Novell SENTINEL LOG MANAGER 1.0.0.4

Novell Sentinel Log Manager 1.0.0.4 Release Notes 1

novdocx (en) 22 June 2009

Novell®

Novell Sentinel Log Manager 1.0.0.4

Release Notes

February 08, 2010

Novell®SentinelTM Log Manager collects data from a wide variety of devices and applications,

including intrusion detection systems, firewalls, operating systems, routers, Web servers, databases,

switches, mainframes, and antivirus event sources. Novell Sentinel Log Manager provides high

event-rate processing, long-term data retention, regional data aggregation, and simple searching and

reporting functionality for a broad range of applications and devices.

Section 1, “What's New in Novell Sentinel Log Manager,” on page 1

Section 2, “System Requirements,” on page 5

Section 3, “Prerequisite,” on page 5

Section 4, “Installation,” on page 5

Section 5, “Issues Fixed,” on page 7

Section 6, “Known Issues,” on page 14

Section 7, “Documentation Conventions,” on page 18

Section 8, “Legal Notices,” on page 18

1 What's New in Novell Sentinel Log Manager

The following sections list the new and enhanced features of Novell Sentinel Log Manager.

Section 1.1, “What’s New in Novell Sentinel Log Manager 1.0.0.4,” on page 1

Section 1.2, “Novell Sentinel Log Manager 1.0 Features,” on page 3

Section 1.3, “New Plug-Ins,” on page 5

1.1 What’s New in Novell Sentinel Log Manager 1.0.0.4

“New Data Collection User Interface” on page 1

“LDAP Authentication” on page 2

“Enhancements to the Search Result User Interface” on page 2

“New User Interface for Actions” on page 2

“Enhancement to the Admin User Interface” on page 2

1.1.1 New Data Collection User Interface

The new and enhanced data collection user interface enables you to perform several new tasks:

Refine all the event sources by using the new Event Sources screen.

2Novell Sentinel Log Manager 1.0.0.4 Release Notes

novdocx (en) 22 June 2009

Start and stop the audit and syslog event source server by using the new Event Source Servers

tab.

Set the time zone for event sources.

Search for events that are coming from one or many event sources.

For more information about data collection configuration, see “Configuring Data Collection” in the

Novell Sentinel Log Manager 1.0.0.4 Administration Guide.

1.1.2 LDAP Authentication

Sentinel Log Manager now supports LDAP authentication in addition to the database authentication.

A new Authentication Type option has been added in the user > Add a user window of the Sentinel

Log Manager, which enables you to create user accounts that use LDAP authentication.

For more information about configuring the Sentinel Log Manager server for LDAP authentication,

see “User Administration” in the Novell Sentinel Log Manager 1.0.0.4 Administration Guide.

1.1.3 Enhancements to the Search Result User Interface

The enhanced search result interface enables you to perform several new tasks:

Export search report results.

Send search results to an action.

Download the raw data files for the selected event result's event source by using the get raw

data link.

View new event fields information in the search results.

For example, it displays the Source IP address, Rawdata Record ID, Collector Script, Collector

name, Collector Manager ID, Connector ID, and Event Source ID information for the incoming

events.

View all the event fields information for the event source by using the show all fields link.

For more information about searching events and generating reports, see “Searching” in the Novell

Sentinel Log Manager 1.0.0.4 Administration Guide.

1.1.4 New User Interface for Actions

The new user interface for actions allows you to create multiple action instances that you can also

use while configuring rules. You can also view the number of rules that are associated with an

action.

For more information about configuring rules and actions, see “Configuring Rules” in the Novell

Sentinel Log Manager 1.0.0.4 Administration Guide.

1.1.5 Enhancement to the Admin User Interface

The new admin user interface enables you to assign new permissions for a user:

You can now allow users to view all reports that are stored on the server

Enable Sentinel Log Manager configuration reporting

You can now set a filter for the events a user can view.

Novell Sentinel Log Manager 1.0.0.4 Release Notes 3

novdocx (en) 22 June 2009

For more information about configuring users, see “User Administration” in the Novell Sentinel Log

Manager 1.0.0.4 Administration Guide.

1.2 Novell Sentinel Log Manager 1.0 Features

“Installation and Deployment” on page 3

“Data Collection” on page 3

“Data Storage and Management” on page 4

“Reporting and Searching” on page 4

“Architecture Options” on page 5

1.2.1 Installation and Deployment

Novell Sentinel Log Manager is easy to install and deploy for data collection, storage, reporting, and

searching of log data. Installation of Novell Sentinel Log Manager includes installation of the

Sentinel Log Manager server, Web server, reporting server, and configuration database.

1.2.2 Data Collection

Novell Sentinel Log Manager can collect and manage data from event sources that generate logs to

syslog, windows event log, files, databases, SNMP, Novell Audit, SDEE, Check Point OPSEC, and

other storage mechanisms and protocols.

Novell Sentinel Log Manager contains enhanced web-based user interface support for Syslog and

Novell Audit connectivity to make it even easier to start collecting logs from event sources. You can

direct all the logs to Sentinel Log Manager.

Messages from recognized data sources are parsed into fields such as target IP address and source

username. Messages from unrecognized data sources are placed intact into a single field for storage,

search, and reporting. All data can be filtered to drop unwanted events.

For a complete list of supported event sources, see “Supported Event Sources” (http://

www.novell.com/documentation/novelllogmanager10/novell_log_manager/data/bhmwq0w.html) in

the Novell Sentinel Log Manager Guide.

Novell Sentinel Log Manager collects data using a wide variety of connection methods:

Syslog Connector automatically accepts and configures syslog data sources that send data over

the standard user datagram protocol (UDP), reliable transmission control protocol (TCP), or

secure transport layer system (TLS).

Audit Connector automatically accepts and configures audit-enabled Novell data sources.

File Connector reads log files.

SNMP Connector receives SNMP traps.

JDBC* Connector reads from database tables.

WMS Connector accesses Windows* event logs on desktops and servers.

SDEE Connector for Cisco* devices.

LEA Connector for Check Point* devices.

4Novell Sentinel Log Manager 1.0.0.4 Release Notes

novdocx (en) 22 June 2009

Sentinel Link Connector accepts data from other Novell Sentinel Log Manager servers.

Process Connector accepts data from custom-written processes that output event logs.

You can also purchase an additional license to download connectors for SAP* and mainframe

operating systems.

To get the license, either call 1-800-529-3400 or contact Novell Technical Support (http://

support.novell.com).

For more information about configuring the connectors, see the connector documents at Sentinel

Content Web site (http://support.novell.com/products/sentinel/sentinel61.html).

For more information about data collection configuration, see “Configuring Data Collection” (http:/

/www.novell.com/documentation/novelllogmanager10/novell_log_manager/data/bjxe7z1.html) in

the Novell Sentinel Log Manager Guide.

1.2.3 Data Storage and Management

Novell Sentinel Log Manager stores all of the log data in a compressed file format. Data can be

archived locally or on a remotely-mounted CIFS or NFS share. You can set up data retention

policies to configure the system to keep some data for longer time periods and other data for shorter

time periods.

For more information about system requirements, see “System Requirements” (http://

www.novell.com/documentation/novelllogmanager10/novell_log_manager/data/bjx8zq7.html) in

the Novell Sentinel Log Manager Guide.

For more information about data storage configuration, see “Configuring Data Storage” (http://

www.novell.com/documentation/novelllogmanager10/novell_log_manager/data/bjxe7z1.html) in

the Novell Sentinel Log Manager Guide.

1.2.4 Reporting and Searching

Novell Sentinel Log Manager can perform full text searches of all the stored event data or perform

focused searches against particular event fields, such as source username. Such searches can be

further refined, saved for future review, filtered, and formatted by applying a report template to the

results.

Sentinel Log Manager has pre-installed reports and also has the ability to upload additional reports.

Reports can be run as per a planned scheduled or for an unplanned requirement.

For more information on list of default reports, see “Sentinel Log Manager Reports” (http://

www.novell.com/documentation/novelllogmanager10/novell_log_manager/data/bl5jfoz.html) in the

Novell Sentinel Log Manager Guide.

Searches and reports can run against both online and archived data.

For more information about searching events and generating reports, see “Searching” (http://

www.novell.com/documentation/novelllogmanager10/novell_log_manager/data/bk76y16.html) and

“Reporting” (http://www.novell.com/documentation/novelllogmanager10/novell_log_manager/

data/bjxdi87.html) respectively in the Novell Sentinel Log Manager Guide.

Novell Sentinel Log Manager 1.0.0.4 Release Notes 5

novdocx (en) 22 June 2009

1.2.5 Architecture Options

Collector managers for Sentinel Log Manager manage all of the data collection processes and data

parsing. A Collector Manager is included in the Sentinel Log Manager server installation, but you

can also install multiple collector managers throughout your enterprise. Remote collector managers

provide several benefits:

Distributed event parsing and processing to improve system performance.

Co-location with event sources, which allows filtering, encryption, and data compression at the

source. This can provide additional data security and decrease network bandwidth

requirements.

Installation on additional operating systems (for example, installation on Microsoft*

Windows* to enable data collection using the WMI protocol).

File caching, which enables the remote collector manager to cache large amounts of data while

the server is temporarily busy performing archiving or processing a spike in events. This is an

advantage for protocols, such as syslog, that do not natively support event caching.

Sentinel Link can be used to forward event data from one Sentinel Log Manager to another. With a

hierarchical set of Sentinel Log Managers, complete logs can be retained at multiple regional

locations while more important events are forwarded to a single Sentinel Log Manager for

centralized search and reporting.

In addition, Sentinel Link can forward important events to Novell Sentinel, a full Security

Information Event Management (SIEM) system, for advanced correlation, incident remediation, and

injection of high-value contextual information such as server criticality or identity information from

an identity management system.

1.3 New Plug-Ins

A new Generic Forwarder Action 6.1r2 plug-in has been added to send search results to an action

instance.

2 System Requirements

For a detailed information on hardware requirements and supported operating systems, browsers,

and event sources, see “System Requirements” (http://www.novell.com/documentation/

novelllogmanager10/novell_log_manager/data/bjx8zq7.html) in the Novell Sentinel Log Manager

Guide.

3 Prerequisite

The Sentinel Log Manager Hot fix 4 (1.0.0.4) should be installed on top of an existing Sentinel Log

Manager 1.0.0.0 or 1.0.0.1 or 1.0.0.2 or 1.0.0.3 installation.

4 Installation

IMPORTANT: The Sentinel Log Manager Hot fix 4 (1.0.0.4) must be installed on the Sentinel Log

Manager server and all the Collector Managers running on remote machines. This hotfix does not

update the Collector Manager installer script that you can download from the Sentinel Log Manager

6Novell Sentinel Log Manager 1.0.0.4 Release Notes

novdocx (en) 22 June 2009

web server. Hence, regardless of whether you have installed a Collector Manager before or after

applying the hotfix on the Sentinel Log Manager server, it is mandatory to apply this hotfix to all the

Collector Managers.

Section 4.1, “On a Sentinel Log Manager Server,” on page 6

Section 4.2, “On a Remote Collector Manager,” on page 6

4.1 On a Sentinel Log Manager Server

To perform a quick and simple installation of Novell Sentinel Log Manager 1.0.0.4 on a Sentinel

Log Manager server:

1Log in to the Sentinel Log Manager as the

novell

user.

The

novell

user is created during the Sentinel Log Manager installation process and does not

have a password by default. Therefore, you can create a password in order to log in as this user,

or you can su - to this user.

2Download or copy the installer

SENTINEL_LOG_MANAGER_1.0.0.4.zip

to a temporary

directory.

3Change to the temporary directory.

4Unzip the install package by using the following command:

unzip SENTINEL_LOG_MANAGER_1.0.0.4.zip

5Change to the unzipped directory.

cd SENTINEL_LOG_MANAGER_1.0.0.4

6(Optional) Stop the Sentinel Log Manager services by using the following command:

Installation_Directory/bin/server.sh stop

7Run the hotfix installer and follow the prompts.

./service_pack.sh

4.2 On a Remote Collector Manager

“Installing on Unix” on page 6

“Installing on Windows” on page 7

4.2.1 Installing on Unix

1Log in to the Sentinel Log Manager as the

root

user.

2Download or copy the installer

SENTINEL_LOG_MANAGER_1.0.0.4.zip

to a temporary

directory.

3Change to the temporary directory.

4Unzip the install package by using the following command:

unzip SENTINEL_LOG_MANAGER_1.0.0.4.zip

5Change to the unzipped directory.

cd SENTINEL_LOG_MANAGER_1.0.0.4

6(Optional) Stop the Collector Manager by using the following command:

Installation_Directory/bin/sentinel.sh stop

Novell Sentinel Log Manager 1.0.0.4 Release Notes 7

novdocx (en) 22 June 2009

7Run the hotfix installer and follow the prompts.

./service_pack.sh

4.2.2 Installing on Windows

1Log in to the Sentinel Log Manager as an

Administrator

2Download or copy the installer

SENTINEL_LOG_MANAGER_1.0.0.4.zip

to a temporary

directory.

3Change to the temporary directory.

4Unzip the installer package.

5Change to the unzipped directory.

cd SENTINEL_LOG_MANAGER_1.0.0.4

6(Optional) Stop the Collector Manager by using the following command:

Installation_Directory/bin/sentinel.bat stop

7Go to the installation directory.

8Execute the

service_pack.bat

from the command window and follow the prompt.

5 Issues Fixed

Section 5.1, “Issues Fixed in Sentinel Log Manager 1.0.0.4 Release,” on page 7

Section 5.2, “Issues Fixed in Sentinel Log Manager 1.0.0.3 Release,” on page 9

Section 5.3, “Issues Fixed in Sentinel Log Manager 1.0.0.2 Release,” on page 11

Section 5.4, “Issues Fixed in Sentinel Log Manager 1.0.0.1 Release,” on page 11

5.1 Issues Fixed in Sentinel Log Manager 1.0.0.4 Release

This section lists the issues fixed in Novell Sentinel Log Manager 1.0.0.4 Release.

Table 1 Issues fixed in Sentinel Log Manager 1.0.0.4 Release

Issues Fixed Description

551079 Issue: In the report details, if the time range is not set to custom date

range, then the time shown reflect the actual times the report had been

run.

Fixed: After the report is run, the date range is being displayed

appropriately in the report details.

545195 Issue: When there are many event sources in the Operating System

section of syslog server user interface, the browser reports an

unresponsive script

error. As a result Sentinel Log Manager user

interface also becomes unusable.

Fixed: A new Data Collection user interface with Sentinel Log Manager

hotfix 4 properly manages the event sources.

8Novell Sentinel Log Manager 1.0.0.4 Release Notes

novdocx (en) 22 June 2009

5.1.1 Enhancement

This section lists the enhancements in Novell Sentinel Log Manager 1.0.0.4 Release.

Table 2 Enhancements in Sentinel Log Manager 1.0.0.4 Release

532421 Issue: The e-mails received from Sentinel Log Manager has Novell

Identity Audit Event text in the subject line.

Fixed: The Subject field is now user configurable.

549330 Issue: The Device Event Time field is appearing as searchable field in the

search tips popup.

Fixed: The Device Event Time field is not a searchable field. It is now

deleted from the search tips popup.

523499 Issue: Passwords with both backward and forward slashes and single

quote characters are not accepted while login.

Fixed: Now the passwords with escape characters (\, /, and ‘) are allowed.

499349 Issue: When executing a search from the search toolbar on the upper right

hand corner of the user interface, it would intermittently open a search tab

with the search criteria of a previous search rather than the currently typed

in search.

Fixed: The new search tab now always has the most recently typed in

search criteria.

Issues Fixed Description

553146 Issue: A raw data link is required next to each search result entry that will

take you to the unparsed raw data on the Raw Data Download page. The

event will display the data originated from the event source.

Fixed: A get raw data link is added to each search result. Clicking on this

link opens a Raw Data Download page in a new tab and points to the

appropriate event source.

509882 Issue: An option to export the report results option should be included.

Fixed: Sentinel Log Manager interface now provides you an option to

export the report results.

508992 Issue: An option needs to be provided to know the number of events the

user has scrolled through.

Fixed: The left pane of the search result displays the number of events the

user has scrolled through.

504105 Issue: LDAP authentication option should be added for Sentinel Log

Manager.

Fixed: Sentinel Log Manager now supports the LDAP authentication

option.

Issues Fixed Description

Novell Sentinel Log Manager 1.0.0.4 Release Notes 9

novdocx (en) 22 June 2009

5.2 Issues Fixed in Sentinel Log Manager 1.0.0.3 Release

This section lists the issues fixed in Novell Sentinel Log Manager 1.0.0.3 Release.

Table 3 Issues fixed in Sentinel Log Manager 1.0.0.3 Release

557632 Issue: The exported results

.csv

file should display the important fields

columns at the beginning.

Fixed: Important fields are placed in the beginning of csv report. The fields

are ordered as dt, port, sev, evt, msg, rv42, shn, sip, rv35, sun, rv41, dhn,

dip, rv45, dun, sp, isvcc, dp, tsvcc, ttd, ttn, rv36, and fn followed by other

fields as long as field has valid value.

542187 Issue: Exported search results were unreadable with too many empty

columns, which was causing it to throw some errors while opening in open

office.

Fixed: The empty columns are removed from the search results to make it

more readable and compact.

547204 Issue: Subject was not configurable in the Send an Email action user

interface and all the mails had default subject value.

Fixed: Now you can specify a subject line using the Subject field in the

Send an Email action user interface.

530183 Issue: The number of records value that went into a collector should be

displayed in the Collector status details pane of the Event Source

Management interface.

Fixed: The Total Records Sent and Records Sent in Last Interval fields are

included in the Collector status details pane of the Event Source

Management interface.

495806 Issue: Export search result has the same event count limit as search

refinement (50,000).

Fixed: The 50,000 limit for exporting results has been removed. Now the

user will be prompted to enter the number of results they want to export.

Issues Fixed Description

563948 Issue: A message stating that no events have been found by the search is

displayed even before the search is completed.

Fixed: The

no events found

message only appears if no events are

found after the completion of a search.

560580 Issue: Occasional searches run from the search tool bar used the previous

search string instead of the new search string.

Fixed: A new search run from the search tool bar uses the new search

string.

Issues Fixed Description

10 Novell Sentinel Log Manager 1.0.0.4 Release Notes

novdocx (en) 22 June 2009

5.2.1 Enhancement

Top N type reports are now supported. A Top N type report named

All Vendors All Products

Top 10 Report

is installed with this hotfix and is available as a Visualization from the Search Save

As Report dialog as well from the main report list. This report provides an easy way to view a

dashboard of the most frequent activity being monitored by Sentinel Log Manager.

556411 Issue: Squashfs indexes that were mounted by a previous running

instance of the server are not cleaned up when the server starts, resulting

is failed searches.

Fixed: The server now detects if old mounts need to be cleaned up and

cleans them up allowing searches to complete normally.

552519 Issue: The softwarekey.sh script was not included in the install, making it

difficult to reset the license key with the server turned off.

Fixed: The softwarekey.sh script is now included.

549582 Issue: An event is not searchable by its original timestamp if it arrives

more than a day late.

Fixed: The event is searchable by its original timestamp no matter how

late it arrives.

546324 Issue: A rule or data retention policy configured with a filter that is just a full

text search (i.e., no field such as

sev:5

is specified) results in an error on

the server that prevents any users from logging into the Web interface or

ESM user interface.

Fixed: The bug is fixed so that all valid filters are now accepted and

evaluated properly. Filter validation is also done before allowing a user to

save a filter to prevent an invalid filter from being saved that would cause

logins to fail.

545837 Issue: The Event Source Management (ESM) user interface is not able to

read the maxclausecount property in the

SentinelPreferences.properties

file.

Fixed: The Event Source Management (ESM) user interface works fine

with a high number (>=~1000) event sources and does not log any

max

clause count exceeded

exceptions.

545197 Issue: When many event sources are configured (for example, 2000+), the

Event Source Management (ESM) user interface consumes lot of memory

on webstart (for example, 1GB) and also becomes unusable.

Fixed: The ESM user interface now works fine if there are many event

sources are configured.

527007 Issue: To turn on or off the data logging for all of the operating system

event sources and all of the Application collectors, a Data logging (All) On

and Off option is required for the APPLICATIONS and OS tables under the

Collection > Syslog Server tab.

Fixed: To turn on or off the data logging for all of the operating system

event sources and all of the Application collectors, a Data logging (All) On

and Off option is provided for the APPLICATIONS and OS tables under

the Collection > Syslog Server tab.

Issues Fixed Description

Table des matières

Autres manuels Novell Logiciel

Novell

Novell LINUX ENTERPRISE SERVER 11 - STORAGE ADMINISTRATION GUIDE... Mode d’emploi

Novell

Novell ACCESS MANAGER 3.1 SP1 - S 11-20-2009 Manuel utilisateur

Novell

Novell OPEN ENTERPRISE SERVER 2.0 SP2 - DOMAIN SERVICE FOR... Manuel utilisateur

Novell

Novell PRIVILEGED USER MANAGER EVALUATION - Manuel utilisateur

Novell

Novell SENTINEL 6.1 SP2 - INSTALLATION GUIDE... Manuel utilisateur

Novell

Novell OPEN ENTERPRISE SERVER - CONVERSION GUIDE... Manuel utilisateur

Novell

Novell GROUPWISE 7 - SECURITY POLICIES Manuel utilisateur

Novell

Novell CUSTOMER CENTER 2.3 - GUIDE 4-8-2009 Manuel utilisateur

Novell

Novell ACCESS MANAGER 3.1 SP1 - IDENTITY SERVER Manuel utilisateur

Novell

Novell LINUX ENTERPRISE DESKTOP 11 - GNOME Manuel utilisateur

Novell

Novell GROUPWISE 8 - LINUX-MAC CLIENT Manuel utilisateur

Novell

Novell SP2 - S Mode d’emploi

Novell

Novell CLIENT FOR LINUX 1.1 Manuel utilisateur

Novell

Novell SLRS 8 - Manuel

Novell

Novell GROUPWISE 7 - USERS Manuel utilisateur

Novell

Novell LINUX ENTERPRISE SERVER 10 - STORAGE ADMINISTRATION GUIDE FOR... Mode d’emploi

Novell

Novell LINUX ENTERPRISE DESKTOP 10 SP2 - GNOME... Manuel utilisateur

Novell

Novell GROUPWISE 8 - MONITOR Manuel utilisateur

Novell

Novell ADMINSTUDIO 9.5 Manuel utilisateur

Novell

Novell LOGIN SCRIPTS - 08-2008 Manuel utilisateur

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - COMMAND LINE UTILITIES REFERENCE 10.3... Manuel technique

Novell

Novell eBook Reader Mode d’emploi

Novell

Novell LINUX ENTERPRISE DESKTOP 11 - KDE 17-03-2009 Manuel utilisateur

Novell

Novell LINUX ENTERPRISE DESKTOP 10 SP2 Manuel utilisateur

Manuels Logiciel populaires d'autres marques

COMPRO

COMPRO COMPROFM Manuel utilisateur

Muratec

Muratec OFFICEBRIDGE ONLINE Manuel utilisateur

Oracle

Oracle Contact Center Anywhere 8.1 Manuel utilisateur

Adobe

Adobe 65007312 - Photoshop Lightroom Manuel

Avaya

Avaya NULL One-X for RIM Blackberry Manuel utilisateur

HP ProLiant BL420c Manuel utilisateur

PS Audio

PS Audio PowerPlay Manuel du propriétaire

Brady

Brady LOCKOUT PRO 3.0 Manuel de service

Avaya

Avaya Interaction Center Manuel utilisateur

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manuel

Oracle

Oracle Application 9i Manuel utilisateur

Acer

Acer RDM Manuel utilisateur

Canon

Canon Vixia HF21 Manuel utilisateur

Canon

Canon ZR950 Manuel utilisateur

Samsung

Samsung Auto Backup Manuel utilisateur

Polycom

Polycom Vortex EF2201 Instructions d'installation et d'utilisation

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manuel utilisateur

Lexmark

Lexmark Apps Manuel de service

Novell SENTINEL LOG MANAGER 1.0.0.4 - S Mode d’emploi

Manuels Logiciel populaires d'autres marques