MVISION Cloud Connector Known Issues

Oct 21,2021

While running Quality Check for log parser wizards: Import Existing Configuration and Manual Configuration, you might encounter improper results. Because currently on the Sub Configuration page, the fields Preprocessor Class Name supports only the Rule-Based Preprocessor option, and the File Format supports only the Bluecoat option. If you select other options from the list besides the specified options on the Sub Configuration page, you will find invalid results.

This issue will be fixed in an upcoming release. 

After upgrading MVISION Cloud Connector from 5.2.2 to 5.4.2, CC may fail to start. If you see these two errors, PANHostname and proxyBypass, use the following steps:
 

For PANHostname:

• Delete the three entries within logprocessor.db.script and logprocessor.db.script.save files corresponding to the PAN settings.
• Restart the CC.

For proxyBypass:

Run the following CLI command:

./shnlpcli sp --name proxyBypass --val true --encrypt"

For help, contact Support. 

Even when all Cloud Connectors are configured with AD, the following message appears in Infrastructure > Cloud Connector > Custom Attributes: 

"You have more than 1 instance of Cloud Connectors and it is recommended to configure Custom Attributes on all the instances that are processing logs to ensure consistency of data fetched and processed. Please set up Custom Attributes for all symbolic servers."

This issue will be fixed in an upcoming release. 

The date format doesn't automatically pick the selected Timestamp column from the Map Log Fields in the Log parser when there are multiple date header columns such as Date or Timestamp in the parsed logs. As a workaround, make sure to manually update the correct date format. 

Cloud Connector throws ldapusers cache error after upgrading from 3.9.2 to 5.3.0 and above versions. As a workaround:

1. Delete the ldapusers cache from the Cloud Connector installed directory (leveldb) and restart the Cloud Connector.
2. Use the following curl command to push respective properties to YML with the mentioned payload when switching between rocksdb and leveldb:

Switching to leveldb

{
  "logProcessor":{ "unmatchedtracker.keyValueStoreType":"LEVELDB",
  "ldapusers.cache.type":"LEVELDB","dualmode.storeType":"LEVELDB",
  "tldcache.cache.type":"LEVELDB","ipDomainCache.cache.type":"LEVELDB",
  "blockedURLCache.cache.type":"LEVELDB",
  "ipUserMapperStore.cache.type":"LEVELDB"   },
  "integration": {
    "smtp": {},
    "siem": {},
    "panorama": {},
    "custom_attributes": {},
    "ip_user_mapping": {},
    "syslog": {}
  }
}

Switching to rocksdb

{
  "logProcessor":
  { 
  "unmatchedtracker.keyValueStoreType":"ROCKSDB",
  "ldapusers.cache.type":"ROCKSDB","dualmode.storeType":"ROCKSDB",
  "tldcache.cache.type":"ROCKSDB","ipDomainCache.cache.type":"ROCKSDB",
  "blockedURLCache.cache.type":"ROCKSDB",
  "ipUserMapperStore.cache.type":"ROCKSDB"   },
  "integration": {
    "smtp": {},
    "siem": {},
    "panorama": {},
    "custom_attributes": {},
    "ip_user_mapping": {},
    "syslog": {}
  }
}

RocksDB is not the default cache memory when MVISION Cloud Connector is upgraded from 5.0.1 to 5.3.0 version. As a workaround, you need to explicitly configure levelDB to RocksDB.