What's New in This Release

New Features

New Features in TIBCO LogLogic® Enterprise Virtual Appliance

The following features have been added in this release in LogLogic® EVA and LogLogic® EVA - Container Edition.

New platforms and product editions

New platforms: In addition to the existing platforms, you can now deploy LogLogic EVA on the following platforms:

• Docker
• Kernel-based virtual machine (KVM)
• Microsoft Azure

For more information about deploying LogLogic EVA on these platforms, see TIBCO LogLogic® Enterprise Virtual Appliance Quick Start.

New product edition: LogLogic EVA - Container Edition (the container edition of LogLogic EVA) includes support only for the Docker platform and is distributed on the TIBCO eDelivery website.

Upgrading in AWS

In an AWS environment, it was not possible to upgrade LogLogic EVA to version 6.3.0. In the 6.3.1 release, you can run a cross-version script to migrate all setup and configuration from your existing setup to a new instance of LogLogic EVA 6.3.1.

For upgrade instructions, see TIBCO LogLogic® Log Management Intelligence Configuration and Upgrade.

Common New Features

The following features have been added in this release in all product editions.

Advanced Features

• Parsing rules: When adding parsing rules for a data model from Add sample events and parsing rules > Parsing rules panel, you can reorder the parsing rules by dragging rules to the required position. Now, you can also hover over the rule and select an appropriate option to reorder the rule. For more information, see Defining the Sequence of Parsing Rules in the TIBCO LogLogic® Log Management Intelligence User Guide.
• Downloading search results: When downloading search results from the Data panel, a new option is now available to download the selected columns with the applied filters from all pages of search results. Earlier there were only two options: all data or the current view.
• Pagination: A Go to field has been provided on the search results page. You can now jump to any result page by entering the page number in the Go to field.

For detailed information about Advanced Search, see Advanced Search in the TIBCO LogLogic® Log Management Intelligence User Guide.

Advanced Dashboards

The following enhancements have been added in this release:

Widget Type	Description
Range Bar	New widget. Displays a range of values as a bar graph.
Combined Widget	You can now drag the pie to any area of the widget. This helps to view the line and bar graphs properly.
All widgets	The following new fields have been added to all widgets: Widget Description field: On the Advanced Dashboard, the description is displayed when you hover over the widget. Auto load field: Automatically loads widget data on the Advanced Dashboard.

For more information about these enhancements, see Types of Widgets in the TIBCO LogLogic® Log Management Intelligence User Guide.

Advanced Alerts

When acknowledging an advanced alert on the Alerts > Advanced Alerts page, you can now specify an external web address in the URL field. This feature is useful for adding alert information such as an external link to a customer relationship management system or a defect tracking system. This enables you to track actions triggered by the alert. For more information, see Acknowledging Alerts in the TIBCO LogLogic® Log Management Intelligence User Guide.

Advanced Aggregation Rules

The purge frequency of aggregated data can now be configured by an administrator.

See the following topics in TIBCO LogLogic® Log Management Intelligence Administration:

• For the procedure, see Configuring Advanced Features
• For the sample configuration file, see Configuration of Aggregation Rules

Monitoring Console

The following enhancements have been introduced in this release:

• Monitoring Console in LogLogic LMI now includes the cluster manager functionality from TIBCO Hawk®. Monitoring Console creates a ready-to-use Hawk domain named lmi_domain and you can connect external Hawk agents to lmi_domain. You can also register additional domains of type regular, proxy, or new domains from the Monitoring Console, and external Hawk agents can connect to those domains.
• A reconnect button has been provided on the Monitoring Console. Whenever the connection of the appliance with the domain is lost, the appliance tries to connect. However, if the appliance is not able to reconnect, a reconnect button appears on the Monitoring Console. You can click the button to manually reconnect to the domain.

For more information, see Monitoring Console in the TIBCO LogLogic® Log Management Intelligence User Guide.

EQL Predefined Functions

The following functions have been added in the EQL predefined functions. For more information, see Predefined Functions in the TIBCO LogLogic® Log Management Intelligence User Guide.

• Math functions: The sum (distinct <columnName>) function returns the sum of the distinct values in the specified column.
• String functions:

  Function	Description
  findlast findnth substituteall substitutefirst	The find functions find the position of one string within another. The substitute functions find a regular expression within a string and replace it with another string.

• Miscellaneous functions:

  Function	Description
  geoiplookup	You can use the geoiplookup function within SQL and EQL queries to fetch the geographical information of a specified IP address. This function helps you to search logs that originated from a particular geographical area such as location, country, city, postal code, and so on. You can use the function in Advanced Search and Advanced Dashboards.
  matchcidr	You can use the matchcidr function to check if an IP address belongs to a CIDR range or a specified range of IP addresses. You can use the function within SQL, EQL, and ECL queries, and in turn, in other functionality that make use of these queries.

Customizable GUI Theme

From the Administration > System Settings > General tab > Theme section, an administrator can now set the colors of the header bars, the text in the header bars, and the text in the menu items. For more information, see Theme in the TIBCO LogLogic® Log Management Intelligence Administration.

Additional Landing Page Options

Advanced Search and Monitoring Console pages have been added to the list of login landing page options. For more information, see Changing the Login Landing Page in the TIBCO LogLogic® Log Management Intelligence User Guide.

Changes in Functionality

Changes in TIBCO LogLogic® Enterprise Virtual Appliance

The following changes have been made in LogLogic EVA and TIBCO LogLogic® Enterprise Virtual Appliance - Container Edition.

• Hardware requirements: The minimum number of cores for LogLogic EVA has been increased from 8 to 16. For the complete list of user privileges, see "Introduction to TIBCO LogLogic® Enterprise Virtual Appliance" in TIBCO LogLogic® Enterprise Virtual Appliance Quick Start.
• Expanding local storage: The feature to expand the local storage of LogLogic EVA is now disabled by default. To attach additional storage, you must enable the feature by running the system command and then attach additional storage volumes. The feature remains enabled through every system restart until it is disabled.

  For more information, see "Expanding Local Storage" TIBCO LogLogic® Enterprise Virtual Appliance Quick Start.

Common Changes

The following functionality changes have been made in this release in all product editions.

Advanced Features

• Starting from LogLogic LMI 6.3.1, spaces are not allowed in the names of:
  • Aggregation rules
  • Bloks
  • Triggers
• Scheduled Queries: When a scheduled query report is sent as an email attachment, the file name of the attachment now includes the schedule name followed by the date and time when the email is sent. The file name format is <scheduleName><date>T<time>.<fileExtension>. For more information about how to schedule the execution of your queries, see Configuring Query Schedules in the TIBCO LogLogic® Log Management Intelligence User Guide.

Advanced Dashboards

In the Number widget, the Description field has been renamed to Result label.

EQL predefined functions

A third optional parameter has been added to the find() function. For more information, see Predefined Functions in the TIBCO LogLogic® Log Management Intelligence User Guide.

Security

• The feature to prevent Cross-site Request Forgery (CSRF) is now enabled by default. In LogLogic LMI 6.3.0 it was disabled by default, and an administrator had to enable the feature.

Privileges of remote users

In versions 6.2.1 and 6.3.0 of LogLogic LMI, after the appliance administrator modified the privileges of the RemoteUserTemplate user, the changes were applied to all RADIUS or TACACS users. Starting from version 6.3.1, an appliance administrator can modify the privileges of a remote RADIUS or TACACS user from the Management > Users > Users tab. For the complete list of user privileges, see List of User Privileges in the TIBCO LogLogic® Log Management Intelligence Administration.