User manual NOVELL SENTINEL 6.1.1.0 README

[. . . ] Novell SentinelTM 6. 1. 1. 0 Novell® March 17, 2009 These are the release notes for the Sentinel 6. 1. 1. 0 (6. 1 SP1) Release. Section 1, "Overview, " on page 1 Section 2, "New Features in Sentinel 6. 1, " on page 2 Section 3, "Prerequisites, " on page 2 Section 4, "Installation, " on page 3 Section 5, "Sentinel Database Patch Installation, " on page 4 Section 6, "Post-Installation, " on page 7 Section 7, "Defects Fixed in Sentinel 6. 1 Release, " on page 8 Section 8, "Known Issues in Sentinel 6. 1. 1. 0 Release, " on page 12 Section 9, "Documentation Conventions, " on page 12 Section 10, "Legal Notices, " on page 13 1 Overview The information in this Release Note file pertains to Novell SentinelTM 6. 1. 1. 0, which provides a real-time, holistic view of security and compliance activities, while helping customers monitor, report, and respond automatically to network events across the enterprise. This Service Pack will apply the latest software fixes and enhancements to an existing installation of Sentinel 6. 1, including the updates in Sentinel 6. 1 Hotfix 1 (6. 1. 0. 1). Sentinel 6. 1 must already be installed before applying this Service Pack. The Service Pack must be installed on all existing Sentinel 6. 1 installation machines, client and server. [. . . ] If there are no errors, you are done with the Sentinel Database patch. If there are errors, resolve the errors and re-run the PatchDb utility. Novell SentinelTM 6. 1. 1. 0 5 9 Restart the Sentinel services on all machines: On Windows, use Windows Service Manager to start the "Sentinel" services. On *NIX, run $ESEC_HOME/bin/sentinel. sh start 5. 2 Sentinel Database Patch Installation on SQL Server The following steps must be performed on the machine with a Microsoft SQL Server database to prepare the database for 6. 1. 1. 0. There is one main patch script for SQL Server (PatchDb. bat). There are several prerequisites for applying the SQL Server patch. The patch must be copied to the machine that is running the Sentinel database. The patch must be run by using the Sentinel Database User credentials, or esecdba if you are using SQL Authentication. SQL Server Database instance name, if any. Port number of the SQL Server database. Name of the SQL Server database to patch (ESEC by default). esecdba user password. After you press Enter the final time, the script verifies the entered information and proceeds if authentication is successful. 8 After the script is done applying the patch, check for any errors. If there are errors, resolve the errors and re-run the PatchDb utility. 9 After the patch runs with no errors, "Sentinel" services should be restarted. 6 Post-Installation After running the installer, some additional updates may be necessary. By default, the Sentinel Control Center (SCC) uses a date and time format that is appropriate for the locale for which the Sentinel Control Center is configured, but that default can be overridden. For formatting details on customizing the date and time format in event field in Sentinel Control Center, see the Java Web site (http://java. sun. com/j2se/1. 5. 0/docs/api/java/text/SimpleDateFormat. html). 1 Edit the SentinelPreferences. properties file. On Windows: %ESEC_HOME%\config\SentinelPreferences. properties On *NIX: $ESEC_HOME/config/SentinelPreferences. properties 2 Uncomment the following line and modify to customize date and time format for Sentinel Control Center event date/time fields. com. eSecurity. Sentinel. event. datetimeformat=yyyy-MM-dd'T'HH:mm:ss. SSSZ Novell SentinelTM 6. 1. 1. 0 7 7 Defects Fixed in Sentinel 6. 1 Release This section lists the defects fixed in the Sentinel 6. 1 Hotfix 1 and Sentinel 6. . 1. 1. 0 Release. Section 7. 1, "Defects Fixed in Sentinel 6. 1. 1. 0 Release, " on page 8 Section 7. 2, "Defects Fixed in Sentinel 6. 1 Hotfix 1, " on page 10 7. 1 Defects Fixed in Sentinel 6. 1. 1. 0 Release This section lists the defects fixed in the Sentinel 6. 1. 1. 0 Release. "Advisor fixes" on page 8 "Performance enhancements" on page 9 "General fixes" on page 9 7. 1. 1 Advisor fixes Table 1 Defects fixed in Sentinel 6. 1. 1. 0 Release Defects Number Description 452478 and 452476 Issue: Advisor server is not downloading the latest CVE. FIXED: Data quality issues in the Advisor data feed have been fixed to provide more complete data and more accurate CVE information. 452473 Issue: Advisor feed failed to be processed by the client. FIXED: Advisor data feed have been fixed to provide complete data. 451602 Issue: Cannot reliably download feed files. FIXED: Improved error handling of corrupted file downloads in Advisor. 451723 Issue: A manual clean up of the partially downloaded file is required, If the Advisor download is interrupted in the middle (like downloading partial feed file). FIXED: Partial or corrupted feed files are re-downloaded by Advisor client and all feed files will be then processed. 451601 Issue: Cannot reliably download feed files. FIXED: Partial or corrupted feed files are re-downloaded by Advisor client and all feed files will be then processed. 8 Novell SentinelTM 6. 1. 1. 0 7. 1. 2 Performance enhancements Table 2 Defects fixed in Sentinel 6. 1. 1. 0 Release Defects Number Description 465935 Issue: Slow performance when querying mssql. [. . . ] To customize date and time format in event time stamp fields in the Sentinel Control Center and related exports to . csv or . html files, modify %ESEC_HOME%\config\SentinelPreferences. properties on Windows, $ESEC_HOME/config/SentinelPreferences. properties on Solaris and Linux to the format you desire. Uncomment the following line in the file: #com. eSecurity. Sentinel. event. datetimeformat=yyyy-MMdd'T'HH:mm:ss. SSSZ The date and time format can be modified using the formatting information on the following web page: Class SimpleDateFormat (http:// java. sun. com/j2se/1. 5. 0/docs/api/java/text/SimpleDateFormat. html) By default, the Sentinel Control Center will use a pattern appropriate for the locale for which it is configured. This property gives the user the ability to override this default. DAT-366 Issue: Inability to manage SENT_AUDITD tablespace probably causing Sentinel to lock up. Perform partitioning and archiving of data in the SENT_AUDITD tablespace. 8 Known Issues in Sentinel 6. 1. 1. 0 Release This table lists the known defects in the Sentinel 6. 1. 1. 0 Release. Table 5 Known defects in Sentinel 6. 1. 1. 0 Release Defects Number Description DAT-375 Issue: PatchDB fails when Audit Record table is large. [. . . ]