User manual JUNIPER NETWORKS STRM LOG MANAGEMENT 2008.2 RELEASE NOTES 6-2008

[. . . ] License Keys - The License key functionality is now enhanced in the STRM Log Management interface to include individual license keys for each system in your deployment. - · New Device Extensions Functionality - You can now modify how a DSM parses logs. For example, you can use a device extension to detect an event that has missing or incorrect fields. A device extension can also parse an event when the DSM to which it is attached fails to produce a result. Universal DSM Enhancement - With STRM Log Management 2008. 2, the Universal DSM includes the following enhancements: Device Extensions - Allows you to use the new device extensions functionality to enhance the DSM parsing of your logs. [. . . ] Updating License Key When Using Internet Explorer 6 No Longer Causes Error Previously, when you updated your license key using an Internet Explorer 6 browser, a window appeared stating "The page cannot be displayed" when you click Save. New Administrative User Now Able to Access Deployment Editor A STRM Log Management administrative (admin) user can create multiple admin accounts for a STRM Log Management system. A administrative user should have unrestricted access to all components of your deployment. Previously, when a new administrative user attempted to access the deployment editor, an error message appeared and access was denied. 530-025628-01 6 STRM Log Management Release Notes Deleting a False Positive Building Block Value No Longer Causes Error Previously, if you attempted to edit the User-BB-FalsePositive: User Defined False Positive Tunings Building Block to edit any of the configured values within the Building Block, the following error message appeared Invalid category id. Multiple Reports No Longer Generate From Single Template When Reports are Shared When you created a new report using the Report Wizard, you can generate the report by selecting the Would you like to run the report now?check box in the report wizard or request the completed report template to generate using the Reports Template interface. Previously, if the report was shared with other users, both options may have resulted in the generation of multiple reports appearing in the Generated Reports interface with Admin as the listed owner. Now Able to Add 200 CIDRS for a Network Object Previously, the limit of CIDR range(s) you could add to the network object was 70. If you attempted to add more than 70 CIDR range(s), an error appeared. In STRM Log Management 2008. 2, the limit of CIDR ranges you can add is approximately 200, depending on the data on your system. Now Able to Apply Any IP Filter When Searching for Events Previously, when you attempted to filter in the Event Viewer using the Any IP filter option, invalid results appears. Now, in STRM Log Management 2008. 2, this no longer occurs and valid search results appear. Now Able to Filter on Device Type Using Right-Click Option in Aggregate Display Using the Display drop-down list box in the Event Viewer, you are able to view events using one of the available aggregate options. Previously, if you selected the Device Type option in the Display drop-down list box, you were not able to access the Filter menu using the right mouse button (right-click) for the Device Type column. Now Able to Use Exclamation Point (!) In LDAP Authentication Passwords Previously, when defining a password for your LDAP authentication, if you entered an exclamation point (!) as part of your password, the password was rejected. Now Able to Use Same IP Address for Off-Site Source and Target Previously, when configuring off-site source and target in the deployment editor, an error appeared if you attempted to use the same IP address for the source and target. This no longer occurs. 530-025628-01 Resolved Issues 7 Restoring Configuration Now Create Proper Directory Structure Previously, when restoring configuration information on a new Console system, the /store/db directory was not properly created. In STRM Log Management 2008. 2, this directory structure is properly created. Events Appear in Event Viewer and Flows in Flow Viewer After June 30, 2008 The Event Correlation Engine license expires on 30 June 2008. STRM version 2008. 2 extends the Event Correlation Engine license until December 2009. In the future, there will be a software upgrade that will eliminate the requirement for this license. 530-025628-01 8 STRM Log Management Release Notes Known Issues and Limitations This section describes the known issues and limitations for the following areas: · · · · General System Configuration Event Viewer Reports General Upgrade May Fail with Custom SSL Certificate The upgrade of STRM may fail if your deployment meets both of the following conditions: · · You use a custom SSL (trusted) certificate, rather than the default certificate shipped with STRM, somewhere in your deployment. The custom certificate has an Intermediate key. Not all trusted certificates have an Intermediate key. [. . . ] Unable to Remove Custom Event Mapping Once you create a custom event mapping using the event mapping tool in the Event Viewer, you are able to edit the mapping, however, you are unable to remove the event mapping or restore default settings. Reports Size of Pie Charts in Reports is Dynamic When creating a report that includes pie charts, the chart size depends on the area consumed by the legend. Pie charts with only a single item in the legend are much larger than pie charts with many items in the legend. Workaround: Reduce the number of items you wish to display in the pie chart. 530-025628-01 Known Issues and Limitations 11 Revision History June 2008--Revision 1. [. . . ]