TIBCO LogLogic LX 820 How to use

TIBCO LogLogic®
Log Management Intelligence (LMI)
Release Notes
Software Release 5.4.1
September 2013
Two-Second Advantage®

Important Information
SOME TIBCO SOFTWARE EMBEDS OR BUNDLES OTHER TIBCO SOFTWARE. USE OF SUCH EMBEDDED OR BUNDLED
TIBCO SOFTWARE IS SOLELY TO ENABLE THE FUNCTIONALITY (OR PROVIDE LIMITED ADD-ON FUNCTIONALITY) OF
THE LICENSED TIBCO SOFTWARE. THE EMBEDDED OR BUNDLED SOFTWARE IS NOT LICENSED TO BE USED OR
ACCESSED BY ANY OTHER TIBCO SOFTWARE OR FOR ANY OTHER PURPOSE.
USE OF TIBCO SOFTWARE AND THIS DOCUMENT IS SUBJECT TO THE TERMS AND CONDITIONS OF A LICENSE
AGREEMENT FOUND IN EITHER A SEPARATELY EXECUTED SOFTWARE LICENSE AGREEMENT, OR, IF THERE IS NO
SUCH SEPARATE AGREEMENT, THE CLICKWRAP END USER LICENSE AGREEMENT WHICH IS DISPLAYED DURING
DOWNLOAD OR INSTALLATION OF THE SOFTWARE (AND WHICH IS DUPLICATED IN THE LICENSE FILE) OR IF THERE
IS NO SUCH SOFTWARE LICENSE AGREEMENT OR CLICKWRAP END USER LICENSE AGREEMENT, THE LICENSE(S)
LOCATED IN THE “LICENSE” FILE(S) OF THE SOFTWARE. USE OF THIS DOCUMENT IS SUBJECT TO THOSE TERMS AND
CONDITIONS, AND YOUR USE HEREOF SHALL CONSTITUTE ACCEPTANCE OF AND AN AGREEMENT TO BE BOUND BY
THE SAME.
This document contains confidential information that is subject to U.S. and international copyright laws and treaties. No part of this
document may be reproduced in any form without the written authorization of TIBCO Software Inc.
TIBCO, Two-Second Advantage, and LogLogic are either registered trademarks or trademarks of TIBCO Software Inc. in the United
States and/or other countries.
All other product and company names and marks mentioned in this document are the property of their respective owners and are
mentioned for identification purposes only.
THIS SOFTWARE MAY BE AVAILABLE ON MULTIPLE OPERATING SYSTEMS. HOWEVER, NOT ALL OPERATING SYSTEM
PLATFORMS FOR A SPECIFIC SOFTWARE VERSION ARE RELEASED AT THE SAME TIME. SEE THE README FILE FOR THE
AVAILABILITY OF THIS SOFTWARE VERSION ON A SPECIFIC OPERATING SYSTEM PLATFORM.
THIS DOCUMENT IS PROVIDED “AS IS” WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED,
INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
PURPOSE, OR NON-INFRINGEMENT.
THIS DOCUMENT COULD INCLUDE TECHNICAL INACCURACIES OR TYPOGRAPHICAL ERRORS. CHANGES ARE
PERIODICALLY ADDED TO THE INFORMATION HEREIN; THESE CHANGES WILL BE INCORPORATED IN NEW EDITIONS
OF THIS DOCUMENT. TIBCO SOFTWARE INC. MAY MAKE IMPROVEMENTS AND/OR CHANGES IN THE PRODUCT(S)
AND/OR THE PROGRAM(S) DESCRIBED IN THIS DOCUMENT AT ANY TIME.
THE CONTENTS OF THIS DOCUMENT MAY BE MODIFIED AND/OR QUALIFIED, DIRECTLY OR INDIRECTLY, BY OTHER
DOCUMENTATION WHICH ACCOMPANIES THIS SOFTWARE, INCLUDING BUT NOT LIMITED TO ANY RELEASE NOTES
AND "READ ME" FILES.
Copyright © 2002-2013 TIBCO Software Inc. ALL RIGHTS RESERVED.
TIBCO Software Inc. Confidential Information

1
LogLogic® Appliance Release 5.4.1 is a maintenance update to previous releases.
You can upgrade to Release 5.4.1 directly from Release 5.2, 5.3, 5.3.1 and 5.4 using
instructions in the LogLogic Configuration and Upgrade Guide, which is included with the
Supplemental CD, or available for download from the TIBCO support website or the
TIBCO Software Product Download Site. .
Before updating your Appliance software, please read these Release Notes to learn:
What’s New in Release 5.4.1
Supported Platforms, Browsers, and Settings
LogLogic Documentation
Fixed Issues
Previous Known Issues
TIBCO LogLogic Support
Table 1 LMI Upgrade Matrix
LMI 5.1.x 5.2 5.3 5.3.1 5.4 5.4.1
4.9.1 
5.0 
5.1.x 
5.2 
5.3 
5.3.1 
5.4 
Table 2 LMI – LSP Compatibility Matrix
LSP 5.1.x 5.2 5.3 5.3.1 5.4 5.4.1
20
 
21 
22 
23 
24 
25 
26 

2
What’s New in Release 5.4.1
What’s New in Release 5.4.1
LogLogic Release 5.4.1 contains the following noteworthy improvements and updates
since the previous feature release:
H4 Support
The new 4th generation TIBCO LogLogic Appliances (H4) come with an embedded SD
card that contains an image of the Appliance software. This new hardware feature
facilitates re-imaging the Appliance in case of critical hardware or software failure.
Changes in Functionality
User Privileges
Management Station privilege: the Access Management Station privilege name has
been changed to View Management Station Status.
Custom Report privilege: previously Access Custom Reports, Add/Modify/Delete
Custom Reports, Run/Schedule Custom Report could be checked separately. With
release 5.4.1 the Access Custom Reports privilege controls the other two privileges.
Multiple Concurrent Logins
Users can only log into one session at a time. If a user is logged in and then opens up a
new session the first session will be closed. When the user tries to click on anything in
the first session the page will redirect him to the login page with the following message
“Your login session is already opened at some other place”.
Supported Platforms, Browsers, and Settings
This LogLogic release supports specific LogLogic Appliance models, and can be used
with supported web browsers on systems using the recommended display settings.
Table 3 Supported Platforms for H3 Appliances
LX Appliances ST Appliances MX Appliances
LX 820 ST 1020 MX 3020
LX 1020 ST 2020-SAN MX 4020
LX 4020 ST 4020
Note: The use of advanced features on the second-generation
hardware Appliances may cause performance degradation.

3
LogLogic Documentation
LogLogic Documentation
This release includes the following documentation, available both on the LogLogic
Customer Support website and on the Solutions CD that ships with the Appliance:
LogLogic Hardware Installation Guide—Describes how to get started with the
LogLogic Appliance, and includes details about the Appliance hardware.
LogLogic Configuration and Upgrade Guide—Describes how to configure and upgrade a
LogLogic Appliance software.
LogLogic Administration Guide—Describes how to administer the LogLogic solution
including managing users, managing log data storage, and managing new log sources
(devices).
LogLogic Management Appliance Guide—Describes how to manage multiple
distributed Appliances using the LogLogic Management Appliance.
LogLogic User Guide—Describes how to use the LogLogic solution, including managing
reports, managing alerts, and performing searches.
LogLogic Enterprise Virtual Appliance Quick Start Guide—Describes how to install
the LogLogic Enterprise Virtual Appliance (EVA) in the VMware environment.
LogLogic Log Source Configuration Guides—Describe how to support log data from
various log sources. There is a separate manual for each supported log source. These
documents include documentation on LogLogic Collectors as well as documentation
on how to configure log sources to work with the LogLogic solution.
Table 4 Supported Platforms for H4 Appliance Models
LX Appliances ST Appliances MX Appliances
LX 825 ST 1025 MX 3025
LX 1025 ST 2025-SAN MX 4025
LX 4025 ST 4025
Note: The use of advanced features on the second-generation
hardware Appliances may cause performance degradation.
Table 5 Supported Browsers
Browser Version
Google Chrome 14.x
Microsoft Internet Explorer 7.x, 8.x
Mozilla Firefox 3.6.x
Table 6 Display Settings
Monitor Recommended settings Minimum settings
Display Resolution 1280 x 1024 pixels or higher 1024 x 768 pixels
Colors 32-bit colors 16-bit colors

4
LogLogic Documentation
LogLogic Collector Guides—Describe how to implement support for using a LogLogic
Collector for specific log sources such as IBM i5/OS and ISS SiteProtector.
LogLogic Log Source Report Mapping Guidebook—This guide provides a set of tables
listing Log Source Reports by Device Type, sorted by UI Categories: Access Control,
Database Activity, Enterprise Content Management, HP NonStop Audit, IBM i5/OS
Activity, Mail Activity, Network Activity, Operational, Policy Reports, Storage Systems
Activity, and Threat Management.
LogLogic Web Services API Implementation Guide —Describes how to implement the
LogLogic Web Services APIs to manage reports, manage alerts, perform searches, and
administrate the system.
LogLogic Syslog Alert Message Format Quick Reference Guide—Describes the
LogLogic Syslog alert message format.
XML Import Guide—Describes how to manually import, export, and edit XML files
into and from the Appliance when not using the Appliance UI.
LogLogic Online Help—Describes the Appliance user interface, including descriptions
for each screen, tab, and element in the Appliance.

5
Fixed Issues
Fixed Issues
The following are the most significant issues resolved in Release 5.4.1:
Files not deleted after the retention period expires. (LLLM-428)
Message-routing transferred file to rsyslog resulted in only a portion of the log
messages being sent. (LLLM-631)
Inconsistent data with index reports. (LLLM-661)
Unable to validate any message after successfully creating a message signature.
(LLLM-680)
User Creation/Deletion events do not show up in Windows 2008 reports. (LLLM-681)
Incorrect auto-identification of LogLogic device as Cisco ASA causes LX Parser to
crash. (LLLM-682)
Unable to drill down on the PCI: Cisco PIX, ASA, FWSM Policy Changed report in
Compliance Manager. (LLLM-693)
Emailed scheduled RegEx search result can only be seen by the user who owns the
Search filter, but not other email recipients. (LLLM-701)
User privileges not working as expected. (LLLM-705)
Update of an user's email in LogApp Account Setting was not reflected in the Address
Book for scheduled reports and saved searches. (LLLM-709)
Management Station menu option disappeared under Management after upgrading to
version 5.4. (LLLM-710)
Inconsistent data with index reports in LMI 5.3.1. (LLLM-713)
LMI tutorial link on the home page got redirected to an irrelevant web page.
(LLLM-741)
Web server displayed version information in the web page content. (LLLM-759)
Web server allowed sensitive HTTPS responses to be cached in the browser.
(LLLM-761)
Cookie issued by the application did not have the HttpOnly flag set. (LLLM-762)
Missing batch file for running R8_RunSearchReportIterate.java sample report through
WSAPI. (LLLM-769)
Account status was revealed in the response after a failed login attempt to lockout
accounts. (LLLM-770)
Unable to add more than two records when adding static routes using the Batch Add
option. (LLLM-774)
Archiving to Centera on ST was very slow. (LLLM-782)
Engine-archive failed to archive index files. (LLLM-783)
The saved report from index search associated with multiple devices was displayed as
blank screen. (LLLM-784)
Archive Watermark could not be set to zero for NAS storage on ST2020-SAN.
(LLLM-785)
Engine_raid failed to format new drive. (LLLM-786)

6
Previous Known Issues
Previous Known Issues
This list includes known issues that exist in the current release:
Formatted Forwarding
Display issues with Firefox browsers older than 3.6.8. (29817)
Forwarding User Defined Types
All Syslog Sources will no longer be selectable from Message Routing Log Source
Picker. (29710)
Security – "All Syslog Sources"
Only users with "Access all devices" privilege should be given the "Message Routing
Configuration" privilege.
Prior to Release 5.3, LMI allows forwarding messages from devices in the All Syslog
Sources group even when the user creating the rule has not been given access to the
specific devices in the group. This is a potential security breach because it allows a user
without specific device privileges to forward messages from that device. This potential
security issue has been fixed in Release 5.3.
New Behavior: A message routing rule using the All Syslog Sources group from
previous versions of LMI will be migrated when upgrading to Release 5.3. The
migrated rule will continue to work in Release 5.3. It will appear in the list of selected
log sources as “All Syslog Sources” in the Message Routing Log Source Picker.
To protect against this potential security breach the administrator must delete the All
Syslog Sources group from the routing rule and replace it with the appropriate All
DeviceType X groups represented by All Syslog Sources.
The All Syslog Sources group represents all devices whose messages are received via
the network. These device types have the collection type of Network as seen on the
Manage Device Types page.
To replace All Syslog Sources include every All DeviceType X group for all of the
device types that have the collection type of Network.
User Defined Groups
Message Routing: The available options could be different when selecting log sources
from a user-defined Group containing mixed log types. (31205)
When creating a Message Routing rule that includes mixed log types from a
user-defined Group, the available options such as Protocols and Settings can be
different compared to a rule that contains only a single log type.
Message Routing: LMI does not support sending duplicate logs to the same
destination IP using different rules when the same protocol is selected even with
different destination ports. (31206)
Workaround: If the user wants to send the same set of data twice to the same
destination using two different rules, he/she must use different protocols for each rule.

7
Previous Known Issues
Selecting A Large Number of Log Sources
Log Source Picker: To avoid problems when adding a large number of devices, use the
options listed below. (31216)
Option 1: When creating a Message Routing rule for a large number of devices of the
same log type, use the system-defined Group option.
After entering the name of an Outbound Message Routing rule, go to the next page
1) Filter by Name, enter All*
2) Select one or more Groups as long as they are the same log type
3) Click “Add selected log sources”
Option 2: Choose user-defined Group when selecting particular devices.
1) Create a user-defined Group and select the devices that you want to add to the
Message Routing rule
2) Create a Message Routing rule and enter any name; go to the next page
3) Filter by Type
4) Select the log type that you added in the user-defined Group
5) That user-defined Group will be displayed on the right panel
6) Select that user-defined Group
7) Click “Add selected log sources”
Option 3: For Log Source picker in Report and Index Search
Go to the Log Source Picker widget
1) Filter by Type or Name to retrieve the list of devices
2) Click on "Add filters as rule..." button
3) It will create a dynamic rule which contains all listed devices on the right panel
Clear Log Data
Cluster membership keeps failing and the UI throws exceptions repeatedly during
clear log data. (23836)
If the Appliance accumulates a significant amount of data, Clear Log Data
(Administration > Clear Log Data) will temporarily lock up the MySQL server for an
extended period of time, potentially causing some background tasks in the Appliance
that accesses the MySQL database to fail. This may cause erroneous log entries to be
added to sys.log. This is expected behavior, and will not affect the action of Clear Log
Data or any Appliance functions after the completion of Clear Log Data.
Browser
Using the browser Back button in IE 8 can cause errors in the Device Management
interface. The error does not occur in Firefox. (25323)
Browser may hang during running reports or index search with configuration of 1000
rows per page. (26108)
Workaround: Set the rows per page to a lower number.

8
Previous Known Issues
Enterprise Virtual Appliance
VMware's Workstation 8 on Windows platform cannot display the EULA page
correctly. (31187)
Workaround: Use the command line tool, ovftool, to import the EVA OVA package.
The ovftool binary comes with WorkStation installation and can be found in
C:\Program Files (x86)\VMware\VMware Workstation\OVFTool\ovftool.exe, or
other Workstation installation path. The Windows command "ovftool.exe
eva_package_name.ova virtual\machines\dir\target_eva_machine_name.vmx" can
deploy the EVA OVA package to WorkStation 8 on Windows.
GUI
HTTP error - 500 (Please contact your Admin) occurs when showing Timeline during
searching a large amount of data. (18110)
This issue does not occur if checking the Show Timeline before or after running the
search; it occurs only when checking the Timeline check box while searching a large
amount of data.
Following an index search, the Next Page button and the Last Page button appear,
even when there is only one page of data returned. After clicking the Last Page button,
"Page request is out of range" overlay window will display. Upon clicking the Previous
Page button, the returned Index Search results disappear. (28342)
Workaround: Click OK when "Page request is out of range" overlay window displays,
and the previous index search results will return.
Management Station
When using Management Station, messages from a specific MX or LX Appliance may
not be included in the detailed report when All LX/MX is selected in "Appliance".
(30028)
Devices with the same name from different Appliances have different device IDs. In
aggregating summary results, only one device ID is kept. When this ID is later used to
get drill-down results, only one Appliance can contain this ID, so drill-down results
contain logs from only one Appliance.
Performance
Slow performance when running the detailed Network Activity - Application
Distribution. (31059)
When the “Enable Accept Detail” is turned on, LMI will begin aggregation starting
with the oldest data collected. The reports will take a longer time to generate while the
aggregator is “catching up”. The amount of time is dependent on: 1) the amount of
un-aggregated data collected prior to enabling Accept Detail and 2) the current
collection rate. Once the aggregator has caught up reports should appear more quickly.
Index Report
Drill-down on index report results does not work when more than 16 devices are
selected. (29746)
Workaround: Select fewer devices, or create a device group to include all devices
needed.

9
Previous Known Issues
Upgrade
All index files from Release 5.1 or earlier will be deleted after upgrading to Release 5.2
or later. Log files will be re-indexed automatically. (28421)
Archiving
In active-passive SAN system, the SAN device listing won't get updated if SAN
controller failover occurs. (23197)
If the same NAS file path is configured for both backup and archive, either for the
same or for different appliances, incorrect data will be stored in the indexFiles table.
(28505)
Workaround: Use a clean directory as a mount point when configuring the NAS server.
1) The same NAS path should not be shared between backup and archive on the
same Appliance.
2) The same NAS path should not be shared between backup and archive on
different Appliances.
When updating Dashboard widgets, the displayed information is not updated
immediately. (31333)
Workaround: Update and save changes twice. This will force an update of the display.
Time
Fall back to the next available ntpserver fails when the NTP server name is specified in
/etc/hosts. (24625)
Workaround: Avoid using /etc/hosts to specify the host name for NTP server.

10
TIBCO LogLogic Support
TIBCO LogLogic Support
TIBCO LogLogic Technical Support is available to resolve issues that might arise. The
LogLogic Documentation Team is eager to receive your feedback to help ensure the
documentation helps everyone as much as possible.
Technical Support
LogLogic is committed to the success of our customers and to ensuring our products
improve customers' ability to maintain secure, reliable networks. Although LogLogic
products are easy to use and maintain, occasional assistance might be necessary. LogLogic
provides timely and comprehensive customer support and technical assistance from
highly knowledgeable, experienced engineers who can help you maximize the
performance of your LogLogic Appliances.
To reach the TIBCO LogLogic Support team by telephone:
Toll Free, US—1 800 957 LOGS (5647) Toll—1 408 834 7480
Toll Free, Canada—1 800 957 LOGS (5647) Toll—1 408 834 7480
Toll Free, Mexico—1 800 957 LOGS (5647) Toll—1 408 834 7480
Toll Free, United Kingdom—00 800 0330 4444 Toll—01480 479391
Toll Free, Mainland Europe—00 800 0330 4444 Toll— [phone]
Email: ll[email protected]
Customer Support website: https://support.tibco.com/esupport/loglogic.htm
When contacting LogLogic Support, be prepared to provide the following information:
Your name, email address, phone number, and fax number
Your company name and company address
Your appliance model and release version
Serial number located on the back of the Appliance or the eth0 MAC address
A description of the problem and the content of pertinent error messages (if any)