Skylar One 13.0.7 Release Notes

The 13.0.7 release of Skylar One (formerly SL1) includes support for Oracle Linux 9 (OL9), Python versions 3.9 to 3.12, PHP version 8, Aurora 3, and MariaDB 10.11. This release also includes package updates for various applications and fixes for Common Vulnerabilities and Exposures (CVEs) for Federal Risk and Authorization Management Program (FedRAMP).

This release is available for both FedRAMP/SaaS users and on-premises users. As such, it adheres to all applicable STIG and other Federal requirements. All the standard restrictions for STIG deployments apply to this release. The Skylar One platform that is deployed in our hardened SaaS environment meets or exceeds the requirements for FedRAMP deployments.

All installations and upgrades for FedRAMP users are completed by the ScienceLogic SRE team.

Before installing or upgrading to this release, ScienceLogic highly recommends that you review the Known Issues, especially the issues in the Administration section.

Upgrade Paths

The following upgrade paths to the 13.0.7 release from previous versions of Skylar One are supported:

13.0.6 → 13.0.7
12.5.8 (Juneau) → 13.0.7
12.3.15 → 13.0.7

12.5.20 or later (Kyoto) is not a supported upgrade path for 13.0.7. If you are already on Kyoto, you will need to use a separate path, which is not yet defined for this line.

For more upgrade information, see Updating Skylar One.

Features in the Skylar One 13.0.7 Release

This release includes the following features and enhancements:

Added new data retention rules to prune topology performance and on-demand performance data after seven days.
Merged multiple defects and improvements from the Juneau release line into this release. This consolidation includes updates to data maintenance, device management, and topology processes.
The Message of the Day (MOTD) was updated to reflect new cluster maintenance commands.
Improved error handling to prevent unhandled exceptions when Concurrent SNMP is enabled. This update ensures that HTTP errors during collection do not cause the collection process to fail unexpectedly.

Issues Addressed in the Skylar One 13.0.7 Release

This section describes the issues that are addressed in this release:

This release includes package updates and other enhancements to improve security and system performance. (Jira IDs: SLS-2280, SLS-2262, SLS-2270, EM-80488, EM-80485, EM-80482, EM-80612).
Addressed an issue where web server configuration files were replaced with defaults, causing custom TLS certificates to be reverted to default. (Cases: 00694948, 00697560) (Jira ID: EM-80863)
Optimized the method by which SNMPv3 engine IDs are stored in the Database Server to lower write churn and overall load during normal polling. (Case: 00605594) (Jira ID: EM-79104)
Ensured that interfaces with alias names, interface names, or descriptions containing non-Latin-1 characters are discovered correctly. (Cases: 00500930, 00658385, 00678903) (Jira IDs: EM-72724, EM-79951, EM-80535)
Reduced the load time for the Device Processes page (Registry > Devices > Processes) in the classic user interface in AWS environments. (Case: 00613590) (Jira ID: EM-78960)
Fixed a Run Book Action Type execution issue where Python 3.6-compatible custom actions aligned to the “SL1 Default Execution Environment (python 3.6)” incorrectly failed with a version error, ensuring compatible runbook actions execute successfully after upgrade. (Case: 00580465) (Jira ID: EM-77789)
Implemented strict input validation and sanitization for virtual device names to prevent HTML and JavaScript injection. The system now validates names on both the client and server side, blocking the use of potentially malicious tags. (Case: 00588211) (Jira ID: [EM-77983])
Resolved an error that occurred when creating a Grouped Data Series (Leaderboard / Top-N secondary data) widget. (Jira ID: EM-70574)
Updated the sl_recurring_maintenance process to gracefully handle missing API key PHP files. This change prevents unhandled exceptions and avoids unnecessary system log spamming when files are not present. (Jira ID: SLS-2296)
Resolved an issue where live in-place upgrades from version 13.0.6 to 13.0.7 served raw encrypted PHP bytes instead of rendered HTML. The fix ensures php-fpm is restarted or reloaded during upgrades to correctly load the silo extension and decode files. (Jira ID: EM-81022)
Addressed an issue where installing an incorrect platform-specific patch hook during the package import phase causes inconsistencies in the patch hook versioning. (Jira ID: EM-80550)
Resolved an issue where package conflicts during system update caused false-positive staging results. (Jira ID: EM-80237)
Addressed an issue that caused siloupdate-manager to fail when running a deployment with all pre-upgrade tests disabled. (Jira ID: EM-76396)
Ensured that Skylar export services, including the metadata exporter and alerts poller, remain available and functional on version 13.0.7 patch systems. (Jira ID: EM-80611)
Addressed a package dependency conflict for the powershell-collector package on STIG-enabled stacks during upgrades from version 12.5.6 or 12.5.7 to 13.0.7. (Jira ID: EM-80678)
Resolved a package dependency issue on STIG-enabled stacks where non-AP appliances failed to patch due to a hard dependency on Python 3.11. (Jira ID: EM-80685)
Addressed a critical issue where enabling the "Include IP in log filenames" setting in Devlog Control caused a stack-wide fatal error under PHP 8. This error previously resulted in a full system outage requiring an infrastructure reboot to recover. (Jira ID: EM-80791)

Working with Signed PowerPacks

The 13.x release line now allows users to import and install PowerPacks in Skylar One, but the PowerPacks must be signed. Using signed PowerPacks ensures that they came from a legitimate source, such as ScienceLogic or other users at your company.

To enable PowerPack signing, you must be a Skylar One (SL1) administrator so you can add new access keys to the keystore. For SaaS deployments, this work is done by the ScienceLogic SRE team. For on-premises deployments, see how to sign a PowerPack.

To add and configure access keys (ScienceLogic SRE team only):

In Skylar One, go to the Trusted Public Keys page (Systems > Manage > Public Keys).
Click the Actions button and select Import GPG Key. The GPG Public Key modal appears.
Type a name for the key and upload the public GPG key.
Save the key. Now you can go to the PowerPacks page (Systems > Manage > PowerPacks) and install a signed PowerPack.

All ScienceLogic PowerPacks included in this release are signed, as all PowerPacks from ScienceLogic now contain the ScienceLogic key.

Non-ScienceLogic PowerPacks will need to be signed with GPG (or PGP if preferred). You will need a public GPG key to import a signed PowerPack, and a secret GPG key to convert an unsigned (non-ScienceLogic) PowerPack to a signed PowerPack.

To sign a non-ScienceLogic PowerPack:

In the directory where you downloaded the unsigned PowerPack file (.em7pp), run the following command:

gpg --import test-secret-key.asc
Run the following command and make a note of the KEY_ID value:

gpg --list-secret-keys
To sign the PowerPack, run the following command:

gpg --local-user <KEY-ID> --sign <unsigned_powerpack>

The resulting signed PowerPack file will have a .gpg extension.

To sign a PowerPack:

In the directory where you downloaded the unsigned PowerPack file (.em7pp), run the following command:

gpg --sign <powerpack_filename>

For example:

gpg --sign Amazon_Web_Services_Version-127.em7pp

This command adds a new file wrapped in an ASCII-armored signature in the same directory, with a new .asc suffx. For example:

Amazon_Web_Services_Version-127.em7pp.asc

To verify that the file was signed correctly, run the following command:

gpg --verify Amazon_Web_Services_Version-127.em7pp.asc

You will get a "not a detached signature" warning that you can ignore. This warning appears because the --clearsign option was used instead of a detached signature file.
You can now install or share the signed PowerPack with other users on this Skylar One system.

To import and install a PowerPack, see Installing a PowerPack.

Skylar One Unsupported Features in This Release

Due to FedRAMP and STIG requirements, some Skylar One appliances, components, and features are not supported or available in this release. These restrictions vary based on whether you are in a SaaS or on-premises environment.

Concurrent PowerShell, concurrent SNMP, and concurrent network interface collection are all supported in version 13.0.7 STIG mode.

Unsupported Features for FedRAMP/SaaS Users

Skylar One Extended Architecture
Administrative access to the Skylar One Database Server or the Skylar One Administration Portal
Administrative access to the Skylar One Collectors (after initial deployment)
Port 7700
The Web Configuration Utility
Skylar One agents
Skylar One Global Manager
Skylar One DB Tool page
Skylar One API calls, including calls made on the Skylar One API Browser and GQL Browser pages
Licensing
Subscription billing
Skylar Compliance (formerly Restorepoint)
Skylar AI and all related components
Customer-supplied code, including the following:

Run book automations
Dynamic Application snippets
ScienceLogic libraries
PHP reports
Alert formulas
Presentation object formulas
Collection object formulas
Custom dashboard widgets

Any customer-supplied code must be delivered as a PowerPack and signed by ScienceLogic.

Unsupported Features for On-premises Users

Skylar One Extended Architecture
The Web Configuration Utility
Skylar One Gen-3 agents
Skylar One DB Tool page
Licensing
Subscription billing

Known Issues

ScienceLogic strongly recommends that you review all Known Issues for Skylar One (SL1). For more information, see https://support.sciencelogic.com/s/known-issues#sort=relevancy.

The following Skylar One known issues exist for this release of Skylar One:

System Update

When deploying an on-premises 13.0.5 or later stack, if you are using Disaster Recovery (DR) backups, the backups will fail unless nginx on the DR node is restarted, or the VM is rebooted. (Jira ID: EM-80476)
If you are upgrading from 12.5.20 or later STIG mode to version 13.0.6 or later, Concurrent PowerShell will not be available.

Administration

After installing or upgrading to this release, your administrator must create new passwords for any local and OS account users, including root, em7admin, and sl1admin. In addition, you will need to change these passwords every 60 days to keep from getting locked out of those accounts. The Skylar One (SL1) user interface will not warn you of the 60-day deadline.

Appliances

A known issue might cause high swap usage in excess of 95% to be observed on appliance types running Skylar One/SL1 12.1.x or later and Oracle Linux 8. This impacts all appliance types, but is most frequently observed on Database Servers or appliances that are under heavy memory pressure. For more information about this issue, including a workaround, see: https://support.sciencelogic.com/s/article/11598. (Jira ID: EM-59269)
On the Appliances page, changes to the IP address or sharing permissions for an appliance are not retained after saving. (Jira ID: EM-80537)

Authentication

A known issue with session cache management might cause Skylar One to log you out unexpectedly, or prevent you from logging in again after a recent session. If you experience either issue, you can work around it by clearing the cache of your web browser before you log into the Skylar One (SL1) user interface. For more information, see https://support.sciencelogic.com/s/article/13701. (Jira ID: SLUI-21011)
The Skylar One (SL1) 12.1.1 release set the maximum number of simultaneous user sessions to 300. With this change, some users have received an "HTTP Response code was 429 (Too Many Requests)" error. For more information about this error, see https://support.sciencelogic.com/s/article/12971.

Backups

You should not use the SFTP protocol option when configuring backups at this time due to a known issue. (Jira ID: EM-81157)

Data Collection

The CyberArk credential gateway service integration is incompatible with the Concurrent PowerShell feature in Skylar One. If you are using the CyberArk credential integration, you must disable Concurrent PowerShell. To disable Concurrent PowerShell, go to the Behavior Settings page (System > Settings > Behavior), ensure that the Enable Concurrent PowerShell Collection checkbox is not selected, and click Save. (Jira ID: EM-63205)

Logging

A known issue might cause several log configuration files to conflict, which could cause you to see errors for the sl_vault and slsctl logs or potentially block log rotation in some cases, depending on the order in which the files are executed. To work around this issue, delete the config files ~sl_vault and ~slsctl. (Jira IDs: SLS-1105, EM-62134)
When using the SNMP Public V2 credential to discover devices, you might see an unhandled exception in the system log near the end of the discovery session, despite the devices being discovered successfully. (Jira ID: EM-59380)

PowerPacks

Resolved an issue where adding or deleting Skylar One dashboards within a PowerPack on STIG-hardened systems triggered an erroneous API error message. Despite the error notification, the dashboards were successfully added or removed as intended. (Jira ID: EM-81093)
In version 13.0.5 and later, you cannot add any content to the AP2 Content Objects tab for a PowerPack. (Jira ID: EM-80508)
If you try to install a PowerPack with an invalid license, instead of an error message, Skylar One will generate a typeError exception, causing the system to hang. (Jira ID: EM-80454)
The execution environment for the "Low Code Tools" PowerPack version 104 does not successfully deploy on 13.0.x releases. (Jira ID: EM-80470)
On the PowerPacks page, when you are importing a PowerPack, the filename for the PowerPack does not display on the import dialog box. (Jira ID: EM-78541)

Reports

Report templates from the Skylar One Central Database are deleted if the Data Retention setting for "Ad-hoc and Scheduled Reports" is set to anything greater than its default of 0 days. (Jira ID: EM-81023)

User Interface

If you are using Safari or Chrome, sorting by column header does not work on the Collections tab of the Device Properties page from the Device Manager page (Devices > Classic Devices, or Registry > Devices > Device Manager in the classic SL1 user interface). This behavior does not occur with Firefox. (Jira ID: EM-75684)
On Safari browsers, when attempting to modify data retention settings within the "Subscription "section of the Data Retention page, the slider for adjusting retention values is not functioning. The system displays the following error message: "Cannot find the input with NAME='sliderValue29h'." (Jira ID: EM-66372)
The following known issues impact Business Services:
- The Anomalies tab on the Service Investigator page for device services might incorrectly display devices that have anomaly detection disabled, rather than showing only those devices with anomaly detection enabled. (Jira ID: EM-62884)
- The header for the preview pane for searches on Business Services pages is missing the closing parenthesis ")" after the limit number. (Jira ID: SLUI-21451)
- Services that are added or created to the N-tier hierarchy have their RCA Options field set to Disabled by default. The current solution to this issue is to edit the service you wish to configure by manually updating the RCA Options field to RCA Enabled (contributors only).(Jira ID: SLUI-18852)
- For services that have their RCA Options field enabled, and has had a child service removed, Skylar One (SL1) will not compute the health, availability, and risk values until the Service Topology Engine returns an updated topology, which occurs every 5 minutes by default. (Jira ID: SLUI-18853)