Versa Analytics Release Notes for Release 21.1

Install the Versa Analytics Software

To install the Versa Analytics software, see the Deployment and Initial Configuration articles.

Upgrade to Release 21.1

You can upgrade Versa Analytics nodes to Release 21.1 from any service release of Release 16.1R2, that is, from Releases 16.1R2(Sx).

% sudo rm -rf /opt/versa_van/apps/apache-tomcat/webapps/versa*
% vsh restart

versa@versa-director:.../vnms/scripts$ ./vd-van-cert-upgrade.sh --pull
Pulling Analytics certificates to Director key store
Checking previous version config path
Changing port for [Analytics]
No modifications to commit.
Port Migration completed
VAN Clusters IPs: [ 10.48.189.23 ]
Removing previous analystics cert store
Getting Certificate for : 10.48.189.23
depth=0 C = US, ST = California, L = Santa Clara, O = versa-networks, OU = VersaAnalytics, CN = versa-analytics
verify error:num=18:self signed certificate
verify return:1
depth=0 C = US, ST = California, L = Santa Clara, O = versa-networks, OU = VersaAnalytics, CN = versa-analytics
verify return:1
DONE
Importing Certificate for : 10.48.189.23
Certificate was added to keystore
Certificates Imported... Requires restart.. Do you want to post pone restart (y/N): N
[sudo] password for versa:
Stopping VNMS service
------------------------------------
Stopping TOMCAT................[Stopped]
Stopping REDIS.................[Stopped]
Stopping NETBOX-IPAM...........[Stopped]
Stopping POSTGRE...............[Stopped]
Stopping SPRING-BOOT...........[Stopped]
Stopping SPACKMGR..............[Stopped]
Stopping NCS...................[Stopped]
* Stopping daemon monitor monit
Starting VNMS service
------------------------------------
Starting NCS...................[Started]
Starting POSTGRE...............[Started]
Starting NETBOX-IPAM...........[Started]
Starting SPRING-BOOT.......... [Started]
Starting REDIS.................[Started]
Starting TOMCAT................[Started]

New Features

This section describes the new Versa Analytics features in Release 21.1.

• Alarm settings enhancements—(In Releases 21.1.3 and later.) You can set alarms for CPU utilization, disk utilization, memory utilization, and Analytics driver stuck. You can override the low-threshold and high-threshold severities for threshold alarms. You can configure the severity for setting and clearing alarms.
  
  

• APM statistics—(In Releases 21.1.3 and later.) You can display the APM statistics for an application. To do so, drill down on the application. For example:
  
  

• Appliance log activity report—You can find a log activity summary for all appliances at Dashboards > System > Appliance Activity tab. For example:
  
  
  
  Drill down to view historic appliance log activity for the configured interval. For example:
  
  

• Application performance monitoring (APM)—(In Releases 21.1.1 and later.) If you enable TCP performance monitoring on sites running SD-WAN, statistics corresponding to TCP sessions are exported to Analytics. Statistics are aggregated per tenant, appliance, application, source, destination prefix, and WAN link. The metrics include round-trip time, aborted and refused counts, session and packet counts, and retransmission counts. These metrics are used to calculate the quality of the application. The application rank is computed as a value from 1 through 100, where 1 is the best performing application and 100 is the worst. The application rank is displayed on the SD-WAN dashboard:
  
  
  
  The following example drilldown shows that there is poor performance on some SSL sessions because of high retransmissions.
  
  
   
• Application uptime—(In Releases 21.1.1 and later.) You can display the amount time that has elapsed since an application started at the Administration > Version tab:
  
  
   
• DIA traffic rules statistics—(In Releases 21.1.3 and later.) The SD-WAN site dashboard shows statistics for DIA rules on the following screens.
  
  
  
• DNS proxy report enhancements—You can store DNS proxy parent and child session logs in the search engine. You can display the DNS proxy logs at Logs > DNS Proxy, and you can search one or more fields of the logs and drill down to related logs and to the parent session log. To find the parent session log, click the icon under the Parent Log column. You can view predefined reports at Logs > DNS Proxy > Charts. For example:
  
  
  
  Drill down on the parent icon to view details about the parent session log. For example:
  
  
   
• GUI support for log collector exporter configuration—(In Releases 21.1.2 and later.) Log collector exporter configuration page has been enhanced to support additional configuration options:
  • Configure remote collector with destination FQDN instead of destination IP address—In the remote collector, you can configure destination IP address or Fully Qualified Domain Name (FQDN). If you configure FQDN, the DNS server listed in the /etc/resolv.conf file must be reachable from the log collector to perform the name resolution. Alternately, /etc/hosts can be configured with the hostname and IP address
    
    
  • Configure primary collector in remote collector group—This configuration ensures that when multiple collectors in a collector group are in the Established state, the primary collector is marked as the active collector.
    
    
  • Configure exporter rules with matching log subtypes—In the exporter rules, apart from log types, you can specify subfields for a granular match. For example, to export only severity cleared, critical, or major, select the following log types:
    
    
    You can match various log types with subfields as listed below:
     

    Field	Subfields	Description
    alarm-log	alarm-type severity	List of alarm types List of alarm severity
    bw-mon-log	sub-type	List of bandwidth monitoring statistics types
    dos-log	Threattype	List of threat values
    idp-log	Threattype	List of threat values
    urlfLog	reputationLevel	List of URL values
    mon-log	Subtype	List of monitoring statistics types

  • Configure system settings—You can configure system settings for NTP and alarm from the the Analytics > Administration > Configuration > Log Collector Exporter in the left menu, then in the Log Collector Configuration window, select the System tab for the host.
    
    
• “is not equal to” log filter—You can filter for logs by specifying “is not equal to” for any fields, as shown here:
  
  
   
• Kafka third-party log collector and log email notification—(In Releases 21.1.1 and later.) You can configure the Analytics log collector and exporter to send the logs to one or more third-party collectors in syslog format using TCP/UDP/SSL transport. In Releases 21.1.1 and later, you can stream logs and events to the the following interfaces:
  • Apache Kafka cluster—You can configure the log collector to send the logs to a customer’s Kafka cluster. To do this, you configure the Kafka cluster as a remote collector in the log collector exporter configuration. Logs are streamed in structured syslog format to Kafka cluster. See Configure Log Collectors and Log Exporter Rules.
  • Email notification service—For critical security events, e-mail alerts/notifications can be sent to users from the log collectors using a new email notification service called van-notif-agent. It can be configured to run on the log collector nodes and can send emails with summary of the events and/or detailed log information at configured intervals. See Configure Log Collectors and Log Exporter Rules.
• Log collector exporter enhancements—(In Releases 21.1.1 and later.)
  • GUI support for log collector exporter configuration—Log collector exporter configuration page has been enhanced to use a new framework to add/delete/modify/clone local collector, remote template/collector/collector group, exporter rules configuration:
    
    
     
  • GUI support for log collector exporter status and statistics display—You can display log collector status and statistics information at a global level, for a local collector, for a remote collector, or for a rule, for all log collectors or for a specific log collector:
    
    
     
  • Alarm configuration—To generate alarms for a remote collector down event or when the queue utilization exceeds the threshold, you can enable the following configuration settings. Note that you can configure alarms only from the CLI. The generated alarms are stored in the /var/log/alarms.log file.
    
    versa@Search1% show
    [edit log-collector-exporter settings alarms]
    remote-collector-queue-utilization {
        low-threshold 75;
        high-threshold 90;
        soak-time      5;
    }
    remote-collector-down {
        soak-time ;
    }
    
    Examples of the generated alarms are:
    
    tail -f /var/log/alarms.log
    Aug 19 09:07:57 Analytics1 versa-lced: [rem-coll] [rem-coll-down] [2020-08-19T09:07:56-0700] Remote collector RC2 down
    Aug 19 09:08:01 Analytics1 versa-lced: [rem-coll] [rem-coll-down] [2020-08-19T09:08:01-0700] Remote collector RC2 up
    Aug 19 09:14:28 Analytics1 versa-lced: [rem-coll] [rem-coll-q-util] [2020-08-19T09:14:27-0700] Remote collector RC1 queue has exceeded threshold value (utilization: 60%)
    Aug 19 09:14:28 Analytics1 versa-lced: [rem-coll] [rem-coll-q-util] [2020-08-19T09:14:28-0700] Remote collector RC1 queue is now available (utilization: 23%)
    Aug 19 09:15:26 Analytics1 versa-lced: [rem-coll] [rem-coll-q-util] [2020-08-19T09:15:25-0700] Remote collector RC1 queue near exhaustion (utilization: 75%)
    Aug 19 09:15:26 Analytics1 versa-lced: [rem-coll] [rem-coll-q-util] [2020-08-19T09:15:26-0700] Remote collector RC1 queue is now available (utilization: 45%)

  • Exporter rules support for match on more granular types and subtypes—Exporter rules define which logs received by the local collector to stream to a remote collector. Match criteria has been enhanced to include more log types listed, and you can match based on specific values inside the logs by configuring features with matching criteria. See Configure Log Collectors and Log Exporter Rules.

  • Operational commands to log restore and clear archive jobs—You can restore and delete archive logs from the CLI, using the request system storage archive restore and request system storage archive delete commands. See Manage Analytics Logs.

• Network prefix in SD-WAN application subscriber report—The SD-WAN application subscriber report displays information about applications and their users. You can determine a username by configuring an IP address-to-user mapping. If you do not configure a mapping, the source IP address of the traffic flow is used as the username. The SD-WAN application subscriber report has been enhanced to display the network prefix, which is the destination address prefix of the traffic flow, if this information is received in the logs from the VOS devices. By default, VOS devices to not send network prefix information. To enable the sending of network prefix information, issue the following command:

admin@branch-cli(config)% set system parameters lef usage-stats-logging sdwan app-user-inc-dest-ip-prefix true

To view the network prefix information, drill down from the Application page. For example:


 

• Operational commands to log restore and clear archive jobs (In Releases 21.1.2 and later.)
  • Logs are archived after they are processed by the log collector—You can view, restore or delete the logs from the Administration > Maintenance > Log Archives menu:
    
    
  • Delete archive logs—You can delete archived files for a specific tenant or appliance within a time range to help free disk space on log collector nodes.
  • Restore archive logs—Extracts archived files for a specific tenant or appliance and time range to a destination directory. If the destination directory is /var/tmp/log, the data is added back to the database.
  • View archive log details—Locates the specified number of archived files and file names of the oldest and newest files per tenant or appliance and per log collector.

• Per-tenant Analytics data settings—For each tenant, you can define the data retention time, data granularity, and other data-related settings. See Analytics Datastore Limits in Versa Analytics Scaling Recommendations.

• Primary and secondary log collectors—You can configure primary and backup log collectors. From a collector group, you can choose a specific collector to be the active, or primary, collector. If the primary collector is down, the next active collector is chosen from the group. When the primary collector comes back up and remains up for a configurable interval, it becomes the active collector again. See Configure Log Export Functionality.
• Reporting enhancements—(In Releases 21.1.1 and later.) The following enhancements have been made to reporting framework:
  • You can create a per-site report using a report template and apply it to other sites.
    
    
    When you save the report, you can choose to copy the settings to other sites so that same report can be generated for the chosen sites.
    
    
    
    You can view the generated reports as follows:
    
    
     
  • You can combine data from multiple sites and appliances into a single time series chart. For example:
    
    
     
  • You can generate reports about available bandwidth for SD-WAN access circuits. SD-WAN branches periodically export to Analytics the total available uplink and downlink bandwidth for each WAN link. If you enable a speed test to the branches, the uplink and downlink bandwidth that is reported by the speed test utility is exported. If you do not enable a speed test, the configured uplink and downlink bandwidth is exported.
    
    
     
• Retention configuration per Analytics report type—You can set different retention values for daily and hourly time-to-live (TTL) data, as shown here:
  
  
   
• SD-WAN site and link availability—(In Releases 21.1.1 and later.)
  • Site availability, a feature available before Release 21.1, indicated the reachability of a site from the controller point of view. If the controller lost connectivity to a branch, it sent a site disconnect message that was used to compute the availability. If all controllers lost connectivity to the branch, the site was marked down. Otherwise, it was marked up. This implementation did not work as expected in some scenarios, causing the availability computation to be inaccurate. Release 21.1.1 implements a new logic that relies on combination of SLA metrics between sites and controllers and log activity from the site to determine site availability. In addition to up/down state, a new degraded state is determined using the SLA loss metrics that indicates brownout conditions. If no SLA metrics are received for a site and if there is no log activity from the site for more than 10 minutes, the site is marked down.
  • Link availability is a new feature that provides the health of the link based on the SLA metrics received from the site and controller for each WAN link of the site. SLA metric values are used to determine whether the state is up, down, degraded. If no SLA metrics logs are received for more than 10 minutes, the link is marked down. Drill down on a site to display site and link availability charts. In the charts, green represents the up state when availability is >= 98 percent, orange represents a degraded state when availability is < 98 percent, and red represents the down state when availability is < 5 percent.
    
    
    
    You can use the reporting framework to generate site and link availability reports for a tenant or a specific appliance:
    
    
    
    See SD-WAN Dashboard.

• Note: If you upgrade an Analytics cluster from Release 16.1R2 or Release 20.2 to Release 21.1, availability data that was displayed before the upgrade is not available after the upgrade because of changes in the software implementation. To keep track of the previous information, use the reporting tool to create and download the availability reports before you perform the upgrade.

• Site availability summary table—You can generate a report for percentage site availability for all a tenant's sites. For example:
  
  
   
• Site tag report—(In Releases 21.1.1 and later.) In Versa Director, you can set one or more site tags for a VOS device, and a filter has been added to the SD-WAN dashboard that allows you to drill down to a site or a site tag. If you choose a site tag, the dashboard displays data only for sites that match the site tag, thus providing a consolidated view for all sites matching the tag.
  
  You set the site tags in Versa Director. For example:
  
  
  You choose the site tabs from the SD-WAN dashboard:
  
  

  Drill down on a site tag to display a dashboard for sites matching the site tag. The following example is for site tag “Controller”:
  
  

• Statistics in SD-WAN dashboard—(In Releases 21.1.1 and later.) The SD-WAN dashboard has been enhanced to include statistics blocks that provide a high-level overview of the tenant.
  
  
  
  Drill down support is available for some of the reports to display information about sites with errors and anomalous conditions. For example:
  
  
• Subscription lifecycle updates—(In Releases 21.1.1 and later.) A number of changes have been made to the subscription lifecycle, including the following. See Subscription Lifecyle.
  • Licenses are valid for 1, 3, or 5 years.
  • License subscriptions do not support the Created and Suspended states
  • A license is immediately activated after the device performs ZTP.
  • Manual license activation is not required.

• TACACS+ support for Analytics nodes—You can use TACACS+-based authentication, authorization, and accounting (AAA) to provide access to Analytics nodes. You can configure up to four TACACS+ servers on each Analytics node. See Configure TACACS+.

• Ubuntu Release 18.04—You can use Ubuntu Release 18.04 (Bionic Beaver) as the base Linux platform for running the Versa Analytics database, log collectors, and application. The release supports .iso file, which you can install on bare-metal platforms or virtual machines (VMs). Releases 21.1.1 and later support the Release 18.04.04 host OS for VOS devices.

• Usage and session logging control default settings—In Release 20.2.2, Versa introduced system settings for usage monitoring logging control (send top-n firewall source and destination statistics and send top-n SD-WAN application user statistics) and for session monitoring logging control (include session ID in firewall logs and include session ID in SD-WAN logs). In Releases 21.1.1 and later, default values are set for the top-N values. Also, including session ID parameters in logs is enabled by default. See Configure Firewall and SD-WAN Usage Monitoring Controls.

Fixed Bugs

The following are the critical and major defects fixed in Release 21.1.

Known Issues

The following are the known issues in Release 21.1.

Request Technical Support

To request technical support, visit http://support.versa-networks.com. If you are contacting support for the first time, register and create an account. You can also send email to support@versa-networks.com or contact your Versa Networks sales account team.

Additional Information

Deployment and Initial Configuration

Revision History

Revision 1—Release 21.1, December 20, 2019
Revision 2—Release 21.1.1, August 21, 2020
Revision 3—Release 21.1.2, December 1, 2020
Revision 4—Release 21.1.3, June 6, 2021
Revision 5—Release 21.1.4, April 27, 2022