What’s New in Superna Eyeglass Easy Auditor Edition
What’s New! In Superna Eyeglass Easy Auditor Edition Release 2.5.2 can be found here.
Supported OneFS releases
Supported Eyeglass releases
Superna Eyeglass Easy Auditor Version
Superna Eyeglass Version
Inter Release Functional Compatibility
OneFS 8.0 -
OneFS 8.0.1 -
OneFS 8.0 -
End of Life Notifications
End of Life Date
None at this time
T5907 No record for failed user query in Finished Reports
If a user based query fails, there is no record of the failed report in the Finished Reports.
Workaround: None Required - Email notification is provided for the failed query.
This does not affect path only queries.
T6145 User with Eyeglass read-only position cannot run a custom query
In the Report Query Builder a user who only has read-only permissions can only Load a previously save query to review it’s setting. From this interface no load can be run.
Workaround: Administrator with full privileges must create and save a query after which a user with read-only permission can then run it from the list.
T6149 Count Table and Access Report queries store unnecessary query parameters
If you save the Count Table or Access Report query, disabled report parameters may be saved with the report definition even though the do not apply.
Workaround: None required. Extra parameters are ignored.
T6227 Finished Report display issue for Date Time Range
Finished Report Date Time Range may not correctly reflect the query date time definition. The display may show an incorrect date range or may be empty for some reports.
Workaround: None required. The data retrieved correctly reflects the query date time definition.
T6293 Stale Access Report and Access Report display Cluster GUID instead of Cluster Name
In the Stale Access and Access Reports, the cluster is identified by its GUID instead of displaying the cluster name.
Workaround: To verify which cluster the report is for, from the Eyeglass web open the Inventory View. Right click on a cluster name and select “Show Properties” to view the cluster GUID.
T6313 Report Query Builder allows filter on Unlicensed Cluster
The Report Query Builder does not block selection of an unlicensed cluster.
Workaround: None required. File activity / events are not stored for unlicensed clusters and as such any report would return with 0 records.
T6338 File Ext Input only in first line
Report Query File Ext filter is only editable in first line. Clicking anywhere else in the box will not let you enter any text
Workaround: None required. Enter File Ext filter at the top of the box.
T6339 Report Query Naming
Saved Report Query names can only contain 0 to 9, a to z (lowercase) and A to Z (uppercase) without any spaces, - or _ .
Workaround: None available.
T6349 Running Report Job State does not immediately reflect a cancelled Job
When a Running Auditor Job is cancelled, the Running Jobs view continues to show the Running state until the cancel task has been completed in its entirety.
Workaround: None required.
T6350 Easy Auditor Running Reports window inactive
The Easy Auditor Running Reports window may become inactive such that expired reports are not removed and you cannot click on a Report to see details of the execution.
Workaround: Refresh the browser session.
T6404 Saved Custom User Queries show unrelated Built In Query
A saved Customer User Query details will incorrectly show
Report Picker: Data access report - users who are writing most/least amount of data
even though this custom report is not related to this built in query.
Workaround: None required - other query information is relevant and accurate.
T6579 Timeout may prevent error on retrieving finished reports where large number of reports exist
When opening the Easy Auditor -> Finished Reports you may experience a comms failure error on population of the list. This is usually a result of default timeout expiring before being able to retrieve all records.
Workaround: Increase the timeout following steps below. Recommend to set to 60s and then try again. May require adjustment depending on latency in your environment and number of reports.
SSH to the eyeglass appliance as admin user
type password (default: 3y3gl4ss)
sudo su - (default password: 3y3gl4ss)
please change the ajax_get_timeout_seconds value to 60. Refer to screenshot below for example
:wq! // save the changes //
login to the eyeglass webpage and open Finished Reports and check whether error still present or resolves. You may need to clear browser cache to ensure new java script is loaded to the browser that includes the new timeout.
T7049 Finished Report display issue for Duration
Finished Report Duration column does not display the entire duration required to complete the query.
Workaround: None available. The duration can be seen in the Running Jobs view while the query is still in running state.
T5955 Wiretap Watch window cannot scroll horizontal
In the Wiretap Watch window you are not able to scroll in the horizontal direction in either section of the window.
Workaround: None available in Watch window. A report could be generated using same criteria and timeframe for review once event of interest are known.
T6074 Wiretap Open Files List not updated
File which is added to the Wiretap Open Files list may not be removed when the file is closed.
Workaround: None required. The real time event display will indicate which files are actively open.
T6305 Invalid username causes Wiretap error
If you enter an invalid username that cannot be resolved when setting up a Wiretap active auditing job it causes the job creation to fail with the following error:
Failed to create new wiretap:
Server error when processing request: java.lang.NullPointerException
Workaround: Enter a username that can be resolved in the documented supported format.
T6466 Deleted Wiretap not removed from filter processing
When you delete a Wiretap from the Eyeglass GUI, it is no longer displayed and cannot be selected but in the backend it continues to be active and filter is applied to incoming events. If the deleted filter has a broad scope, it may result in dropped events for a smaller scope query as per Known Limitations T6061/T6465.
Workaround: Contact support for assistance in resolving this issue.
T6467 Wiretap Event type blank for Directory Create / Delete, File Create, File Set ACL, Directory Rename
The Wiretap Watch window Event type column is empty for following event types:
File Set ACL
Workaround: None Available in the Watch window. You may run a report with the same filter and timeframe to review these events.
T5678 Manage Services CPU and RAM show n/a
The CPU and RAM information for the ECA components is not populated.
Workaround: ssh to each ECA node and execute the following command to see the CPU and RAM for each component:
T5858 ecactl commands do not switch to ecaadmin user
If you are logged into an ECA node as root user and execute an ecactl command, you are prompted to login as the ecaadmin user to continue but even though the console indicates that the login as ecaadmin is underway the login never completes and the command cannot be executed.
Workaround: Login to ECA as ecaadmin user when using ecactl commands.
T5915 Event retrieval stopped by Disable/Enable of Protocol Monitoring on the Isilon
If you disable / enable Protocol Auditing on the Isilon cluster the ECA does not recover and does not begin reading events once Protocol Auditing enabled again.
Workaround: If you need to disable/enable Protocol auditing down the ECA cluster first
Ecactl cluster down
Then disable Protocol Auditing on the Isilon cluster
After you have enabled Protocol Auditing on Isilon cluster, the bring the ECA back up:
ecactl cluster up.
T6004 Isilon Directory Selector Usage
In order to populate a cluster in the Directory Selector a directory must be selected in the file tree.
Workaround: None required. Once cluster is populated a path can be selected from the tree or typed in but must begin with /ifs .
T6097 UI Desktop Unexpected Behaviour
If you move a window to the edge of the Eyeglass desktop it may become stuck in that position.
Workaround: Refresh browser.
T6450 some ecactl commands result in error
The following ecactl commands have an error:
ecactl cluster status
To verify hbase tables:
ecactl db shell
HBase Shell; enter 'help<RETURN>' for list of supported commands.
Type "exit<RETURN>" to leave the HBase Shell
Version 1.2.6, rUnknown, Mon May 29 02:25:32 CDT 2017
5 row(s) in 0.2570 seconds
=> ["inv", "report", "signal", "stats", "user"]
To verify hdfs connectivity:
ecactl cluster hdfs-status
T6451 Extra ECA Node listed in Manage Services with IP 0.0.0.0
The Manage Services window may show an additional ECA Node with IP address 0.0.0.0. It is Inactive and therefore results in an ECA Node Inactive alarm. Otherwise has no negative impact on functionality.
Workaround: Remove the extra ECA node with IP address of 0.0.0.0 from Manage Services by selecting the associated “x”.
Conditions under which audit events are not processed
In the following situations audit events will not be processed and any audit events which occur while processing is down are dropped - they are not recovered by post processing:
ECA NFS mount is down: Each ECA node is responsible for reading audit events for a specific set of Isilon nodes. While the ECA NFS mount is down, audit events for these Isilon nodes are dropped.
ECA down: Each ECA node is responsible for reading audit events for a specific set of Isilon nodes. While the ECA NFS mount is down, audit events for these Isilon nodes are dropped.
T6361 Reporting for shares with local user permissions unsupported
Reports generated against shares which have a local Isilon user permission configured may give unexpected results in the report and may cause email notification to fail.
T6478 Stale Access and Share Access Report AD User Limitation
Reports have been successfully generated against AD environment with up to 4000 users. Reports against larger AD environments may fail.
T6061, T6465 Wiretap event rate display maximum of 25 events / s
Wiretap Watch window is limited to displaying events at a maximum of 25 events/s. If there are more than 25 event/s which match the Wiretap filter this will result in events being dropped and not displayed.
Workaround: Define filter with smaller scope by adding a user and defining more precisely the path in the filter. A report may also be run using same filter to retrieve all related results.
Copyright Superna LLC