Current Release - Release Notes Easy Auditor

Technical Advisories

T11752 Custom Real-time Audit policy User selection filtering

To select a name from the User drop-down list on a Custom Real-time Audit policy trigger you must first type the first letter of the user domain (name format is DOMAIN\name) after which you can type any other letter from user name for further filtering. Leave a space between first letter and next letter if letters are not adjacent in user name. Example below

Workaround: None required.

T11890 Able to save query without a name

The GUI allows saving of query without name.  Query can be run but cannot be deleted.  Only one query without a name will be able to be saved.

Workaround: Enter name when saving a query.

T13573 Delete parent folder with subfolders shows duplicates in Where Did My Folder Go

Where Did My Folder Go search results for a parent deleted folder where subfolders were also deleted duplicates entries for some folders.

Workaround: None required

T14722 Issues with custom report where path selected contains special language characters

Custom report where path selected contains special language characters may either not run or will complete with 0 results.

Workaround: Selecting a path higher up in the directory tree without special language characters may return results where special language characters not displayed correctly. Note that Wiretap and Where Did My Folder Go provide an option for reporting on these paths.

T15037 Easy Auditor does not report files with multiple extensions correctly

For the case where a file has multiple extensions in the Easy Auditor report the first extension only is reported. For example file.pdf.gz is reported as a pdf not as a gz file.

Workaround: None available.

T15582 Easy Auditor issues where path has & or brackets

Easy auditor has following issues for path with &:

- user or path search where path contains & return 0 results

- DLP trigger cannot be saved where path contains &

- Mass Delete trigger where path contains & returns 0 results

Workaround: Select path above path with & when defining custom search, DLP or Mass Delete triggers

Easy auditor has following issues where path contains bracket

- Wiretap, Where did My Folder Go, Active Auditor triggers not functioning

Workaround: No workaround available

T19561 Easy Auditor scheduled reports may not run

Under some circumstances the license state for a Powerscale cluster is lost after which scheduled reports may fail to run.

Workaround: Manually run the scheduled query for the desired timeframe.

T20078 Emailed built-in report may contain user SID

The summary in the email body for some built in reports shows user SID instead of the associated user id.

Workaround: The attached CSV file has SID resolved to user id.

T20661 Large Report cannot be downloaded from Windows

There is an issue downloading reports with very large number of records from Windows using Chrome browser. On download a "Loading" message appears but once the Loading message stops, no download is started. This issue does not appear on MAC with Chrome browser.

Workaround:

1) On Windows, large reports can be successfully downloaded using Firefox browser build 72

2) The file is generated and present on the Eyeglass appliance and could be retrieved using a tool such as WinSCP. The report files are located on the Eyeglass appliance in the folder: /srv/www/htdocs/csv 

T22708 Access Report only reports on shares using AD Group permissions

The Access Report can only be used to report on permissions for shares using AD Groups. Share permissions to AD Users directly or well known user/group such as Everyone results in an error when running the report.

Workaround: None available.

T22719 Access Report reports extra information when reporting on share with same name in multiple Access Zone

If there are multiple Access Zone configured on the PowerScale and those Access Zone contain shares with the same name, reporting on one of those shares will report for all shares of that name and not be filtered on the Access Zone selected.

Workaround: None required.

T22720 Access Report not compatible with LDAP retrieval of AD Users and Groups

If Eyeglass is configured to use LDAP for retrieval of AD Users and Groups, the Access Report cannot report on share access as it relying on PowerScale API calls for that information.

Workaround: None available.

T22731 Access Report cannot be displayed in the GUI with large number of permissions

If the resulting Access Report has more than 1000 permissions, the report cannot be viewed from the Easy Auditor GUI. Opening the report causes the GUI to freeze.

Workaround: Download report with large number of permissions to view it.

T22738 Access Report does not report on nested groups

The Access Report only reports on the users in the parent group where a share has permissions configured with nested groups.

Workaround: None available.

Active Auditing

T8878 Cannot save DLP trigger for a different NE but same path

With 2 licensed clusters a Data loss prevention policy cannnot use the exact same path on both clusters if entering 2 differnent policies one for each cluster.

Work around:  none only the first cluster and path can be added.

T6305 Invalid username causes Wiretap error

If you enter an invalid username that cannot be resolved when setting up a Wiretap active auditing job it causes the job creation to fail with the following error:

Failed to create new wiretap:

Server error when processing request: java.lang.NullPointerException

Workaround: Enter a username that can be resolved in the documented supported format.

T7547  Wiretap does not show user name for NFS events

For events generated over NFS protocol, Wiretap does not include user name in the event information. Only client IP address is displayed.

Resolution: A custom query can be built using the Report Query Builder based on path and timeframe in order to view user name.

T12876 DLP trigger cannot be added

An error (Error saving response) occurs when adding a DLP trigger if there is an existing directory quota without data-protection overhead option enabled on the the path that a DLP trigger is being configured for.

Workaround: If possible, delete the existing quota and allow new quota to be created as part of adding the DLP trigger. Note that the directory quota that is created will be created with the data-protection overhead option enabled.

T15198 Active Auditor Triggers may have inaccurate Signal Strength

Active Auditor trigger processing (DLP, Mass Delete, Custom Triggers) may receive duplicate events and as a result show a higher Signal Strength than is actually the case.

Workaround: None required. The duplicate events will cause early detection of configured triggers. The associated CSV for files involved in the detection is correct.

T15250 The command to reset Active Auditor event queue must be run twice

The command igls adv eventTriggers set --operation=reset --topic=ea must be run twice to clear the queue.

Workaround: Execute the command a second time to clear the queue.

T16980 Active Auditor events Affected Files-CSV may not show all events

Under some circumstances the Affected Files-CSV may not show all events for the Active Auditor trigger as the timeframe for the report may result in some events being excluded.

Workaround: Use the Report Query Builder to run a query with the same conditions and user as the associated trigger and a timeframte that starts before the detected time. Typically starting query an hour prior to the event would ensure all events were listed but may also include some audit events that are not related to to the trigger.

T19629 Expired Active Auditor Events not archived to Event History if Ransomware Defender has Automatic Learning enabled

If the Ransomware Defender settings has Automatically Learn.... setting selected, an Active Auditor event that matches criteria for Automatic Learning encounters an error when it expires which prevents it from being archived to the Event History list. Impact: There is no impact on the detection of the Active Auditor event only on expiry the event is not moved to the event history as it should be.

Workaround: Event can be moved to the Event History by manually archiving as unsolved from the Action menu for the event.

T21226, T22604 Active Auditor Snapshot functionality follows Ransomware Defender Snapshot configuration

The snapshot behaviour for Active Auditor Mass Delete and manual snapshot creation follow the configuration for snapshot budget, and snapshot enable/disable in the Ransomware Defender / Snapshots window. Ransomware Defender snapshot logic for user share snapshot is followed if configured rather than a snapshot for the mass delete path.

Workaround: Do not use the Create Snapshot checkbox in the Easy Auditor / Active Auditor window to manage Active Auditor snapshots. It does not have any effect. Use the Ransomware Defender / Snapshots window to enable / disable snapshots. Important - configuration here also affects snapshot management for Ransomware Defender. User share snapshot will also protect the mass delete path as user share would provide access to this location in the filesystem.

Robo Audit

T8694 Robo Audit may show Success when it did not run

Robo Audit may show as having successfully completed when in fact it did not run. For example:

• Robo Audit configured but disabled

• Robo Audit misconfigured and enabled

Workaround: Open the Robo Audit logs to see details of Job Execution.

T11880 Robo Audit fails when configured to run on more than one cluster

When configured to run on more than one cluster, Robo Audit job will succeed for one cluster but fail for the subsequent cluster.

Workaround: Configure Robo Audit to only run on one cluster.

T15175 Existing Robo Audit Logs lost formatting after upgrade to 2.5.6

Any existing Robo Audit logs viewed from the Eyeglass GUI will have lost the formatting after upgrading to 2.5.6.

Workaround: None required. New logs will have the correct formatting.

General

T5858  ecactl commands do not switch to ecaadmin user

If you are logged into an ECA node as root user and execute an ecactl command, you are prompted to login as the ecaadmin user to continue but even though the console indicates that the login as ecaadmin is underway the login never completes and the command cannot be executed.   

Workaround: Login to ECA as ecaadmin user when using ecactl commands.

T5915  Event retrieval stopped by Disable/Enable of Protocol Monitoring on the PowerScale

If you disable / enable Protocol Auditing on the PowerScale cluster the ECA does not recover and does not begin reading events once Protocol Auditing enabled again.

Workaround: If you need to disable/enable Protocol auditing down the ECA cluster first

    Ecactl cluster down

Then disable Protocol Auditing on the PowerScale cluster

After you have enabled Protocol Auditing on PowerScale cluster, the bring the ECA back up:

      ecactl cluster up.

T6004  PowerScale Directory Selector Usage

In order to populate a cluster in the Directory Selector a directory must be selected in the file tree.   

Workaround: None required. Once cluster is populated a path can be selected from the tree or typed in but must begin with /ifs .

T15457 HTML 5 vmware vcenter bug on OVA deployment

 Some versions of vmware vcenter HTML user interface have a known issue with OVA properties being read correctly post power on, leading to first boot issues.

Workaround: use the Flash client as a work around.

T6097  UI Desktop Unexpected Behaviour

If you move a window to the edge of the Eyeglass desktop it may become stuck in that position.   

Workaround: Refresh browser.

T6617  PowerScale Directory Selector does not display hidden directories

Directories that start with a dot (.) are not displayed in the PowerScale Directory Selector.   

Workaround: Use the PowerScale Directory Selector to enter \ifs\ and then enter the remainder of the path manually.

T8091  Login Monitor Report does not have Sorting

When viewing the Login Monitor Report Built-In query results from the GUI, sorting on columns Logons, Logoffs, and failed Logons is not available.  

Workaround: Download the report csv file and open in spreadsheet for sorting and filtering of data.

T8105 Alarm EAU0002 has no detailed information for failed auditor report

The alarm Info for EAU0002 alarm "Auditor report failed" does not have any detailed information on cause of report failure.

Workaround: In Easy Auditor / Running Reports tab select the report that failed and in the Job Details expand the tree and select the Info link for the failed step.

T8249 Canceling Easy Auditor Running Report results in Critical severity alarm

Cancelling a running auditor report results in a Critical Severity alarm.

Workaround: None required. This alarm is informational only and does not indicate any critical issue in Easy Auditor.

T19929 Easy Auditor Directory Selector returns "Error retrieving directory info from cluster"

The Directory Selector directory tree display encounters an issue displaying the tree when the folder structure count (including files) exceeds 100,000.

Workaround: In the Directory Selector, select the cluster and the first folder "ifs" then manually enter the remainder of the path. Important: path is case sensitive and must match the filesystem path.

EA-171 Bulk Ingest folder is not created automatically

Bulk Ingest folder is not created automatically

workaround:

1 mkdir -p /opt/superna/sca/data/bulkingest

2touch /opt/superna/sca/data/bulkingest/bulkingest.json

3chown sca:users /opt/superna/sca/data/bulkingest/bulkingest.json

EA-193 Bulk ingest job is not working with turboaudit REST API