TIBCO LogLogic Log Management Intelligence (LMI) Release Notes

TIBCO LogLogic Log Management Intelligence (LMI) Release Notes Software Release 5.6.1 July 2015 Two-Second Advantage

Important Information SOME TIBCO SOFTWARE EMBEDS OR BUNDLES OTHER TIBCO SOFTWARE. USE OF SUCH EMBEDDED OR BUNDLED TIBCO SOFTWARE IS SOLELY TO ENABLE THE FUNCTIONALITY (OR PROVIDE LIMITED ADD-ON FUNCTIONALITY) OF THE LICENSED TIBCO SOFTWARE. THE EMBEDDED OR BUNDLED SOFTWARE IS NOT LICENSED TO BE USED OR ACCESSED BY ANY OTHER TIBCO SOFTWARE OR FOR ANY OTHER PURPOSE. USE OF TIBCO SOFTWARE AND THIS DOCUMENT IS SUBJECT TO THE TERMS AND CONDITIONS OF A LICENSE AGREEMENT FOUND IN EITHER A SEPARATELY EXECUTED SOFTWARE LICENSE AGREEMENT, OR, IF THERE IS NO SUCH SEPARATE AGREEMENT, THE CLICKWRAP END USER LICENSE AGREEMENT WHICH IS DISPLAYED DURING DOWNLOAD OR INSTALLATION OF THE SOFTWARE (AND WHICH IS DUPLICATED IN THE LICENSE FILE) OR IF THERE IS NO SUCH SOFTWARE LICENSE AGREEMENT OR CLICKWRAP END USER LICENSE AGREEMENT, THE LICENSE(S) LOCATED IN THE LICENSE FILE(S) OF THE SOFTWARE. USE OF THIS DOCUMENT IS SUBJECT TO THOSE TERMS AND CONDITIONS, AND YOUR USE HEREOF SHALL CONSTITUTE ACCEPTANCE OF AND AN AGREEMENT TO BE BOUND BY THE SAME. This document contains confidential information that is subject to U.S. and international copyright laws and treaties. No part of this document may be reproduced in any form without the written authorization of TIBCO Software Inc. TIBCO, Two-Second Advantage, and LogLogic are either registered trademarks or trademarks of TIBCO Software Inc. in the United States and/or other countries. All other product and company names and marks mentioned in this document are the property of their respective owners and are mentioned for identification purposes only. THIS SOFTWARE MAY BE AVAILABLE ON MULTIPLE OPERATING SYSTEMS. HOWEVER, NOT ALL OPERATING SYSTEM PLATFORMS FOR A SPECIFIC SOFTWARE VERSION ARE RELEASED AT THE SAME TIME. SEE THE README FILE FOR THE AVAILABILITY OF THIS SOFTWARE VERSION ON A SPECIFIC OPERATING SYSTEM PLATFORM. THIS DOCUMENT IS PROVIDED AS IS WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. THIS DOCUMENT COULD INCLUDE TECHNICAL INACCURACIES OR TYPOGRAPHICAL ERRORS. CHANGES ARE PERIODICALLY ADDED TO THE INFORMATION HEREIN; THESE CHANGES WILL BE INCORPORATED IN NEW EDITIONS OF THIS DOCUMENT. TIBCO SOFTWARE INC. MAY MAKE IMPROVEMENTS AND/OR CHANGES IN THE PRODUCT(S) AND/OR THE PROGRAM(S) DESCRIBED IN THIS DOCUMENT AT ANY TIME. THE CONTENTS OF THIS DOCUMENT MAY BE MODIFIED AND/OR QUALIFIED, DIRECTLY OR INDIRECTLY, BY OTHER DOCUMENTATION WHICH ACCOMPANIES THIS SOFTWARE, INCLUDING BUT NOT LIMITED TO ANY RELEASE NOTES AND "READ ME" FILES. Copyright 2002-2015 TIBCO Software Inc. ALL RIGHTS RESERVED. TIBCO Software Inc. Confidential Information

Contents 3 Contents Preface........................................................................ 5 Related Documentation..................................................................... 6 Typographical Conventions.................................................................. 8 Connecting with TIBCO Resources........................................................... 10 How to Join TIBCOmmunity............................................................. 10 How to Access TIBCO Documentation..................................................... 10 How to Contact TIBCO Support.......................................................... 10 Release Notes................................................................. 11 New Features............................................................................ 12 Changes in Functionality................................................................... 13 Deprecated and Removed Features.......................................................... 14 Deprecated Features.................................................................. 14 Removed Features.................................................................... 14 Migration and Compatibility................................................................. 15 Supported Platforms, Browsers, and Settings................................................... 17 Closed Issues........................................................................... 18 Hotfixes Incorporated.................................................................. 19 Known Issues............................................................................ 22

4 Contents

5 Preface LogLogic provides the industry's first enterprise class, end-to-end log management solution. Using LogLogic log management solutions, IT organizations can analyze and archive network log data for the purpose of compliance and legal protection, decision support for network security remediation, and increased network performance and improved availability. LogLogic log management Appliances simplify, automate, and reduce the cost of log data aggregation and retention, eliminating the need for servers, tape libraries, and archival administrators. If the network grows, simply rack and stack additional Appliances as needed. Topics Related Documentation, page 6 Typographical Conventions, page 8 Connecting with TIBCO Resources, page 10

6 Related Documentation Related Documentation This release includes the following documentation, available on the TIBCO Product Documentation website https://docs.tibco.com LogLogic Hardware Installation Guide Describes how to get started with the LogLogic Appliance, and includes details about the Appliance hardware. LogLogic Configuration and Upgrade Guide Describes how to configure and upgrade a LogLogic Appliance software. LogLogic Administration Guide Describes how to administer the LogLogic solution including managing users, managing log data storage, and managing new log sources (devices). LogLogic User Guide Describes how to use the LogLogic solution, including managing reports, managing alerts, and performing searches. LogLogic Enterprise Virtual Appliance Quick Start Guide Describes how to install the LogLogic Enterprise Virtual Appliance (EVA) in the VMware environment. LogLogic Log Source Configuration Guides Describe how to support log data from various log sources. There is a separate manual for each supported log source. These documents include documentation on LogLogic Collectors as well as documentation on how to configure log sources to work with the LogLogic solution. LogLogic Collector Guides Describe how to implement support for using a LogLogic Collector for specific log sources such as IBM i5/os and ISS SiteProtector. LogLogic Log Source Report Mapping Guide This guide provides a set of tables listing Log Source Reports by Device Type, sorted by UI Categories: Access Control, Database Activity, Enterprise Content Management, HP NonStop Audit, IBM i5/os Activity, Mail Activity, Network Activity, Operational, Policy Reports, Storage Systems Activity, and Threat Management. LogLogic Web Services API Implementation Guide Describes how to implement the LogLogic Web Services APIs to manage reports, manage alerts, perform searches, and administrate the system. LogLogic Syslog Alert Message Format Quick Reference Guide Describes the LogLogic Syslog alert message format. XML Import Guide Describes how to manually import, export, and edit XML files into and from the Appliance when not using the Appliance UI.

Preface 7 LogLogic Online Help Describes the Appliance user interface, including descriptions for each screen, tab, and element in the Appliance.

8 Typographical Conventions Typographical Conventions The following typographical conventions are used in this manual. Table 1 General Typographical Conventions Convention code font bold code font italic font Key combinations Use Code font identifies commands, code examples, filenames, pathnames, and output displayed in a command window. For example: Use MyCommand to start the foo process. Bold code font is used in the following ways: In procedures, to indicate what a user types. For example: Type admin. In large code samples, to indicate the parts of the sample that are of particular interest. In command syntax, to indicate the default parameter for a command. For example, if no parameter is specified, MyCommand is enabled: MyCommand [enable disable] Italic font is used in the following ways: To indicate a document title. For example: See TIBCO ActiveMatrix BusinessWorks Concepts. To introduce new terms For example: A portal page may contain several portlets. Portlets are mini-applications that run in a portal. To indicate a variable in a command or code syntax that you must replace. For example: MyCommand PathName Key name separated by a plus sign indicate keys pressed simultaneously. For example: Ctrl+C. Key names separated by a comma and space indicate keys pressed one after the other. For example: Esc, Ctrl+Q. The note icon indicates information that is of special interest or importance, for example, an additional action required only in certain circumstances. The tip icon indicates an idea that could be useful, for example, a way to apply the information provided in the current section to achieve a specific result.

Preface 9 Table 1 General Typographical Conventions (Cont d) Convention Use The warning icon indicates the potential for a damaging situation, for example, data loss or corruption if certain steps are taken or not taken.

10 Connecting with TIBCO Resources Connecting with TIBCO Resources How to Join TIBCOmmunity TIBCOmmunity is an online destination for TIBCO customers, partners, and resident experts. It is a place to share and access the collective experience of the TIBCO community. TIBCOmmunity offers forums, blogs, and access to a variety of resources. To register, go to http://www.tibcommunity.com. How to Access TIBCO Documentation You can access TIBCO documentation here: https://docs.tibco.com How to Contact TIBCO Support For comments or problems with this manual or the software it addresses, contact TIBCO Support as follows: For an overview of TIBCO Support, and information about getting started with TIBCO Support, visit this site: http://www.tibco.com/services/support If you already have a valid maintenance or support contract, visit this site: https://support.tibco.com Entry to this site requires a user name and password. If you do not have a user name, you can request one.

11 Release Notes Check the TIBCO Product Support web site at https://support.tibco.com for product information that was not available at release time. Entry to this site requires a username and password. If you do not have a username, you can request one. You must have a valid maintenance or support contract to use this site. Topics New Features, page 12 Changes in Functionality, page 13 Deprecated and Removed Features, page 14 Migration and Compatibility, page 15 Supported Platforms, Browsers, and Settings, page 17 Closed Issues, page 18 Known Issues, page 22

12 New Features New Features TIBCO LogLogic Release 5.6.1 contains the following improvements and updates since the previous feature release: Message Forwarding to LogLogic Unity An Appliance receiving messages from multiple sources can be configured to forward some or all of the messages to a LogLogic Unity platform based on one or more rules. The Event Distribution Client (EDC) allows for log data transfer from a LogLogic LMI platform to a TIBCO LogLogic Unity platform. The EDC remains in standby mode until a user creates a rule. Once a rule is created EDC applies the filters and starts sending events. IPv6 Support Management Station now works with LMIs using IPv6 addresses EVA supports archival to NFS volumes It is now possible to enable the archival function (NAS only) for EVA, thereby extending the storage capacity by up to 32 NAS volumes of arbitrary size. Local, non-archival storage continues to be governed by the incremental license up to 14.5 TB. TIBCO LogLogic Log Management Intelligence supports larger length for Regular Expression filtering on forwarding rules. The new maximum size is 4096 bytes. TIBCO LogLogic Log Management Intelligence now supports 8 Active Directory servers. TIBCO LogLogic Log Management Intelligence has been updated to use OpenJDK 1.8.0.

Release Notes 13 Changes in Functionality The following platforms and browsers are no longer supported: H3 Appliances Microsoft IE 9.x

14 Deprecated and Removed Features Deprecated and Removed Features Deprecated Features No features have been deprecated in TIBCO LogLogic Log Management Intelligence 5.6.1. Removed Features No features have been removed in TIBCO LogLogic Log Management Intelligence 5.6.1.

Release Notes 15 Migration and Compatibility TIBCO LogLogic Appliance Release 5.6.1 is a feature update to previous releases. Upgrading to Release 5.6.1 1. First upgrade to version 5.6.0. 2. Install version 5.6.1. Upgrading to Release 5.6.0 1. You can upgrade from Release 5.5.0 with HF3 or above and 5.5.1 with HF1or above to Release 5.6.0 using instructions in the LogLogic Configuration and Upgrade Guide, which is available for download from the TIBCO support website or the TIBCO Software Product Download Site. 2. After upgrading from 5.5.0 or 5.5.1 to 5.6.0 you must run the Post Upgrade Script rundbm which is under /loglogic/bin/directory. Upgrading to Release 5.6.0 from Previous Versions 1. If you are running a release prior to 5.3.0, you must first upgrade to Release 5.3.0, 5.3.1, 5.4, 5.4.1, or 5.4.2. 2. After upgrading run the Post Upgrade Script. If you do not run the Post Upgrade Script, you will lose some of the reports data. 3. Upgrade to Release 5.6.0. Table 2 LMI Upgrade Matrix LMI 5.4.0 5.4.1 5.4.2 5.5.0 5.5.1 5.6.0 5.6.1 5.4 5.4.1 5.4.2 5.5.0 5.5.1 5.6.0

16 Migration and Compatibility Table 3 LMI LSP Compatibility Matrix LSP 5.4.0 5.4.1 5.4.2 5.5.0 5.5.1 5.6.0 5.6.1 25 26 27 27.1 28 29

Release Notes 17 Supported Platforms, Browsers, and Settings This TIBCO LogLogic release supports specific LogLogic Appliance models, and can be used with supported web browsers on systems using the recommended display settings. Table 4 Supported Platforms for H4 Appliance Models LX Appliances ST Appliances MX Appliances LX825 ST1025 MX3025 LX1025 ST2025 SAN MX4025 LX4025 ST4025 Table 5 Supported Browsers Browser Version Google Chrome 23.x, 31.x, 41.x Microsoft Internet Explorer 10.x, 11.x Mozilla Firefox 3.6.x, 16.x, 25.x, 26.x, 36.x Table 6 Display Settings Monitor Recommended settings Minimum settings Display Resolution 1280 x 1024 pixels or higher 1024 x 768 pixels Colors 32-bit colors 16-bit colors

18 Closed Issues Closed Issues The following issues were fixed in this release: Key LLLM-2432 Summary Correct instructions are now provided for users to enable the execution of the Real Time Viewer in a java 8 client environment. LLLM-3090 It is now possible to re-import devices from another appliances after their names have been changed on the origin appliance. LLLM-3108 LLLM-3086 LLLM-3076 LLLM-3071 LLLM-3039 LLLM-3050 LLLM-3030 LLLM-3027 LLLM-3033 LLLM-3038 LLLM-3028 LLLM-3032 The Ldapsearch, rcp, and rlogin commands are now part of the LMI installation ST Appliances can now archive to Centera even if the authentication file is larger than 4K. Loglogic Message Signatures now works properly for EMS messages. The cli command unset net no longer shows extraneous interfaces named None. Bash has been updated to the lastest Oracle Linux 6.5 version for protection against the "Shellshock" attack. FTP and SCP file transfers success and failure are now reported consistently for z/os and RACF log sources. The web UI server, http collector, and uldp collector now all refuse client-initiated renegotiation. Security flaws in java-1.7.0-openjdk have been addressed by upgrading to Java-1.8.0-openjdk. Security flaws in openssl-1.0.1e have been addressed by upgrading to openssl-1.0.1m and using that version for all LMI's openssl needs. LLLM-3031 Cryptography downgrade attacks have been prevented by removing all support for sslv3 and export cipher from our ssl servers. LLLM-3021 The change in the default support for asymmetric routing since LMI 5.6.0 (and how to work around or re-enable it) is now documented.

Release Notes 19 Key LLLM-2985 LLLM-3024 LLLM-3011 LLLM-3019 LLLM-2882 LLLM-1570 Summary Oracle RAC log sources are now supported properly, up to version 12.0. The Message Pattern Editor now displays the forward slash (/) character correctly. Logs for the logapp device are now collected when data migration is being performed. The real-time viewer jar file is now signed, allowing it be executed by java 7 and later without a warning. Hotfixes Incorporated The following hotfixes were merged into this release: LMI 5.4.2 Hotfixes LMI 5.4.2-HF4 Key LLCE-702 LLCE-724 LLCE-735 Summary Due to multipath configuration in archivededicatedstoragepool, rebuild_stdatafiles did not work against SAN data. Message containing french characters did not match the Regex, even when the Regex was created using the initial message. On NAS the Index-Remove process write.locked index files and hung the remove and relocate processes. LMI 5.4.2-HF5 Key LLCE-1039 LLCE-1046 Summary Management Station user replication created corrupt alert entries in the admuseralert table. Applying HF4 for 5.4.2 broke the fix for LLCE-818.

20 Closed Issues Key LLCE-1048 LLCE-1054 LLCE-1121 Summary Management Station user replication created corrupt alert entries in the admuseralert table. Update for the HTTP/ULDP Collector for POODLE. Rebuild_stdatafiles did not work against SAN data due to multi-path configuration in archivededicatedstoragepool. LMI 5.5.0 Hotfixes 5.5.0-HF4 Key Summary LLCE-742 On NAS the Index-Remove process write.locked index files and hung the remove and relocate processes. LLCE-935 LLCE-975 LLCE-1029 LLCE-1031 LLCE-1032 LLCE-982 LLCE-1050 Phantom indexfiles pointers were deleted from MySql, even when they were within the index retention time. When the time zone was set to Asia/Calcutta, Scheduled Reports were duplicated. Rebuild_stdatafiles did not work against SAN data due to multi-path configuration in archivededicatedstoragepool. The forward slash (/) character in password caused authentication failure via web services. In 5.4.1, WSAPI did not use search expression Filters in index searches. Blue Coat configuration to a LogLogic appliance with TLS authentication for HTTPS continuous upload did not work. Update for HTTP/ULDP Collector - SSL FREAK/POODLE vulnerabilities.

Release Notes 21 LMI 5.5.1 Hotfixes 5.5.1-HF2 Key LLCE-1072 Summary Update for HTTP/ULDP Collector - SSL FREAK/POODLE vulnerabilities. LMI 5.6.0 Hotfixes 5.6.0-HF1 LLCE-1027 LLCE-1034 Update for HTTP/ULDP Collector - SSL FREAK/POODLE vulnerabilities. Index search failed with java.lang.stringindexoutofboundsexception when the time file had grown too large

22 Known Issues Known Issues The following issues are known to exist in the current release: Key LLLM-3106 LLLM-3098 LLLM-3171 Summary/Workaround Summary: Users experience problems accessing LMI, when using Chrome browser on MAC. Workaround: If having difficulty on MAC with Chrome browser for access to LMI, complete the following steps: 1. Click on Lock symbol pre-pended before the url for accessing the appliance. 2. Go to certificate information. 3. Click on logapp.cer (the certificate) and drag it to save location. 4. Now, from the saved location click on the certificate, and then right-click and choose option Open with Keychain access. 5. Now go to Certificates section and double click on logapp. 6. Select the Trust drop-down. 7. For the first option which is When using this certificate, select Always Trust. 8. Now you should be able to use this url to access LMI on a Chrome browser. Summary: When accessing and IPv4-based LMI appliance and then attempting to remotely control an IPv6-based LMI appliance, users are redirect to the login page. Workaround: When managing mixed (IPv4 and IPv6) appliances connect to Management Station using an IPv6 address. Summary: Management Center (including upgrade) is temporarily unsupported. Workaround:None

Release Notes 23 Key LLLM-3172 LLLM-1817 LLLM-1816 LLLM-1790 LLLM-1660 Summary/Workaround Summary: LMI routing stops sending messages to LogLogic Unity when the distributed member data node crashes. Workaround: If LMI stops routing messages to your LogLogic Unity, complete the following steps: 1. Make sure that both the LogLogic Unity Event Distributor and Data Nodes are up and running. 2. On LMI delete your LogLogic Unity forwarding rule. 3. Recreate your LogLogic Unity forwarding rule. Summary: Setting up encrypted forwarding via LLTCP or TCP syslog causes the root account key of the source appliance to become authorized by the destination appliance. Resulting in the password-less ssh access by root from source appliance to destination, in addition to allowing log forwarding. Workaround: None Summary: EVA product comes out of the box with a default SSH signature. This signature should be changed to maintain proper security measures once installation is complete. Workaround: None Summary: Distributed regex searches are cancelled by LMI if they execute for more than 5 minutes on Management Stations. Workaround: Contact Support for the workaround. Summary: Greek characters within usernames cause LDAP authentication to fail. Workaround: None LLLM-1713 Summary: Can not collect the logs forwarded by UC when domain have 256 characters. Workaround: None LLLM-2376 LLLM-2699 Summary: Three failures are reported from the OEL65 init scripts. These messages do not indicate any malfunction. The services which do not start are either already started or unnecessary. Workaround: None Summary: Unable to export 100k devices using the export feature. Workaround: Export less than 60K devices at a time.

24 Known Issues Key LLLM-2548 LLLM-2783 LLLM-2853 LLLM-2881 Summary/Workaround Summary: Depending on the type of model, importing large numbers of devices can take some time (hours). Workaround: None Summary: An error is displayed when the User Last Activity PCI report is run. Workaround: Edit the report, run it and resave it. Summary: GUI cannot redirect to login page after restore if eth0 is configured with default IP 10.0.0.11 and IPv6 is configured on any other NIC. Workaround: Unset the default eth0 configuration or configure eth0 with real network information. Summary: SNMP of upgraded appliance does not work on IPv6. Works for fresh install. Workaround: To make SNMP work on IPv6, the snmpd.conf file (located in /loglogic/update) needs to be appended with the lines given below for LX and ST appliances. For LX: agentaddress udp:161,udp6:161 rocommunity6 public default For ST: agentaddress udp:161,udp6:161 rocommunity6 public default If the community string for IPv6 used is not public then that string needs to be replaced in these lines. For example, for IPv4 if the existing community string is LOGLOGIC then the corresponding entry in the snmpd.conf will be: rocommunity LOGLOGIC Replace the string:rocommunity6 public default with rocommunity6 LOGLOGIC default

Release Notes 25 Key LLLM-3098 Summary/Workaround Summary: When accessing and IPv4 LMI and then remote controlling to an IPv6 Remote Appliance, users are redirect to the login page. Workaround: When managing mixed (IPv4 and IPv6) appliances connect to Management Station using an IPv6 address.

26 Known Issues