TIBCO LogLogic LX 820 How to use

TIBCO LogLogic®

Log Management Intelligence (LMI)

Release Notes

Software Release 5.4.1

September 2013

Two-Second Advantage®

Important Information

SOME TIBCO SOFTWARE EMBEDS OR BUNDLES OTHER TIBCO SOFTWARE. USE OF SUCH EMBEDDED OR BUNDLED

TIBCO SOFTWARE IS SOLELY TO ENABLE THE FUNCTIONALITY (OR PROVIDE LIMITED ADD-ON FUNCTIONALITY) OF

THE LICENSED TIBCO SOFTWARE. THE EMBEDDED OR BUNDLED SOFTWARE IS NOT LICENSED TO BE USED OR

ACCESSED BY ANY OTHER TIBCO SOFTWARE OR FOR ANY OTHER PURPOSE.

USE OF TIBCO SOFTWARE AND THIS DOCUMENT IS SUBJECT TO THE TERMS AND CONDITIONS OF A LICENSE

AGREEMENT FOUND IN EITHER A SEPARATELY EXECUTED SOFTWARE LICENSE AGREEMENT, OR, IF THERE IS NO

SUCH SEPARATE AGREEMENT, THE CLICKWRAP END USER LICENSE AGREEMENT WHICH IS DISPLAYED DURING

DOWNLOAD OR INSTALLATION OF THE SOFTWARE (AND WHICH IS DUPLICATED IN THE LICENSE FILE) OR IF THERE

IS NO SUCH SOFTWARE LICENSE AGREEMENT OR CLICKWRAP END USER LICENSE AGREEMENT, THE LICENSE(S)

LOCATED IN THE “LICENSE” FILE(S) OF THE SOFTWARE. USE OF THIS DOCUMENT IS SUBJECT TO THOSE TERMS AND

CONDITIONS, AND YOUR USE HEREOF SHALL CONSTITUTE ACCEPTANCE OF AND AN AGREEMENT TO BE BOUND BY

THE SAME.

This document contains confidential information that is subject to U.S. and international copyright laws and treaties. No part of this

document may be reproduced in any form without the written authorization of TIBCO Software Inc.

TIBCO, Two-Second Advantage, and LogLogic are either registered trademarks or trademarks of TIBCO Software Inc. in the United

States and/or other countries.

All other product and company names and marks mentioned in this document are the property of their respective owners and are

mentioned for identification purposes only.

THIS SOFTWARE MAY BE AVAILABLE ON MULTIPLE OPERATING SYSTEMS. HOWEVER, NOT ALL OPERATING SYSTEM

PLATFORMS FOR A SPECIFIC SOFTWARE VERSION ARE RELEASED AT THE SAME TIME. SEE THE README FILE FOR THE

AVAILABILITY OF THIS SOFTWARE VERSION ON A SPECIFIC OPERATING SYSTEM PLATFORM.

THIS DOCUMENT IS PROVIDED “AS IS” WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED,

INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR

PURPOSE, OR NON-INFRINGEMENT.

THIS DOCUMENT COULD INCLUDE TECHNICAL INACCURACIES OR TYPOGRAPHICAL ERRORS. CHANGES ARE

PERIODICALLY ADDED TO THE INFORMATION HEREIN; THESE CHANGES WILL BE INCORPORATED IN NEW EDITIONS

OF THIS DOCUMENT. TIBCO SOFTWARE INC. MAY MAKE IMPROVEMENTS AND/OR CHANGES IN THE PRODUCT(S)

AND/OR THE PROGRAM(S) DESCRIBED IN THIS DOCUMENT AT ANY TIME.

THE CONTENTS OF THIS DOCUMENT MAY BE MODIFIED AND/OR QUALIFIED, DIRECTLY OR INDIRECTLY, BY OTHER

DOCUMENTATION WHICH ACCOMPANIES THIS SOFTWARE, INCLUDING BUT NOT LIMITED TO ANY RELEASE NOTES

AND "READ ME" FILES.

TIBCO Software Inc. Confidential Information

LogLogic® Appliance Release 5.4.1 is a maintenance update to previous releases.

You can upgrade to Release 5.4.1 directly from Release 5.2, 5.3, 5.3.1 and 5.4 using

instructions in the LogLogic Configuration and Upgrade Guide, which is included with the

Supplemental CD, or available for download from the TIBCO support website or the

TIBCO Software Product Download Site. .

Before updating your Appliance software, please read these Release Notes to learn:

What’s New in Release 5.4.1

Supported Platforms, Browsers, and Settings

LogLogic Documentation

Fixed Issues

Previous Known Issues

TIBCO LogLogic Support

Table 1 LMI Upgrade Matrix

LMI 5.1.x 5.2 5.3 5.3.1 5.4 5.4.1

4.9.1 

5.0 

5.1.x 

5.2 

5.3 

5.3.1 

5.4 

Table 2 LMI – LSP Compatibility Matrix

LSP 5.1.x 5.2 5.3 5.3.1 5.4 5.4.1



21 

22 

23 

24 

25 

26 

What’s New in Release 5.4.1

LogLogic Release 5.4.1 contains the following noteworthy improvements and updates

since the previous feature release:

H4 Support

The new 4th generation TIBCO LogLogic Appliances (H4) come with an embedded SD

card that contains an image of the Appliance software. This new hardware feature

facilitates re-imaging the Appliance in case of critical hardware or software failure.

Changes in Functionality

User Privileges

Management Station privilege: the Access Management Station privilege name has

been changed to View Management Station Status.

Custom Report privilege: previously Access Custom Reports, Add/Modify/Delete

Custom Reports, Run/Schedule Custom Report could be checked separately. With

release 5.4.1 the Access Custom Reports privilege controls the other two privileges.

Multiple Concurrent Logins

Users can only log into one session at a time. If a user is logged in and then opens up a

new session the first session will be closed. When the user tries to click on anything in

the first session the page will redirect him to the login page with the following message

“Your login session is already opened at some other place”.

Supported Platforms, Browsers, and Settings

This LogLogic release supports specific LogLogic Appliance models, and can be used

with supported web browsers on systems using the recommended display settings.

Table 3 Supported Platforms for H3 Appliances

LX Appliances ST Appliances MX Appliances

LX 820 ST 1020 MX 3020

LX 1020 ST 2020-SAN MX 4020

LX 4020 ST 4020

Note: The use of advanced features on the second-generation

hardware Appliances may cause performance degradation.

LogLogic Documentation

This release includes the following documentation, available both on the LogLogic

Customer Support website and on the Solutions CD that ships with the Appliance:

LogLogic Hardware Installation Guide—Describes how to get started with the

LogLogic Appliance, and includes details about the Appliance hardware.

LogLogic Configuration and Upgrade Guide—Describes how to configure and upgrade a

LogLogic Appliance software.

LogLogic Administration Guide—Describes how to administer the LogLogic solution

including managing users, managing log data storage, and managing new log sources

(devices).

LogLogic Management Appliance Guide—Describes how to manage multiple

distributed Appliances using the LogLogic Management Appliance.

LogLogic User Guide—Describes how to use the LogLogic solution, including managing

reports, managing alerts, and performing searches.

LogLogic Enterprise Virtual Appliance Quick Start Guide—Describes how to install

the LogLogic Enterprise Virtual Appliance (EVA) in the VMware environment.

LogLogic Log Source Configuration Guides—Describe how to support log data from

various log sources. There is a separate manual for each supported log source. These

documents include documentation on LogLogic Collectors as well as documentation

on how to configure log sources to work with the LogLogic solution.

Table 4 Supported Platforms for H4 Appliance Models

LX Appliances ST Appliances MX Appliances

LX 825 ST 1025 MX 3025

LX 1025 ST 2025-SAN MX 4025

LX 4025 ST 4025

Note: The use of advanced features on the second-generation

hardware Appliances may cause performance degradation.

Table 5 Supported Browsers

Browser Version

Google Chrome 14.x

Microsoft Internet Explorer 7.x, 8.x

Mozilla Firefox 3.6.x

Table 6 Display Settings

Monitor Recommended settings Minimum settings

Display Resolution 1280 x 1024 pixels or higher 1024 x 768 pixels

Colors 32-bit colors 16-bit colors

LogLogic Documentation

LogLogic Collector Guides—Describe how to implement support for using a LogLogic

Collector for specific log sources such as IBM i5/OS and ISS SiteProtector.

LogLogic Log Source Report Mapping Guidebook—This guide provides a set of tables

listing Log Source Reports by Device Type, sorted by UI Categories: Access Control,

Database Activity, Enterprise Content Management, HP NonStop Audit, IBM i5/OS

Activity, Mail Activity, Network Activity, Operational, Policy Reports, Storage Systems

Activity, and Threat Management.

LogLogic Web Services API Implementation Guide —Describes how to implement the

LogLogic Web Services APIs to manage reports, manage alerts, perform searches, and

administrate the system.

LogLogic Syslog Alert Message Format Quick Reference Guide—Describes the

LogLogic Syslog alert message format.

XML Import Guide—Describes how to manually import, export, and edit XML files

into and from the Appliance when not using the Appliance UI.

LogLogic Online Help—Describes the Appliance user interface, including descriptions

for each screen, tab, and element in the Appliance.

Fixed Issues

The following are the most significant issues resolved in Release 5.4.1:

Files not deleted after the retention period expires. (LLLM-428)

Message-routing transferred file to rsyslog resulted in only a portion of the log

messages being sent. (LLLM-631)

Inconsistent data with index reports. (LLLM-661)

Unable to validate any message after successfully creating a message signature.

(LLLM-680)

User Creation/Deletion events do not show up in Windows 2008 reports. (LLLM-681)

Incorrect auto-identification of LogLogic device as Cisco ASA causes LX Parser to

crash. (LLLM-682)

Unable to drill down on the PCI: Cisco PIX, ASA, FWSM Policy Changed report in

Compliance Manager. (LLLM-693)

Emailed scheduled RegEx search result can only be seen by the user who owns the

Search filter, but not other email recipients. (LLLM-701)

User privileges not working as expected. (LLLM-705)

Update of an user's email in LogApp Account Setting was not reflected in the Address

Book for scheduled reports and saved searches. (LLLM-709)

Management Station menu option disappeared under Management after upgrading to

version 5.4. (LLLM-710)

Inconsistent data with index reports in LMI 5.3.1. (LLLM-713)

LMI tutorial link on the home page got redirected to an irrelevant web page.

(LLLM-741)

Web server displayed version information in the web page content. (LLLM-759)

Web server allowed sensitive HTTPS responses to be cached in the browser.

(LLLM-761)

Cookie issued by the application did not have the HttpOnly flag set. (LLLM-762)

Missing batch file for running R8_RunSearchReportIterate.java sample report through

WSAPI. (LLLM-769)

Account status was revealed in the response after a failed login attempt to lockout

accounts. (LLLM-770)

Unable to add more than two records when adding static routes using the Batch Add

option. (LLLM-774)

Archiving to Centera on ST was very slow. (LLLM-782)

Engine-archive failed to archive index files. (LLLM-783)

The saved report from index search associated with multiple devices was displayed as

blank screen. (LLLM-784)

Archive Watermark could not be set to zero for NAS storage on ST2020-SAN.

(LLLM-785)

Engine_raid failed to format new drive. (LLLM-786)

Previous Known Issues

This list includes known issues that exist in the current release:

Formatted Forwarding

Display issues with Firefox browsers older than 3.6.8. (29817)

Forwarding User Defined Types

All Syslog Sources will no longer be selectable from Message Routing Log Source

Picker. (29710)

Security – "All Syslog Sources"

Only users with "Access all devices" privilege should be given the "Message Routing

Configuration" privilege.

Prior to Release 5.3, LMI allows forwarding messages from devices in the All Syslog

Sources group even when the user creating the rule has not been given access to the

specific devices in the group. This is a potential security breach because it allows a user

without specific device privileges to forward messages from that device. This potential

security issue has been fixed in Release 5.3.

New Behavior: A message routing rule using the All Syslog Sources group from

previous versions of LMI will be migrated when upgrading to Release 5.3. The

migrated rule will continue to work in Release 5.3. It will appear in the list of selected

log sources as “All Syslog Sources” in the Message Routing Log Source Picker.

To protect against this potential security breach the administrator must delete the All

Syslog Sources group from the routing rule and replace it with the appropriate All

DeviceType X groups represented by All Syslog Sources.

The All Syslog Sources group represents all devices whose messages are received via

the network. These device types have the collection type of Network as seen on the

Manage Device Types page.

To replace All Syslog Sources include every All DeviceType X group for all of the

device types that have the collection type of Network.

User Defined Groups

Message Routing: The available options could be different when selecting log sources

from a user-defined Group containing mixed log types. (31205)

When creating a Message Routing rule that includes mixed log types from a

user-defined Group, the available options such as Protocols and Settings can be

different compared to a rule that contains only a single log type.

Message Routing: LMI does not support sending duplicate logs to the same

destination IP using different rules when the same protocol is selected even with

different destination ports. (31206)

Workaround: If the user wants to send the same set of data twice to the same

destination using two different rules, he/she must use different protocols for each rule.

Previous Known Issues

Selecting A Large Number of Log Sources

Log Source Picker: To avoid problems when adding a large number of devices, use the

options listed below. (31216)

Option 1: When creating a Message Routing rule for a large number of devices of the

same log type, use the system-defined Group option.

After entering the name of an Outbound Message Routing rule, go to the next page

1) Filter by Name, enter All*

2) Select one or more Groups as long as they are the same log type

3) Click “Add selected log sources”

Option 2: Choose user-defined Group when selecting particular devices.

1) Create a user-defined Group and select the devices that you want to add to the

Message Routing rule

2) Create a Message Routing rule and enter any name; go to the next page

3) Filter by Type

4) Select the log type that you added in the user-defined Group

5) That user-defined Group will be displayed on the right panel

6) Select that user-defined Group

7) Click “Add selected log sources”

Option 3: For Log Source picker in Report and Index Search

Go to the Log Source Picker widget

1) Filter by Type or Name to retrieve the list of devices

2) Click on "Add filters as rule..." button

3) It will create a dynamic rule which contains all listed devices on the right panel

Clear Log Data

Cluster membership keeps failing and the UI throws exceptions repeatedly during

clear log data. (23836)

If the Appliance accumulates a significant amount of data, Clear Log Data

(Administration > Clear Log Data) will temporarily lock up the MySQL server for an

extended period of time, potentially causing some background tasks in the Appliance

that accesses the MySQL database to fail. This may cause erroneous log entries to be

added to sys.log. This is expected behavior, and will not affect the action of Clear Log

Data or any Appliance functions after the completion of Clear Log Data.

Browser

Using the browser Back button in IE 8 can cause errors in the Device Management

interface. The error does not occur in Firefox. (25323)

Browser may hang during running reports or index search with configuration of 1000

rows per page. (26108)

Workaround: Set the rows per page to a lower number.

Previous Known Issues

Enterprise Virtual Appliance

VMware's Workstation 8 on Windows platform cannot display the EULA page

correctly. (31187)

Workaround: Use the command line tool, ovftool, to import the EVA OVA package.

The ovftool binary comes with WorkStation installation and can be found in

C:\Program Files (x86)\VMware\VMware Workstation\OVFTool\ovftool.exe, or

other Workstation installation path. The Windows command "ovftool.exe

eva_package_name.ova virtual\machines\dir\target_eva_machine_name.vmx" can

deploy the EVA OVA package to WorkStation 8 on Windows.

GUI

HTTP error - 500 (Please contact your Admin) occurs when showing Timeline during

searching a large amount of data. (18110)

This issue does not occur if checking the Show Timeline before or after running the

search; it occurs only when checking the Timeline check box while searching a large

amount of data.

Following an index search, the Next Page button and the Last Page button appear,

even when there is only one page of data returned. After clicking the Last Page button,

"Page request is out of range" overlay window will display. Upon clicking the Previous

Page button, the returned Index Search results disappear. (28342)

Workaround: Click OK when "Page request is out of range" overlay window displays,

and the previous index search results will return.

Management Station

When using Management Station, messages from a specific MX or LX Appliance may

not be included in the detailed report when All LX/MX is selected in "Appliance".

(30028)

Devices with the same name from different Appliances have different device IDs. In

aggregating summary results, only one device ID is kept. When this ID is later used to

get drill-down results, only one Appliance can contain this ID, so drill-down results

contain logs from only one Appliance.

Performance

Slow performance when running the detailed Network Activity - Application

Distribution. (31059)

When the “Enable Accept Detail” is turned on, LMI will begin aggregation starting

with the oldest data collected. The reports will take a longer time to generate while the

aggregator is “catching up”. The amount of time is dependent on: 1) the amount of

un-aggregated data collected prior to enabling Accept Detail and 2) the current

collection rate. Once the aggregator has caught up reports should appear more quickly.

Index Report

Drill-down on index report results does not work when more than 16 devices are

selected. (29746)

Workaround: Select fewer devices, or create a device group to include all devices

needed.

This manual suits for next models

Table of contents

Other TIBCO Network Hardware manuals

TIBCO

TIBCO LogLogic LX series Manual

Popular Network Hardware manuals by other brands

Matrix Switch Corporation

Matrix Switch Corporation MSC-HD161DEL product manual

B&B Electronics

B&B Electronics ZXT9-IO-222R2 product manual

Yudor

Yudor YDS-16 user manual

D-Link

D-Link ShareCenter DNS-320L datasheet

Samsung

Samsung ES1642dc Hardware user manual

Honeywell Home

Honeywell Home LTEM-PV Installation and setup guide

evertz

evertz 7700 Series manual

D-Link

D-Link ShareCenter DNS-343 Quick installation guide

Asante

Asante AsanteBridge 1012 user guide

FireBrick

FireBrick FB2700 user manual

Audiovox Electronics

Audiovox Electronics ARWH2T user manual

ADC

ADC DSX-1 Operational Procedures Guide

NetComm

NetComm NF2 user guide

Alcatel-Lucent

Alcatel-Lucent 5620 user guide

Dell EMC

Dell EMC XC6420 Series Solution guide

Lanner

Lanner NCA-1020A user manual

Allied Telesis

Allied Telesis AT-TN121-A Specifications

Arista

Arista CCA-ETM-Q12 quick start guide