell Sentinel Log Manager 1.0.0.4 Administration Guide.

1.2.3 Enhancements to the Search Result User Interface

The enhanced search result interface enables you to perform several new tasks:

Export search report results.

Send search results to an action.

Download the raw data files for the selected event result's event source by using the get raw

data link.

View new event fields information in the search results.

Novell Sentinel Log Manager 1.0.0.5 Release Notes 3

novdocx (en) 19 February 2010

For example, it displays the Source IP address, Rawdata Record ID, Collector Script, Collector

name, Collector Manager ID, Connector ID, and Event Source ID information for the incoming

events.

View all the event fields information for the event source by using the show all fields link.

For more information about searching events and generating reports, see “Searching” in the Novell

Sentinel Log Manager 1.0.0.4 Administration Guide.

1.2.4 New User Interface for Actions

The new user interface for actions allows you to create multiple action instances that you can also

use while configuring rules. You can also view the number of rules that are associated with an

action.

For more information about configuring rules and actions, see “Configuring Rules” in the Novell

Sentinel Log Manager 1.0.0.4 Administration Guide.

1.2.5 Enhancement to the Admin User Interface

The new admin user interface enables you to assign new permissions for a user:

You can now allow users to view all reports that are stored on the server

Enable Sentinel Log Manager configuration reporting

You can now set a filter for the events a user can view.

For more information about configuring users, see “User Administration” in the Novell Sentinel Log

Manager 1.0.0.4 Administration Guide.

1.3 New Plug-Ins

A new Generic Forwarder Action 6.1r2 plug-in has been added to send search results to an action

instance.

2 Prerequisite

The Sentinel Log Manager Hot fix 5 (1.0.0.5) should be installed on top of an existing Sentinel Log

Manager 1.0.0.0, 1.0.0.1, 1.0.0.2, 1.0.0.3, or 1.0.0.4 installation.

3 Installing Novell Sentinel Log Manager 1.0.0.5

IMPORTANT: The Sentinel Log Manager Hot fix 5 (1.0.0.5) must be installed on the Sentinel Log

Manager server and all the Collector Managers running on remote machines. This Hot fix does not

update the Collector Manager installer script that you can download from the Sentinel Log Manager

web server. Hence, regardless of whether you have installed a Collector Manager before or after

applying the Hot fix on the Sentinel Log Manager server, it is mandatory to apply this Hot fix to all

the Collector Managers.

Section 3.1, “System Requirements,” on page 4

Section 3.2, “Installing on a Sentinel Log Manager Server,” on page 4

Section 3.3, “Installing on a Remote Collector Manager,” on page 4

4Novell Sentinel Log Manager 1.0.0.5 Release Notes

novdocx (en) 19 February 2010

3.1 System Requirements

For a detailed information on hardware requirements and supported operating systems, browsers,

and event sources, see “System Requirements” (http://www.novell.com/documentation/

novelllogmanager10/novell_log_manager/data/bjx8zq7.html) in the Novell Sentinel Log Manager

Guide.

3.2 Installing on a Sentinel Log Manager Server

To perform a quick and simple installation of Novell Sentinel Log Manager 1.0.0.5 on a Sentinel

Log Manager server:

1Log in to the Sentinel Log Manager as the

novell

user.

The

novell

user is created during the Sentinel Log Manager installation process and does not

have a password by default. Therefore, you can create a password in order to log in as this user,

or you can su - to this user.

2Download or copy the installer

SENTINEL_LOG_MANAGER_1.0.0.5.zip

to a temporary

directory.

3Change to the temporary directory.

4Unzip the install package by using the following command:

unzip SENTINEL_LOG_MANAGER_1.0.0.5.zip

5Change to the unzipped directory.

cd SENTINEL_LOG_MANAGER_1.0.0.5

6(Optional) Stop the Sentinel Log Manager services by using the following command:

Installation_Directory/bin/server.sh stop

7Run the hotfix installer and follow the prompts.

./service_pack.sh

3.3 Installing on a Remote Collector Manager

“Installing on Unix” on page 4

“Installing on Windows” on page 5

3.3.1 Installing on Unix

1Log in to the Sentinel Log Manager as the

root

user.

2Download or copy the installer

SENTINEL_LOG_MANAGER_1.0.0.5.zip

to a temporary

directory.

3Change to the temporary directory.

4Unzip the install package by using the following command:

unzip SENTINEL_LOG_MANAGER_1.0.0.5.zip

5Change to the unzipped directory.

cd SENTINEL_LOG_MANAGER_1.0.0.5

6(Optional) Stop the Collector Manager by using the following command:

Installation_Directory/bin/sentinel.sh stop

Novell Sentinel Log Manager 1.0.0.5 Release Notes 5

novdocx (en) 19 February 2010

7Run the hotfix installer and follow the prompts.

./service_pack.sh

3.3.2 Installing on Windows

1Log in to the Sentinel Log Manager as an

Administrator

2Download or copy the installer

SENTINEL_LOG_MANAGER_1.0.0.5.zip

to a temporary

directory.

3Change to the temporary directory.

4Unzip the installer package.

5Change to the unzipped directory.

cd SENTINEL_LOG_MANAGER_1.0.0.5

6(Optional) Stop the Collector Manager by using the following command:

Installation_Directory/bin/sentinel.bat stop

7Go to the installation directory.

8Execute the

service_pack.bat

from the command window and follow the prompt.

4 Issues Fixed

Section 4.1, “Issues Fixed in Sentinel Log Manager 1.0.0.5 Release,” on page 5

Section 4.2, “Issues Fixed in Sentinel Log Manager 1.0.0.4 Release,” on page 7

Section 4.3, “Issues Fixed in Sentinel Log Manager 1.0.0.3 Release,” on page 9

Section 4.4, “Issues Fixed in Sentinel Log Manager 1.0.0.2 Release,” on page 10

Section 4.5, “Issues Fixed in Sentinel Log Manager 1.0.0.1 Release,” on page 11

4.1 Issues Fixed in Sentinel Log Manager 1.0.0.5 Release

This section lists the issues fixed in Novell Sentinel Log Manager 1.0.0.5 release.

Table 1 Issues Fixed in Sentinel Log Manager 1.0.0.5 Release

Issues Fixed Description

582427 Issue:Legacy collectors stopped sending event data after Sentinel Log

Manager was upgraded to Hot fix 4.

Fixed:The latest version of agent-manager.jar file is bundled with the Hot

fix 5 to enable legacy collectors to send event data.

581908 Issue:The collector debugger fails as the latest version of libuuid.jar was

not present in the webstart webserver directory.

Fixed: The latest version of libuuid.jar file is now bundled with the Hot fix 5

build, to enable the collector debugger to function properly.

6Novell Sentinel Log Manager 1.0.0.5 Release Notes

novdocx (en) 19 February 2010

581912 Issue: Upgrading to Hot Fix 4 fails on a remote 64 bit Linux Collector

Manager.

Fixed: The installer now checks for the directory name. The upgrade

procedure now works fine.

590171 Issue: The All Vendors All Products Top 10 Report is not installed when

user upgrades to Hot fix 4 from versions older than Hot Fix 3.

Fixed: The report is now installed.

581698 Issue: The

start_tomcat.sh

script is unable to find the correct IP

address to write to JNLP files on startup.

Fixed: The script now attempts to read the user specified SERVER_IP

value from the

ipaddress.conf

file. If the

ipaddress.conf

file is not

present or if the IP address is not set in the file, then the script determines

the IP address automatically.

To enable the script to read the SERVER_IP value from the configuration

file, create the

ipaddress.conf

file in the

$ESEC_HOME/config

directory and specify the IP address in the following format:

SERVER_IP=<ip address value>

For example,

SERVER_IP=192.168.1.255

572619 Issue: Attempt to download raw data files for an Event Source which has a

name with double byte characters results in the

java.io.FileNotFoundException

error.

Fixed: Users can now download raw data files with double byte characters

in their names.

583775 Issue: A non-admin user is allowed to click the Get Raw Data link in their

search results. This links should be presented only to administrators.

Fixed: Now, when a non-admin user clicks the Get Raw Data link, the

following error message is displayed in the resulting page:

Must be an Administrator to download Raw Data

563886 Issue: The Collector framework must stop overwriting event fields so that

the Sentinel Link can properly report the agent that parsed the event.

Fixed: The Collector framework now doesn't overwrite the event fields

other than the rv21-rv25 fields.

580749 Issue: If you click the Help button from Web UI, an error page is displayed.

This is because an extra / is added to the URL.

Fixed: This issue is now fixed. If you click the Help button, the Novell

Sentinel Log Manager documentation page opens.

586957 Issue: Clicking details+ in Web UI fails for the events from a Collector that

does not populate the rv32 field.

Fixed: Clicking details+ in Web UI now expands even for events with

empty rv32 field.

Issues Fixed Description

Novell Sentinel Log Manager 1.0.0.5 Release Notes 7

novdocx (en) 19 February 2010

4.2 Issues Fixed in Sentinel Log Manager 1.0.0.4 Release

This section lists the issues fixed in Novell Sentinel Log Manager 1.0.0.4 release.

Table 2 Issues fixed in Sentinel Log Manager 1.0.0.4 Release

4.2.1 Enhancement

This section lists the enhancements in Novell Sentinel Log Manager 1.0.0.4 Release.

591055, 591059 Issue: After upgrading to Hot fix 4, the data parsed by Collectors is not

displayed in the generated report.

Fixed: The data is now displayed in the generated reports.

Issues Fixed Description

551079 Issue: In the report details, if the time range is not set to custom date

range, then the time shown reflect the actual times the report had been

run.

Fixed: After the report is run, the date range is being displayed

appropriately in the report details.

545195 Issue: When there are many event sources in the Operating System

section of syslog server user interface, the browser reports an

unresponsive script

error. As a result Sentinel Log Manager user

interface also becomes unusable.

Fixed: A new Data Collection user interface with Sentinel Log Manager

hotfix 4 properly manages the event sources.

532421 Issue: The e-mails received from Sentinel Log Manager has Novell

Identity Audit Event text in the subject line.

Fixed: The Subject field is now user configurable.

549330 Issue: The Device Event Time field is appearing as searchable field in the

search tips popup.

Fixed: The Device Event Time field is not a searchable field. It is now

deleted from the search tips popup.

523499 Issue: Passwords with both backward and forward slashes and single

quote characters are not accepted while login.

Fixed: Now the passwords with escape characters (\, /, and ‘) are allowed.

499349 Issue: When executing a search from the search toolbar on the upper right

hand corner of the user interface, it would intermittently open a search tab

with the search criteria of a previous search rather than the currently typed

in search.

Fixed: The new search tab now always has the most recently typed in

search criteria.

Issues Fixed Description

8Novell Sentinel Log Manager 1.0.0.5 Release Notes

novdocx (en) 19 February 2010

Table 3 Enhancements in Sentinel Log Manager 1.0.0.4 Release

Issues Fixed Description

553146 Issue: A raw data link is required next to each search result entry that will

take you to the unparsed raw data on the Raw Data Download page. The

event will display the data originated from the event source.

Fixed: A get raw data link is added to each search result. Clicking on this

link opens a Raw Data Download page in a new tab and points to the

appropriate event source.

509882 Issue: An option to export the report results option should be included.

Fixed: Sentinel Log Manager interface now provides you an option to

export the report results.

508992 Issue: An option needs to be provided to know the number of events the

user has scrolled through.

Fixed: The left pane of the search result displays the number of events the

user has scrolled through.

504105 Issue: LDAP authentication option should be added for Sentinel Log

Manager.

Fixed: Sentinel Log Manager now supports the LDAP authentication

option.

557632 Issue: The exported results

.csv

file should display the important fields

columns at the beginning.

Fixed: Important fields are placed in the beginning of csv report. The fields

are ordered as dt, port, sev, evt, msg, rv42, shn, sip, rv35, sun, rv41, dhn,

dip, rv45, dun, sp, isvcc, dp, tsvcc, ttd, ttn, rv36, and fn followed by other

fields as long as field has valid value.

542187 Issue: Exported search results were unreadable with too many empty

columns, which was causing it to throw some errors while opening in open

office.

Fixed: The empty columns are removed from the search results to make it

more readable and compact.

547204 Issue: Subject was not configurable in the Send an Email action user

interface and all the mails had default subject value.

Fixed: Now you can specify a subject line using the Subject field in the

Send an Email action user interface.

530183 Issue: The number of records value that went into a collector should be

displayed in the Collector status details pane of the Event Source

Management interface.

Fixed: The Total Records Sent and Records Sent in Last Interval fields are

included in the Collector status details pane of the Event Source

Management interface.

Novell Sentinel Log Manager 1.0.0.5 Release Notes 9

novdocx (en) 19 February 2010

4.3 Issues Fixed in Sentinel Log Manager 1.0.0.3 Release

This section lists the issues fixed in Novell Sentinel Log Manager 1.0.0.3 Release.

Table 4 Issues fixed in Sentinel Log Manager 1.0.0.3 Release

495806 Issue: Export search result has the same event count limit as search

refinement (50,000).

Fixed: The 50,000 limit for exporting results has been removed. Now the

user will be prompted to enter the number of results they want to export.

Issues Fixed Description

563948 Issue: A message stating that no events have been found by the search is

displayed even before the search is completed.

Fixed: The

no events found

message only appears if no events are

found after the completion of a search.

560580 Issue: Occasional searches run from the search tool bar used the previous

search string instead of the new search string.

Fixed: A new search run from the search tool bar uses the new search

string.

556411 Issue: Squashfs indexes that were mounted by a previous running

instance of the server are not cleaned up when the server starts, resulting

is failed searches.

Fixed: The server now detects if old mounts need to be cleaned up and

cleans them up allowing searches to complete normally.

552519 Issue: The softwarekey.sh script was not included in the install, making it

difficult to reset the license key with the server turned off.

Fixed: The softwarekey.sh script is now included.

549582 Issue: An event is not searchable by its original timestamp if it arrives

more than a day late.

Fixed: The event is searchable by its original timestamp no matter how

late it arrives.

546324 Issue: A rule or data retention policy configured with a filter that is just a full

text search (i.e., no field such as

sev:5

is specified) results in an error on

the server that prevents any users from logging into the Web interface or

ESM user interface.

Fixed: The bug is fixed so that all valid filters are now accepted and

evaluated properly. Filter validation is also done before allowing a user to

save a filter to prevent an invalid filter from being saved that would cause

logins to fail.

Issues Fixed Description

10 Novell Sentinel Log Manager 1.0.0.5 Release Notes

novdocx (en) 19 February 2010

4.3.1 Enhancement

Top N type reports are now supported. A Top N type report named

All Vendors All Products

Top 10 Report

is installed with this hotfix and is available as a Visualization from the Search Save

As Report dialog as well from the main report list. This report provides an easy way to view a

dashboard of the most frequent activity being monitored by Sentinel Log Manager.

4.4 Issues Fixed in Sentinel Log Manager 1.0.0.2 Release

This section lists the issues fixed in Novell Sentinel Log Manager 1.0.0.2 Release.

Table 5 Issues fixed in Sentinel Log Manager 1.0.0.2 Release

545837 Issue: The Event Source Management (ESM) user interface is not able to

read the maxclausecount property in the

SentinelPreferences.properties

file.

Fixed: The Event Source Management (ESM) user interface works fine

with a high number (>=~1000) event sources and does not log any

max

clause count exceeded

exceptions.

545197 Issue: When many event sources are configured (for example, 2000+), the

Event Source Management (ESM) user interface consumes lot of memory

on webstart (for example, 1GB) and also becomes unusable.

Fixed: The ESM user interface now works fine if there are many event

sources are configured.

527007 Issue: To turn on or off the data logging for all of the operating system

event sources and all of the Application collectors, a Data logging (All) On

and Off option is required for the APPLICATIONS and OS tables under the

Collection > Syslog Server tab.

Fixed: To turn on or off the data logging for all of the operating system

event sources and all of the Application collectors, a Data logging (All) On

and Off option is provided for the APPLICATIONS and OS tables under

the Collection > Syslog Server tab.

Issues Fixed Description

537273 Issue: Non-admin user is able to log in to the Event Source Management

interface by using a cached ESM jnlp file.

Fixed: Only authorized admin user can log in to the Event Source

Management interface.

536377 Issue: Lucene indexes are not being committed on a timely basis.

Fixed: Lucene indexes are now being committed on a timely basis - once a

minute.

535736 Issue: The Rule user interface does not perform the filter validation.

Fixed: The specified filter value is validated by the Rule user interface.

Issues Fixed Description

Inhaltsverzeichnis

Andere Novell Software Handbücher

Novell

Novell OPEN ENTERPRISE SERVER 2.0 SP2 - DOMAIN SERVICE FOR... Bedienungsanleitung

Novell

Novell APPARMOR - AND Technisches Handbuch

Novell

Novell CLIENT FOR LINUX 2.0 SP2 - 03-2009 Bedienungsanleitung

Novell

Novell LINUX ENTERPRISE DESKTOP 11 - ADMINISTRATION GUIDE... Kurzanleitung

Novell

Novell PLATESPIN ORCHESTRATE 2.0.2 - UPGARDE GUIDE... Installations- und Betriebshandbuch

Novell

Novell GROUPWISE 8 - TROUBLESHOOTING 3 Bedienungsanleitung

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - NETWORK DISCOVERY DATABASE... Kurzanleitung

Novell

Novell ZENWORKS NETWORK ACCESS CONTROL 5.0 - ... Bedienungsanleitung

Novell

Novell ZENWORKS APPLICATION VIRTUALIZATION 8.0.2 - INTEGRATION AND STREAMING GUIDE... Bedienungsanleitung

Novell

Novell POLICY IN DESIGNER 3.5 - 09-18-2009 Bedienungsanleitung

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - PREBOOT SERVICES AND IMAGING REFERENCE 10.3... Bedienungsanleitung

Novell

Novell LINUX ENTERPRISE DESKTOP 10 SP2 - KDE... Bedienungsanleitung

Novell

Novell OES 11 SP2 Bedienungsanleitung

Novell

Novell APPARMOR 2.1 - Bedienungsanleitung

Novell

Novell PLATESPIN PORTABILITY SUITE 8.1 Bedienungsanleitung

Novell

Novell GROUPWISE 7 - SECURITY POLICIES Bedienungsanleitung

Novell

Novell LINUX ENTERPRISE SERVER 10 SP2 - STORAGE ADMINISTRATION GUIDE... Bedienungsanleitung

Novell

Novell LINUX ENTERPRISE 10 SP1 - LINUX AUDIT Bedienungsanleitung

Novell

Novell LINUX ENTERPRISE DESKTOP 10 SP1 - START UP GUIDE... Bedienungsanleitung

Novell

Novell ZENWORKS APPLICATION VIRTUALIZATION 8.0.2 - INTEGRATION AND STREAMING GUIDE... Bedienungsanleitung

Novell

Novell ZENWORKS APPLICATION VIRTUALIZATION 8.0.1 -... Bedienungsanleitung

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - NETWORK DISCOVERY DATABASE... Kurzanleitung

Novell

Novell LINUX ENTERPRISE DESKTOP 11 - KDE Bedienungsanleitung

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - COMMAND LINE UTILITIES REFERENCE 10.3... Betriebsanleitung

Beliebte Software Handbücher anderer Marken

COMPRO

COMPRO COMPROFM Bedienungsanleitung

Muratec

Muratec OFFICEBRIDGE ONLINE Bedienungsanleitung

Oracle

Oracle Contact Center Anywhere 8.1 Bedienungsanleitung

Adobe

Adobe 65007312 - Photoshop Lightroom Handbuch

Avaya

Avaya NULL One-X for RIM Blackberry Bedienungsanleitung

HP ProLiant BL420c Bedienungsanleitung

PS Audio

PS Audio PowerPlay Betriebsanleitung

Brady

Brady LOCKOUT PRO 3.0 Service-Handbuch

Avaya

Avaya Interaction Center Bedienungsanleitung

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Handbuch

Oracle

Oracle Application 9i Bedienungsanleitung

Acer

Acer RDM Bedienungsanleitung

Canon

Canon Vixia HF21 Bedienungsanleitung

Canon

Canon ZR950 Bedienungsanleitung

Samsung

Samsung Auto Backup Bedienungsanleitung

Polycom

Polycom Vortex EF2201 Montage- und Bedienungsanleitung

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Bedienungsanleitung

Lexmark

Lexmark Apps Service-Handbuch