Software Releases
Release 2.5.6 - Release Notes Easy Auditor

What’s New in Superna Eyeglass Easy Auditor Edition

Release 2.5.6

What’s New! In Superna Eyeglass Easy Auditor Edition Release 2.5.6 can be found here.

Supported OneFS releases











Supported Eyeglass releases

Superna Eyeglass Easy Auditor Version

Superna Eyeglass Version









Inter Release Functional Compatibility

OneFS 8.0 -

OneFS 8.0.1

OneFS 8.0.1 -

OneFS 8.1

OneFS 8.0 -

OneFS 8.1

OneFS 8.0.x , 8.1.x - OneFS 8.2.x






Active Auditing





End of Life Notifications

End of Life Notifications for all products are available here.

Issues Fixed in 2.5.6

Enhancements and Fixes in 2.5.6-20263

Refer to Enhancements/Fixes in previous 2.5.6 versions.

Enhancements and Fixes in 2.5.6-20258

New: Where Did My Folder Go default results retrieved increased to 5000

The Where Did My Folder Go default results retrieved for files or folder search has been increased to 5000.


T16668 Cannot load saved Built-In Query

A saved Built-In Query cannot be loaded or acted upon. After attempting to load a saved query the Eyeglass desktop window appears blank.

Resolution: A saved Built-In Query can now be loaded and run.


Enhancements and Fixes in 2.5.6-20158


New: T16126 Logon/Logoff event report now generated from Report Query Builder

Report for Logon/Logoff audit events is now generated from the Easy Auditor -> Query -> Report query Builder window. Built-In Query for Logon/Logoff has been removed. From the Report Query Builder select

Path: Select the cluster of interest and path /ifs (no other path can be selected as a path is not specified for a LOGON or LOGOFF audit event)

Event Type: LOGON and/or LOGOFF as required

Query can be further filtered by User Name and TIme Frame as required.

Note that in the Report, the Powerscale Cluster will appear in the Cluster column. Path is also populated but with Systemnull value as the LOGON/LOGOFF events are not associated with a path.


Active Auditing

New: T15327 Where Did My Folder Go now also reports on File Rename and File Delete Events

Easy Auditor -> Active Auditing -> Where Did My Folder Go window by default will continue to search for Folder Renames and Deletes but now includes the option to perform the same search for File Rename and Delete events. Select the Folder path as before as well as timeframe then select either Folder or Files as the subject of the search. With the addition of this capability you will see following additional changes as well:

- Time Frame for the search is now a Start time with a configurable number of hours to bound the search backwards in time: 1, 2, 4, 6 or 24 hours

- Total records retrieved is limited to a maximum number of records returned. If your search returned matches equal to the limit you may need to further narrow your search by either modifying the path or picking a shorter timeframe to find your result. Note that records retrieved contain both delete and rename events, the Show Deleted Objects checkbox will only filter them in the GUI.

Documentation details can be found here.

Fixed in 2.5.6-20084


T15359 Backup & Restore does not restore Ransomware Defender or Easy Auditor settings

A Backup & Restore does not restore the Ransomware Defender or Easy Auditor settings

Resolution: Ransomware Defender settings now restored on restore from 2.5.5 to 2.5.6. THere is no restore of settings from release 2.5.4 and earlier. For release 2.5.4 and earlier continue to capture all Ransomware settings (False Positive, Ignore List, Allowed Extensions Security Guard) and Easy Auditor settings (Active Auditor Trigger settings, RoboAudit). Post restore verify settings and update where required before cluster up on ECA. Following expected to not be restored on an AnyRelease restore: Ransomware Defender Event History, Threats Detected, Easy Auditor: Finished Reports, Scheduled Reports, Saved Queries.


T15834 Bulk Ingest of Old Audit Data not functional

The ability to bulk ingest old audit data is not functional as of 2.5.6 release.

Resolution: Bulk ingest of old audit data is now functional.

Technical Advisories

Technical Advisories for all products are available here.

Known Issues


T5907 No record for failed user query in Finished Reports

If a user based query fails, there is no record of the failed report in the Finished Reports.  

Workaround: None Required - Email notification is provided for the failed query.

This does not affect path only queries.


T6145 User with Eyeglass read-only position cannot run a custom query

In the Report Query Builder a user who only has read-only permissions can only Load a previously save query to review it’s setting. From this interface no load can be run.

Workaround: Administrator with full privileges must create and save a query after which a user with read-only permission can then run it from the list.


T6149 Count Table and Access Report queries store unnecessary query parameters

If you save the Count Table or Access Report query, disabled report parameters may be saved with the report definition even though the do not apply.

Workaround: None required.  Extra parameters are ignored.


T6293 Stale Access Report and Access Report display Cluster GUID instead of Cluster Name

In the Stale Access and Access Reports, the cluster is identified by its GUID instead of displaying the cluster name.  

Workaround: To verify which cluster the report is for, from the Eyeglass web open the Inventory View.  Right click on a cluster name and select “Show Properties” to view the cluster GUID.


T6313 Report Query Builder allows filter on Unlicensed Cluster

The Report Query Builder does not block selection of an unlicensed cluster.  

Workaround: None required.  File activity / events are not stored for unlicensed clusters and as such any report would return with 0 records.


T6338 File Ext Input only in first line

Report Query File Ext filter is only editable in first line.  Clicking anywhere else in the box will not let you enter any text

Workaround: None required.  Enter File Ext filter at the top of the box.


T6339 Report Query Naming

Saved Report Query names can only contain 0 to 9, a to z (lowercase) and A to Z (uppercase) without any spaces, - or _ .

Workaround: None available.


T6349 Running Report Job State does not immediately reflect a cancelled Job

When a Running Auditor Job is cancelled, the Running Jobs view continues to show the Running state until the cancel task has been completed in its entirety.

Workaround: None required.


T6350 Easy Auditor Running Reports window inactive

The Easy Auditor Running Reports window may become inactive such that expired reports are not removed and you cannot click on a Report to see details of the execution.

Workaround: Refresh the browser session.


T6404 Saved Custom User Queries show unrelated Built In Query

A saved Customer User Query details will incorrectly show

Report Picker: Data access report - users who are writing most/least amount of data

even though this custom report is not related to this built in query.

Workaround: None required - other query information is relevant and accurate.


T7049 Finished Report display issue for Duration

Finished Report Duration column does not display the entire duration required to complete the query.

Workaround: None available.  The duration can be seen in the Running Jobs view while the query is still in running state.


T7049 Finished Report display issue for Duration

Finished Report Duration column does not display the entire duration required to complete the query.

Workaround: None available.  The duration can be seen in the Running Jobs view while the query is still in running state.


T7437/T12178 Employee Exit Report may not complete

In large environment with high event rate, the 30 day Employee Exit Report may not complete or it may complete with a large number of records but viewing/download of results limited to 10,000 records.

Workaround: Modify the query for less than 30 days to reduce number of records in report or build a custom report using the Report Query Builder.


T7823 Email Report shows success when error with attachment

Emailing report shows as success even when there is an issue in attaching the report.

Workaround: Re-run the report or contact support at for assistance.


T9837  Warning on Wait for Spark Job

A Warning may appear on a Running Report Job Details for the Wait for Spark Job step with info “warning: Applicationid could not be retrieved” without impacting the completion of the query itself.

Workaround: None required


T10911 Share/Stale Access Report issue when AD has nested groups

The built in Share Access and Stale Access Reports do not show user access to a share for those users that are members of a nested subgroup of the AD group configured in the share permissions.

Workaround: None available.


T11752 Custom Real-time Audit policy User selection filtering

To select a name from the User drop-down list on a Custom Real-time Audit policy trigger you must first type the first letter of the user domain (name format is DOMAIN\name) after which you can type any other letter from user name for further filtering. Leave a space between first letter and next letter if letters are not adjacent in user name. Example below

Workaround: None required.


T11890 Able to save query without a name

The GUI allows saving of query without name.  Query can be run but cannot be deleted.  Only one query without a name will be able to be saved.

Workaround: Enter name when saving a query.


T13573 Delete parent folder with subfolders shows duplicates in Where Did My Folder Go

Where Did My Folder Go search results for a parent deleted folder where subfolders were also deleted duplicates entries for some folders.

Workaround: None required


T14722 Issues with custom report where path selected contains special language characters

Custom report where path selected contains special language characters may either not run or will complete with 0 results.

Workaround: Selecting a path higher up in the directory tree without special language characters may return results where special language characters not displayed correctly. Note that Wiretap and Where Did My Folder Go provide an option for reporting on these paths.


T15037 Easy Auditor does not report files with multiple extensions correctly

For the case where a file has multiple extensions in the Easy Auditor report the first extension only is reported. For example file.pdf.gz is reported as a pdf not as a gz file.

Workaround: None available.

T15582 Easy Auditor issues where path has & or brackets

Easy auditor has following issues for path with &:

- user or path search where path contains & return 0 results

- DLP trigger cannot be saved where path contains &

- Mass Delete trigger where path contains & returns 0 results

Workaround: Select path above path with & when defining custom search, DLP or Mass Delete triggers

Easy auditor has following issues where path contains bracket

- Wiretap, Where did My Folder Go, Active Auditor triggers not functioning

Workaround: No workaround available


T20661 Large Report cannot be downloaded from Windows

There is an issue downloading reports with very large number of records from Windows using Chrome browser. On download a "Loading" message appears but once the Loading message stops, no download is started. This issue does not appear on MAC with Chrome browser.


1) On Windows, large reports can be successfully downloaded using Firefox browser build 72

2) The file is generated and present on the Eyeglass appliance and could be retrieved using a tool such as WinSCP. The report files are located on the Eyeglass appliance in the folder: /srv/www/htdocs/csv 

Active Auditing

T8878 Cannot save DLP trigger for a different NE but same path

With 2 licensed clusters a Data loss prevention policy cannnot use the exact same path on both clusters if entering 2 differnent policies one for each cluster.

Work around:  none only the first cluster and path can be added.


T6305 Invalid username causes Wiretap error

If you enter an invalid username that cannot be resolved when setting up a Wiretap active auditing job it causes the job creation to fail with the following error:

Failed to create new wiretap:

Server error when processing request: java.lang.NullPointerException

Workaround: Enter a username that can be resolved in the documented supported format.


T7547  Wiretap does not show user name for NFS events

For events generated over NFS protocol, Wiretap does not include user name in the event information. Only client IP address is displayed.

Resolution: A custom query can be built using the Report Query Builder based on path and timeframe in order to view user name.


T12876 DLP trigger cannot be added

An error (Error saving response) occurs when adding a DLP trigger if there is an existing directory quota without data-protection overhead option enabled on the the path that a DLP trigger is being configured for.

Workaround: If possible, delete the existing quota and allow new quota to be created as part of adding the DLP trigger. Note that the directory quota that is created will be created with the data-protection overhead option enabled.


T15198 Active Auditor Triggers may have inaccurate Signal Strength

Active Auditor trigger processing (DLP, Mass Delete, Custom Triggers) may receive duplicate events and as a result show a higher Signal Strength than is actually the case.

Workaround: None required. The duplicate events will cause early detection of configured triggers. The associated CSV for files involved in the detection is correct.


T15250 The command to reset Active Auditor event queue must be run twice

The command igls adv eventTriggers set --operation=reset --topic=ea must be run twice to clear the queue.

Workaround: Execute the command a second time to clear the queue.


T16978 Display of Files for Mass Delete always shows 1 file

On the GUI for Active Auditor > Active Events as well as in associated alarm information the number of affected files is always displayed as 1. This is a display issue only. The number of files configured in the trigger was correctly used in the detection.

Workaround: To see the full list of files, download the report containing the files by selecting the Files link in teh GUI and then Affected Files - CSV.


T16980 Active Auditor events Affected Files-CSV may not show all events

Under some circumstances the Affected Files-CSV may not show all events for the Active Auditor trigger as the timeframe for the report may result in some events being excluded.

Workaround: Use the Report Query Builder to run a query with the same conditions and user as the associated trigger and a timeframte that starts before the detected time. Typically starting query an hour prior to the event would ensure all events were listed but may also include some audit events that are not related to to the trigger.

Robo Audit

T8694 Robo Audit may show Success when it did not run

Robo Audit may show as having successfully completed when in fact it did not run. For example:

  • Robo Audit configured but disabled

  • Robo Audit misconfigured and enabled

Workaround: Open the Robo Audit logs to see details of Job Execution.


T11880 Robo Audit fails when configured to run on more than one cluster

When configured to run on more than one cluster, Robo Audit job will succeed for one cluster but fail for subsequent cluster.

Workaround: Configure Robo Audit to only run on one cluster.


T15175 Existing Robo Audit Logs lost formatting after upgrade to 2.5.6

Any existing Robo Audit logs viewed from the Eyeglass GUI will have lost the formatting after upgrade to 2.5.6.

Workaround: None required. New logs will have correct formatting.



T5858  ecactl commands do not switch to ecaadmin user

If you are logged into an ECA node as root user and execute an ecactl command, you are prompted to login as the ecaadmin user to continue but even though the console indicates that the login as ecaadmin is underway the login never completes and the command cannot be executed.   

Workaround: Login to ECA as ecaadmin user when using ecactl commands.


T5915  Event retrieval stopped by Disable/Enable of Protocol Monitoring on the PowerScale

If you disable / enable Protocol Auditing on the PowerScale cluster the ECA does not recover and does not begin reading events once Protocol Auditing enabled again.

Workaround: If you need to disable/enable Protocol auditing down the ECA cluster first

    Ecactl cluster down

Then disable Protocol Auditing on the PowerScale cluster

After you have enabled Protocol Auditing on PowerScale cluster, the bring the ECA back up:

      ecactl cluster up.


T6004  PowerScale Directory Selector Usage

In order to populate a cluster in the Directory Selector a directory must be selected in the file tree.   

Workaround: None required. Once cluster is populated a path can be selected from the tree or typed in but must begin with /ifs .


T15457 HTML 5 vmware vcenter bug on OVA deployment

 Some versions of vmware vcenter HTML user interface have a known issue with OVA properties being read correctly post power on, leading to first boot issues.

Workaround: use the Flash client as a work around.


T6097  UI Desktop Unexpected Behaviour

If you move a window to the edge of the Eyeglass desktop it may become stuck in that position.   

Workaround: Refresh browser.


T6617  PowerScale Directory Selector does not display hidden directories

Directories that start with a dot (.) are not displayed in the PowerScale Directory Selector.   

Workaround: Use the PowerScale Directory Selector to enter \ifs\ and then enter the remainder of the path manually.


T8091  Login Monitor Report does not have Sorting

When viewing the Login Monitor Report Built-In query results from the GUI, sorting on columns Logons, Logoffs, and failed Logons is not available.  

Workaround: Download the report csv file and open in spreadsheet for sorting and filtering of data.


T8105 Alarm EAU0002 has no detailed information for failed auditor report

The alarm Info for EAU0002 alarm "Auditor report failed" does not have any detailed information on cause of report failure.

Workaround: In Easy Auditor / Running Reports tab select the report that failed and in the Job Details expand the tree and select the Info link for the failed step.


T8249 Canceling Easy Auditor Running Report results in Critical severity alarm

Cancelling a running auditor report results in a Critical Severity alarm.

Workaround: None required. This alarm is informational only and does not indicate any critical issue in Easy Auditor.


T13539 PowerScale Directory selector missing directories

The PowerScale Directory selector currently has a maximum list size of 1000 so that environments with more than 1000 directories on the PowerScale will be missing directories in the directory selector.

Workaround: Use the PowerScale Directory Selector to enter \ifs\ and then enter the remainder of the path manually.


Known Limitations


Conditions under which audit events are not processed

In the following situations audit events will not be processed and any audit events which occur while processing is down are dropped - they are not recovered by post processing:

  • ECA NFS mount is down: Each ECA node is responsible for reading audit events for a specific set of PowerScale nodes.  While the ECA NFS mount is down, audit events for these PowerScale nodes are dropped.

  • ECA down: Each ECA node is responsible for reading audit events for a specific set of PowerScale nodes.  While the ECA NFS mount is down, audit events for these PowerScale nodes are dropped.


T6260 Stale Access Report Known Limitations

1) The Stale Access Report Built-In query does not report on activity for shares under following conditions:

  • Share access by AD user with run as root permissions
  • Share access by AD group where AD group has nested group and access by user in sub-group
2) With nested share topology, share access will be reported for "parent" share and "child" share when access was done via "child" share. For example, if PowerScale is configured with the default /ifs share, access by any other share will also be reported as access via the /ifs share.


T6361 Reporting for shares with local user permissions unsupported

Reports generated against shares which have a local PowerScale user permission configured may give unexpected results in the report and may cause email notification to fail.


T6478 Stale Access and Share Access Report AD User Limitation

Reports have been successfully generated against AD environment with up to 4000 users.  Reports against larger AD environments may fail.


T2842 Login Monitor Report Known Limitations

The Login Monitor Report Built-In query has following Known Limitations:

  • NFS login is not reported
  • Failed login due to invalid password, or invalid user are reported by user SID
  • A login where user does not appropriate share permission is reported as a Logon and Logoff together


T18936 Rerun of query required

Query may need to be re-run if the ECA OS product requirements have not been met for disk latency as this can cause search jobs to timeout in Eyeglass. The job may still complete by reviewing the finished jobs report tab. If the report shows error you will need to re-run the job. OS latency or memory issues can cause this and permanent fix should move the ECA VM's to flash based storage. This command can be run to look at disk statistics:

ecactl cluster exec iostat -xyz 6 6

This command will return a sample of disk IO per ECA. Consult documentation on latency requirements.

Active Auditing

T6061, T6465 Wiretap event rate display maximum of 25 events / s

Wiretap Watch window is limited to displaying events at a maximum of 25 events/s.  If there are more than 25 event/s which match the Wiretap filter this will result in events being dropped and not displayed.

Workaround: Define filter with smaller scope by adding a user and defining more precisely the path in the filter.  A report may also be run using same filter to retrieve all related results.


T7500  DLP Known Limitations

DLP Active Auditing has following Known Limitations:

  • Small Files DLP threshold affected by PowerScale Quota Usage Reporting

For small files, PowerScale Quota Usage reports a larger usage than actual storage consumed.  When setting a DLP threshold you must consider the threshold% against the quota reported usage.  For example, if actual space consumed by 1 small files is 20b but quota usage is reported by PowerScale as 8K then the threshold to detect copy of that file is not 100%, it is 20b/8K.

  • DLP generate 1 signal when threshold crossed for any size of copy

Any copy that crosses the configured threshold will generate only 1 signal - whether the copy is one time the threshold configured or many times the threshold configured.


T7525 Active Auditor Affected Files also shows Ransomware Defender Affected Files

When viewing the Affected Files for an Active Auditor event, any files associated wtih a Ransomware Defender event that has occurred at the same time are also displayed.

Workaround: Download the csv file and use the path associated with the Active Auditor event from the GUI to filter the results.


T8744 No event processing once Signal Strength passes 2 times Critical Threshold

Once a Security Event or Active Audit event has passed 2 times the Critical threshold configured in Ransomware Defender Settings, there is no further processing of Signals for the associated user. In all cases actions based on Critical threshold settings would have been already taken prior to reaching the 2x level.

For the case where both Ransomware Defender and Easy Auditor are licensed, reaching Signals processed count of 2 times Ransomware Critical threshold for a particular user limit is applied independently for Ransomware Defender and Easy Auditor.

Workaround: None available.


T11540 Active Auditor may report on Audit Failure events

Active Auditor may report on failed audit events.

Workaround: Reporting of failed audit events can be disabled on the PowerScale audit settings. Please contact for more information on disabling reporting on failed audit events.


T12380 Ransomware Defender Ignore List settings are applied to Active Auditor analysis

Analysis of file events for Active Auditor triggers will ignore an user, IP or path that is configured in the Ransomware Defender Ignore list.

Workaround: None available.



T8281 hbase major compaction affects queries

An hbase major compaction will prevent queries happening at the same time from completing.

Workaround: Re-run query once hbase major compaction has completed.


T16137 Anyrelease restore does not restore all Ransomware Defender and Easy Auditor settings

There is no restore of settings from release 2.5.4 and earlier. For release 2.5.4 and earlier continue to capture all Ransomware settings (False Positive, Ignore List, Allowed Extensions, Security Guard) and Easy Auditor settings (Active Auditor Trigger settings, RoboAudit). Post restore verify settings and update where required before cluster up on ECA.

In all cases, restoring an Eyeglass backup using the --anyrelease option will not restore following Ransomware Defender and Easy Auditor settings:

Ransomware Defender: Event History, Threats Detected

Easy Auditor: Finished Reports, Scheduled Reports, Saved Queries


Known Limitations

T16499 Easy Auditor reports double events

In some cases it will be expected that a single operation such as deleting a folder is reported by the SMB protocol or Isilon as multiple delete events that appear as duplicates.  Easy Auditor will record events as logged by Isilon and display all recorded events which may appear as duplicate but in fact is expected.

© Superna Inc