The Data Source Setup wizard now gives you the option to view matched data types as well as all data types in the drop-down list for syslog and directory-based configurations. This allows you more flexibility in choosing the correct data type.
The log file analyzer has been optimized to better handle large invalid logs using a time-out feature.
Restart or Shutdown. In a VM deployment, the Restart or Shutdown page has been updated with the Restart Hardware and Shut Down Hardware options to allow you to restart and shut down the VM respectively.
Syslog Log Data
The UPD packet size has been increased from 1K to 4K.
Additional statistics for syslog log data have been added to the Syslog Status page.
A flag was added to disable direct importing for syslog data to import data manually or via scheduling.
Reporting Categories
The product can now read third-party categories from log files for reporting. This is enabled by using a configuration with a category definition. Categories read from log files are assigned the Neutral classification.
Report category selections will only populate with data that is available in the metric server. If the metric server has no data for the category, the category will not be available when creating a report.
Data Source Configurations. On the Data Source Type page, the following data source configurations have been added to the Type of Data field:
Palo Alto Firewall (Categories)
Zscaler 5.6 Export
Zscaler 5.6 Syslog
Importing Data
When setting categories to “Off” on the Display Categories pages, data will not be added to the metric server.
A flag was added to import only records for users that exist in Groups and IDs.
Unique IDs. Along with the number of licensed IDs, the number of unique IDs is now displayed in the Licensed IDs field on the Server Information page. This number represents the number of users imported into the metric server.
Hits and Visits Calculation. The supplemental content-type and extension list has been updated which improves the hits and visits calculation.
Corrections
Syslog Configuration. When modifying a syslog configuration by changing the type of data source, the syslog server may not launch properly after the configuration change. This has been corrected.
Directory-Based Configuration. When modifying a directory-based configuration by changing the File Name Filter only, the filter change does not save. This has been corrected.
Profiling. Profiling was fixed for a syslog port closure exception.