Geneos Upgrade Notes

Apache Log4j library

Upgraded the Apache Log4j library to fix the following vulnerabilities:

• The Apache Log4j library in the Active Console, Web Dashboard, Terracotta Messaging integration, and VMware Monitor integration, has been upgraded to 2.17.0 to fix the security vulnerability in Apache Log4j (CVE-2021-45105). We recommend upgrading to the latest version Geneos 5.11.3 or newer.

• The Apache Log4j library in the Active Console, Web Dashboard, Terracotta Messaging integration, and VMware Monitor integration, has been upgraded to 2.16.0 to fix the security vulnerability in Apache Log4j (CVE-2021-45046). We recommend upgrading to the latest version Geneos 5.11.2 or newer.

• The Apache Log4j library in the Active Console, Web Dashboard, Terracotta Messaging integration, and VMware Monitor integration, has been upgraded to 2.15.0 to fix the security vulnerability in Apache Log4j (CVE-2021-44228). We recommend upgrading to the latest version Geneos 5.11.1 or newer.

Dynamic Entity mapping

Netprobe 5.11.0 introduced changes to the Dynamic Entities wherein additional checks are now made to ensure new metric data points being added to an existing entity have a consistent set of dimensions and attributes. As a result of this change, your current Dynamic Entity mapping configuration may reject metric data points that were previously accepted.

You will see the rejected metric in the Dynamic Entity plugin dataview with the reason Entity Dimension clash. Make sure that all metric data points mapped to a single entity have the same set of dimensions and attributes.

Further, Netprobe 5.11.0 removed the old Dynamic entities > Mappings configuration that was first introduced in Geneos 5.1.0. This configuration has already been deprecated and was replaced by more simplified Dynamic entities > Mapping configuration in Geneos 5.7.0.

Publisher plugin

Publisher plugin has been updated so that Success, Failed, and Lost columns no longer just accumulate the number of events. Instead, the columns now show the number of occurrence of each event for each sample interval. We recommend that you review the existing rules that you have set in the Publisher plugin configuration.

Netprobe package files per platform

Beginning Geneos 5.9.1, the libssl.so.1.1 and libcrypto.so.1.1 libraries are renamed to libsslgeneos.so.1.1 and libcryptogeneos.so.1.1 respectively for generic Linux and Linux on IBM POWER8 platforms to eliminate the dependency of libcurl to these libraries, and to reduce compatibility issues such as the following scenarios:

• When the Netprobe is run under elevated privileges in Linux, the runtime loader of Linux (ld.so) ignores the RPATH and LD_LIBRARY_PATH, so the Netprobe is unable to load the libraries from <netprobe directory>/lib64. For the libraries to be loaded, the path to <netprobe directory>/lib64 has to be added to the trusted paths of ld.so. This can cause compatibility issues for other applications that run on the same machine. For more information, see Run Netprobe under elevated privileges in Linux.

• When /usr/lib64 or any library folder that has OpenSSL libraries is loaded before the netprobe conf, files are loaded alphabetically in /etc/ld.so.conf.d/*. These libraries are not packaged with Netprobe but are in the /usr/lib64 directory. Therefore, they might not be compatible.

Geneos components

The additional HTTP security headers are now applied to all web responses sent on the Geneos communication ports (EMF2 ports):

• X-Frame-Options: sameorigin

• X-XSS-Protection: 1; mode=block

• X-Content-Type-Options: nosniff

• Strict-Transport-Security: max-age=31536000; includeSubDomains

This applies to all Geneos components including debug and ORB pages generated by Netprobes and Gateways.

Licence Daemon

Beginning Geneos 5.9.x, the Licence Daemon detailed report is not available by default. A new command line option -report detail is required to enable a detailed report.

Gateway and Licence Daemon

Both Gateway and Licence Daemon are not compatible with RHEL 6.x (kernel 2.6.32). Both components now require at least RHEL 7.x or higher.

Web Dashboard

Geneos 5.8.2 introduced changes to the security.xml file in the Web Server config folder as a result of the upgraded Spring Security libraries.

When upgrading to Geneos 5.8.2 or newer, we recommend that you use this latest version of security.xml and ensure that any previous security.xml files are removed from your local machine. Otherwise, the Web Server will not run properly.

Express Report

Beginning Geneos 5.8.x, the Express Reports feature of Gateway is no longer available.

This feature will continue to be available and supported for Geneos 5.7.x and older until its end of life (EOL) date on 31 December 2021.

Publisher plugin

The Publisher plugin Elasticsearch configuration schema has been refactored to support additional publishing destinations.

The plugin configuration prior to version 5.7.1 is not compatible with versions 5.7.1 and higher. We recommend that you update the configuration after upgrading to Geneos 5.7.1 and higher.

Hardware plugin

The following metrics in the Hardware plugin have been changed:

• ntpAvailability is now timeSyncSource.

• ntpLocalClockOffset is now timeSyncOffset.

For more information, see Hardware documentation.

IBM i plugin

Beginning Geneos 5.7.x, the severityCodeFilter metric and filters > queueNameFilter configuration in the IBM i Queue plugin have been deprecated.

The new filters for Queue library and Queue name replaces the filters > queueNameFilter.

Web Dashboard

Web Dashboard requires the fontconfig package to be installed in the system to start up. Beginning Geneos 5.7.x, Web Dashboard now uses Open Sans as its default font when a required font is not available in the system.

For more information, see Fontconfig dependency in Web Dashboard documentation.

Dynamic Entities

The new and simplified mapping configuration replaces the Dynamic Mapping Configuration. Any existing configurations using the previous setup will continue to work. However, we recommend you migrate to the new Dynamic Entities > Mapping:

• Dynamic entities > Mapping type > Entity timeout — the new default entity time out value is increased from 2 minutes to 1 hour.

• Dynamic entities > Mapping type > Stale data timeout — this is a new setting in this release to mark individual dataviews as containing stale data if the data has not been updated within the set timeout. The default is 2 minutes.

Gateway publishing to Gateway Hub

Beginning Geneos 5.7, Gateway supports publishing data to Gateway Hub without schema. This schema-less publishing of data from Gateways is supported beginning Gateway Hub 2.4.x.

If you upgrade your Gateway to version 5.7.x or higher and you have many dataviews in the Gateway without a valid schema, then it is recommended that you also upgrade Gateway Hub to version 2.4.x or higher to take advantage of the automatic inference of schema in the Gateway Hub. Gateway Hub 2.3.x and older will continue to report ingestion errors if a dataview is published without a schema.

New binary file name for Geneos third-party plugins

The binary file naming convention in ITRS Downloads has been changed from <plugin><version>.tar.gz to <plugin>-<version>.tar.gz. This change applies to all Geneos versions.

New ITRS Maven repository

The ITRS Maven repository has changed its location from <url>https://itrsgroup.bintray.com/collection</url> to <url>https://maven.itrsgroup.com/repository/public</url>. Please update all the existing links as they will stop working by end of February 2021.

New workspace directory in Active Console

Beginning Geneos 5.6.x, Active Console now sets the new workspace default directory to the following paths:

• On Windows: ~\ITRS\ActiveConsole

• On macOS and Linux: ~/ITRS/ActiveConsole/

The new default workspace directory is used when creating a new workspace, but all existing workspaces are not affected. For more information, see Workspace directory in Active Console.

New binary file name for Geneos components

As part of the improvements to automate our deployment process, the binary file naming convention in ITRS Downloads has been changed from geneos-<component>-<version>.<os>.tar.gz to geneos-<component>-<version>-<os>.tar.gz. This change applies beginning Geneos 5.5.x.

Self-monitoring in Geneos

Beginning Geneos 5.4.x, self-monitoring in Geneos is now enabled by default with no configuration required.

This results in an Entity being dynamically created called <gateway_name> Info which contains samplers and dataviews that are automatically enabled with no configuration required. These samplers and dataviews are created using the existing Gateway plugins which you may already have manually configured in your Gateways.

If you do not wish the Gateway to automatically create a self-monitoring Entity, you can disable this feature in the Gateway > Operating environment section.

For more information, see operatingEnvironment > selfMonitoring in Gateway Operating Environment documentation.

E4JMS plugin

Beginning Geneos 5.4.x, the E4JMS plugin supports SSL client authentication. This feature introduces breaking changes to the E4JMS plugin SSL implementation for older Geneos versions.

If you are using SSL connections on your E4JMS plugins, you must update your configuration when using the new schema.

For more information, see E4JMS Plugin Technical Reference.

File Keyword Monitor plugin

Beginning Geneos 5.4.x, the FKM plugin uses Perl Compatible Regular Expressions (PCRE) by default. Be aware that this may introduce breaking changes in your implementation.

For more information, see the following documentation in the File Keyword Monitor:

• Regular expressions
• Notable differences between POSIX and PCRE

State Tracker plugin

The State Tracker > Rewind option in Gateway Setup Editor is now disabled by default.

For more information, see trackerGroup > trackers > tracker > rewind in State Tracker Technical Reference.

If you enable this option, this may cause a sudden increase in your CPU usage with no known changes in the monitored file. Since the State Tracker will track the monitored file from the beginning, and not when the file grows for new events.

Dynamic Entities

Gateway, Netprobe, and Licence Daemon have each been updated to support licensing of Collection Agent plugins. All three of these components must be updated to Geneos 5.2.x or higher for the Dynamic Entities feature to be supported in Gateway.

Collection Agent plugins require an additional licence to use. Please contact your ITRS Account Manager or ITRS Sales.

Gateway and Licence Daemon

If you are upgrading to Gateway 5.2.x or higher, you must also upgrade Licence Daemon to version 5.2.x or higher.

StatsD Plugin

The StatsD configuration in the packaged Collection Agent (collection-agent.yml) now uses the default protocol UDP and port 8125. Previously, this was set to protocol TCP and port 7780.