What’s New in Superna Eyeglass Easy Auditor Edition

Release 2.5.3, 2.5.4

What’s New! In Superna Eyeglass Easy Auditor Edition Release 2.5.3, 2.5.4 can be found here.

Supported OneFS releases

8.0.0.x

8.0.1.x

8.1.x.x

Supported Eyeglass releases

Inter Release Functional Compatibility

End of Life Notifications

T10895 Share/Stale Access Report in Error when AD contains distribution groups

The Share Access and Stale Acces built in reports will fail to complete when AD has distribution groups configured.

Workaround: None available

Active Auditing

T8175 Upgrade from 2.5.2 to 2.5.3 wiretap settings are lost

In the Wiretap tab any settings need to be deleted and re-added before they are active

T8878 Cannot save DLP trigger for a different NE but same path

With 2 licensed clusters a Data loss prevention policy cannnot use the exact same path on both clusters if entering 2 differnent policies one for each cluster.

Work around:  none only the first cluster and path can be added.

T5955 Wiretap Watch window cannot scroll horizontal

In the Wiretap Watch window you are not able to scroll in the horizontal direction in either section of the window.

Workaround: None available in Watch window.  A report could be generated using same criteria and timeframe for review once event of interest are known.

—————————————————–

T6074 Wiretap Open Files List not updated

File which is added to the Wiretap Open Files list may not be removed when the file is closed.

Workaround: None required. The real time event display will indicate which files are actively open.

—————————————————–

T6305 Invalid username causes Wiretap error

If you enter an invalid username that cannot be resolved when setting up a Wiretap active auditing job it causes the job creation to fail with the following error:

Failed to create new wiretap:

Server error when processing request: java.lang.NullPointerException

Workaround: Enter a username that can be resolved in the documented supported format.

—————————————————–

T6466 Deleted Wiretap not removed from filter processing

When you delete a Wiretap from the Eyeglass GUI, it is no longer displayed and cannot be selected but in the backend it continues to be active and filter is applied to incoming events.  If the deleted filter has a broad scope, it may result in dropped events for a smaller scope query as per Known Limitations T6061/T6465.

Workaround: Contact support for assistance in resolving this issue.

—————————————————–

T6467 Wiretap Event type blank for Directory Create / Delete, File Create, File Set ACL, Directory Rename

The Wiretap Watch window Event type column is empty for following event types:

• Directory Create

• Directory Delete

• File Create

• File Set ACL

• Directory Rename

Workaround: None Available in the Watch window.  You may run a report with the same filter and timeframe to review these events.

—————————————————–

T7547  Wiretap does not show user name for NFS events

For events generated over NFS protocol, Wiretap does not include user name in the event information. Only client IP address is displayed.

Workaround: A custom query can be built using the Report Query Builder based on path and timeframe in order to view user name.

—————————————————–

T8241 Affected Files display limited to 100 files

Any messages displayed indicating that more than 100 files can be displayed are inaccurate.

Workaround: None Required. Affected files display limited to 100 regardless of what the UI states. To review any additional files involved, download CSV will retrieve last hour in current release up to 50,000 records.

—————————————————–

T8437 Download csv for Active Auditor event may not show all Affected Files

The download csv created for Active Auditor event may not contain all Affected Files (up to 50,000 record limit).

Workaround: Use the Report Query Builder to build a custom report with events taking the relevant user, path and time period from the event information in the Active Auditor GUI.

—————————————————–

Robo Audit

T8694 Robo Audit may show Success when it did not run

Robo Audit may show as having successfully completed when in fact it did not run. For example:

• Robo Audit configured but disabled

• Robo Audit misconfigured and enabled

Workaround: Open the Robo Audit logs to see details of Job Execution.

—————————————————–

General

T5858  ecactl commands do not switch to ecaadmin user

If you are logged into an ECA node as root user and execute an ecactl command, you are prompted to login as the ecaadmin user to continue but even though the console indicates that the login as ecaadmin is underway the login never completes and the command cannot be executed.   

Workaround: Login to ECA as ecaadmin user when using ecactl commands.

—————————————————–

T5915  Event retrieval stopped by Disable/Enable of Protocol Monitoring on the PowerScale

If you disable / enable Protocol Auditing on the PowerScale cluster the ECA does not recover and does not begin reading events once Protocol Auditing enabled again.

Workaround: If you need to disable/enable Protocol auditing down the ECA cluster first

    Ecactl cluster down

Then disable Protocol Auditing on the PowerScale cluster

After you have enabled Protocol Auditing on PowerScale cluster, the bring the ECA back up:

      ecactl cluster up.

—————————————————–

T6004  PowerScale Directory Selector Usage

In order to populate a cluster in the Directory Selector a directory must be selected in the file tree.   

Workaround: None required. Once cluster is populated a path can be selected from the tree or typed in but must begin with /ifs .

—————————————————–

T6097  UI Desktop Unexpected Behaviour

If you move a window to the edge of the Eyeglass desktop it may become stuck in that position.   

Workaround: Refresh browser.

—————————————————–

T6451  Extra ECA Node listed in Manage Services with IP 0.0.0.0

The Manage Services window may show an additional ECA Node with IP address 0.0.0.0.  It is Inactive and therefore results in an ECA Node Inactive alarm. Otherwise has no negative impact on functionality.   

Workaround: Remove the extra ECA node with IP address of 0.0.0.0 from Manage Services by selecting the associated “x”.

—————————————————–

T6617  PowerScale Directory Selector does not display hidden directories

Directories that start with a dot (.) are not displayed in the PowerScale Directory Selector.   

Workaround: Use the PowerScale Directory Selector to enter \ifs\ and then enter the remainder of the path manually.

—————————————————–

T8091  Login Monitor Report Sorting does not work

When viewing the Login Monitor Report Built-In query results from the GUI, sorting on columns Logons, Logoffs, and failed Logons does not work.  

Workaround: Download the report csv file and open in spreadsheet for sorting and filtering of data.

—————————————————–

T8105 Alarm EAU0002 has no detailed information for failed auditor report

The alarm Info for EAU0002 alarm "Auditor report failed" does not have any detailed information on cause of report failure.

Workaround: In Easy Auditor / Running Reports tab select the report that failed and in the Job Details expand the tree and select the Info link for the failed step.

—————————————————–

T8249 Canceling Easy Auditor Running Report results in Critical severity alarm

Cancelling a running auditor report results in a Critical Severity alarm.

Workaround: None required. This alarm is informational only and does not indicate any critical issue in Easy Auditor.

—————————————————–

Known Limitations

Reporting

Conditions under which audit events are not processed

In the following situations audit events will not be processed and any audit events which occur while processing is down are dropped - they are not recovered by post processing:

• ECA NFS mount is down: Each ECA node is responsible for reading audit events for a specific set of PowerScale nodes.  While the ECA NFS mount is down, audit events for these PowerScale nodes are dropped.

• ECA down: Each ECA node is responsible for reading audit events for a specific set of PowerScale nodes.  While the ECA NFS mount is down, audit events for these PowerScale nodes are dropped.

—————————————————–

T6260 Stale Access Report Known Limitations

1) The Stale Access Report Built-In query does not report on activity for shares under following conditions:

• Share access by AD user with run as root permissions
• Share access by AD group where AD group has nested group and access by user in sub-group

—————————————————–

T6361 Reporting for shares with local user permissions unsupported

Reports generated against shares which have a local PowerScale user permission configured may give unexpected results in the report and may cause email notification to fail.

—————————————————–

T6478 Stale Access and Share Access Report AD User Limitation

Reports have been successfully generated against AD environment with up to 4000 users.  Reports against larger AD environments may fail.

—————————————————–

T2842 Login Monitor Report Known Limitations

The Login Monitor Report Built-In query has following Known Limitations:

• NFS login is not reported
• Failed login due to invalid password, or invalid user are reported by user SID
• A login where user does not appropriate share permission is reported as a Logon and Logoff together

—————————————————–

Active Auditing

T6061, T6465 Wiretap event rate display maximum of 25 events / s

Wiretap Watch window is limited to displaying events at a maximum of 25 events/s.  If there are more than 25 event/s which match the Wiretap filter this will result in events being dropped and not displayed.

Workaround: Define filter with smaller scope by adding a user and defining more precisely the path in the filter.  A report may also be run using same filter to retrieve all related results.

—————————————————–

T7500  DLP Known Limitations

DLP Active Auditing has following Known Limitations:

• Small Files DLP threshold affected by PowerScale Quota Usage Reporting

For small files, PowerScale Quota Usage reports a larger usage than actual storage consumed.  When setting a DLP threshold you must consider the threshold% against the quota reported usage.  For example, if actual space consumed by 1 small files is 20b but quota usage is reported by PowerScale as 8K then the threshold to detect copy of that file is not 100%, it is 20b/8K.

• DLP generate 1 signal when threshold crossed for any size of copy

Any copy that crosses the configured threshold will generate only 1 signal - whether the copy is one time the threshold configured or many times the threshold configured.

—————————————————–

T7525 Active Auditor Affected Files also shows Ransomware Defender Affected Files

When viewing the Affected Files for an Active Auditor event, any files associated wtih a Ransomware Defender event that has occurred at the same time are also displayed.

Workaround: Download the csv file and use the path associated with the Active Auditor event from the GUI to filter the results.

—————————————————–

T8744 No event processing once Signal Strength passes 2 times Critical Threshold

For the case where both Ransomware Defender and Easy Auditor are licensed, reaching Signals processed count of 2 times Ransomware Critical threshold for a particular user will stop processing events for both Ransomware Defender and Active Auditor. This would only be a factor in the unlikely event that a Ransomware Security event and Active Audit event (Mass Delete, DLP) occurred at the same time for the same user.

Workaround: None available.

—————————————————–

General

T8281 hbase major compaction affects queries

An hbase major compaction will prevent queries happening at the same time from completing.

Workaround: Re-run query once hbase major compaction has completed.

—————————————————–