Skip to main content

Data LakeExabeam Data Lake i40 Release Notes

Version: i40

Table of Contents

Known Issues in Data Lake i40

LMS-16688

The Syslog default forwarder filters that contain \\\ (three slashes) are not working and the logs are not transferring from Data Lake to Advanced Analytics as expected.

This is due to extra \\\" syntax being included in the forwarder filter line.

For example, the default Microsoft Azure forwarder filter line:

...or "CEF:" and "destinationServiceName=Office 365" and "description\\\":\\\"Log on\\\"" or...

Would fail to forward a log containing:

...destinationServiceName=Office 365 "dash":"","description":"Log on","genericEventType"...

Workaround

Copy and paste the default forwarding filter in notepad, remove all the extra unnecessary slashes, and then create a custom forwarding filter without these slashes.

LMS-15907

**This issues was resolved in i40.7**

Token authentication is temporarily not working in Data Lake versions i40.3, i40.4 and i40.5. In these versions, cookies are required for API authentication.

LMS-15779

**This issues was resolved in i40.5**

With Data Lake i40.4, index patterns do not auto-update as new log sources are introduced, even when parser field extraction is occurring for these fields. As a result, dashboards, reports and visualizations that contain newly introduced index fields are not visible.

If you have already upgraded to Data Lake i40.4, please see the Community Notice for instructions on how to manually refresh the index entries, or upgrade to Data Lake i40.5, where this issue is resolved.

LMS-15089

When you enable a valid S3 archiving destination to Data Lake, it fails with a Connection Refused error and elastic node-a goes down.

There is a workaround for this issue, please reach out to the Exabeam Customer Success Team for this workaround.

DLA-3653

**This issues was resolved in i40.7**

If a saved search produces no results, you are unable to change the access control on it, to share that query. As a workaround, you must prepare a search with the proper sharing permissions first, before you modify and save the query.

DLA-3637

**This issues was resolved in i40.6**

After upgrading to i40.3, if you are not connected to the internet, the Data Lake web interface may not render properly. This is due to Data Lake relying on resources (such as fonts) from external parties.