Agent Release Notes

Agent Release Notes

Agent Release Notes 1

 Contents

Contents
Data Protection Agent Release Notes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Features Released with this Version. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Database Support - Data Security Coverage Tool. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Database Agent Installation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Database Agent Installation Files. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Note on Agent Package Numbers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Determining Which non-Windows Database Agent Package to Install. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Database Agent Package Installation File Names. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Database Agent Packages Released with v14.8 Patch 50. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Database Agent Packages Released with v14.8 Patch 40. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Database Agent Packages Released with v14.8 Patch 30. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Database Agent Packages Released with v14.8 Patch 21. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Database Agent Packages Released with v14.8 Patch 20. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Database Agent Packages Released with v14.8 Patch 10. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Agent Installation Requirements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Agent Memory Requirements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Agent Disk Space Requirements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Platform Specific Notes for the Database Agent. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Special Considerations for Certain Linux Platforms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Database Agents on Microsoft Windows. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Database Agents on Ubuntu. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Prerequisites when Installing the Database Agent for Big Data. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Installing Database Agents. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Installing and Upgrading Database Agents. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Required Permissions for Agent Installation/Configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Database Agent Package. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Upgrading Database Agents. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
After Installing the Database Agent. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
AIX Post Installation Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Locally Caching Monitored Traffic. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
The Agent Compatibility Package (ACP). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Agent Patch Open Issues. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Open Issues with Imperva Data Protection Agent - v14.6 Patch 130. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Open Issues with Imperva Data Protection Agent - v14.6 Patch 120. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
Open Issues with Imperva Data Protection Agent - v14.6 Patch 110. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Open Issues with Imperva Data Protection Agent - v14.6 Patch 100. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71

Agent Release Notes 2

 Contents

Agent Patch Bug Fixes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88

Fixed Issues with Imperva Data Protection Agent - v14.6 Patch 130. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
Fixed Issues with Imperva Data Protection Agent - v14.6 Patch 120. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
Fixed Issues with Imperva Data Protection Agent - v14.6 Patch 110. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
Fixed Issues with Imperva Data Protection Agent - v14.6 Patch 100. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
Fixed Issues with Imperva Data Protection Agent - v14.6 Patch 90. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
Fixed Issues with Imperva Data Protection Agent - v14.6 Patch 80. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90
Fixed Issues with Imperva Data Protection Agent - v14.6 Patch 70. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90
Fixed Issues with Imperva Data Protection Agent - v14.6 Patch 60. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91
Fixed Issues with Imperva Data Protection Agent - v14.6 Patch 50. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92
Fixed Issues with Imperva Data Protection Agent - v14.6 Patch 40. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92
Fixed Issues with Imperva Data Protection Agent - v14.6 Patch 30. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93
Fixed Issues with Imperva Data Protection Agent - v14.6 Patch 20. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93
Fixed Issues with Imperva Data Protection Agent - v14.6 Patch 10. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93
Proprietary Rights Notice. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95

Agent Release Notes 3

 Agent Release Notes

Data Protection Agent Release Notes

Welcome to the v14.6 Data Protection Agent Release Notes.

New Features
See Features Released with this Version.

Agent Release Notes 4

 Agent Release Notes

Features Released with this Version

Patch 130 Release Date: November 8, 2023
This patch contains the Windows database Agent packages only.

Bug fixes - see Fixed Issues with Imperva Data Protection Agent - v14.6 Patch 130

Patch 120 Release Date: October 30, 2023

systemd support: For Linux only, Agent loading is now done using systemd

Coverage: Data Protection Agents can now be used on the following:

• OEL 7-UEK supporting UEK 4, UEK 5 and UEK 6 kernels

• RHEL 9 - user space mode only
• Rocky Linux 9 - user space mode only

Bug fixes - No bug fixes are provided with this patch.

Patch 110 Release Date: September 27, 2023

Bug fixes - see Fixed Issues with Imperva Data Protection Agent - v14.6 Patch 110

Patch 100 Release Date: September 18, 2023

Coverage: Data Protection Agents can now be used on the following:

• OEL 9-UEK package supporting UEK 7 kernel. UEK 7 is currently supported in user space mode only.

Bug fixes - No bug fixes are provided with this patch.

Patch 90 Release Date: August 21, 2023

Coverage: Data Protection Agents can now be used on the following:

• OEL 8-UEK package supporting both UEK 6 and UEK 7 kernels. UEK 7 is currently supported in user space mode
only.

Bug fixes - see Fixed Issues with Imperva Data Protection Agent - v14.6 Patch 90

Agent Release Notes 5

 Agent Release Notes

Patch 80 Release Date: July 24, 2023

Coverage: Data Protection Agents can now be used on the following:

• Mongo 6 (excluding support for SELinux policy for MongoDB)

• Rocky Linux 8 for big data databases

Bug fixes - see Fixed Issues with Imperva Data Protection Agent - v14.6 Patch 80

Patch 70 Release Date: June 26, 2023

Coverage: Data Protection Agents can now be used on the following:

• AIX 7.3

Bug fixes - see Fixed Issues with Imperva Data Protection Agent - v14.6 Patch 70

Patch 60 Release Date: June 5, 2023

Bug fixes - see Fixed Issues with Imperva Data Protection Agent - v14.6 Patch 60

Patch 50 Release Date: March 20, 2023

Bug fixes - see Fixed Issues with Imperva Data Protection Agent - v14.6 Patch 50

Patch 40 Release Date: February 23, 2023

Coverage: Data Protection Agents can now be used on the following:

• Microsoft Windows 2022

• Microsoft SQL Server 2022
• SUSE 15 SP 4

Bug fixes - see Fixed Issues with Imperva Data Protection Agent - v14.6 Patch 40

Patch 30 Release Date: January 16, 2023

• MongoDB v5: Data Security Agents now support MongoDB v5
• Improved error reporting for Big Data agents: An enhancement has been made that improves how errors are
reported for Big Data agents including new error notifications for some agents, in some cases including a
troubleshooting step
• Upgraded 3rd Party Libraries: A number of 3rd party libraries were upgraded which mitigates vulnerabilities
that were present in those libraries

Agent Release Notes 6

 Agent Release Notes

Bug fixes - No bug fixes are provided with this patch.

Patch 20 Release Date: December 19, 2022

• Configure agent monitoring mode: You can configure the monitoring mode of an agent as kernel when you
install the agent.

Bug fixes - see Fixed Issues with Imperva Data Protection Agent - v14.6 Patch 20

Patch 10 Release Date: November 30, 2022

• Agent monitoring mode: The agent’s monitoring mode (kernel, user space, or both) can now be viewed both in
the MX UI and in the Agents’ report generated by the MX
• OpenSSL Upgrade to 3.0.7: OpenSSL has been upgraded to version 3.0.7
• Customized tmp directory path for Agent Installation: Users can now customize the tmp directory path
required when installing or upgrading Database Agents

Bug fixes - see Fixed Issues with Imperva Data Protection Agent - v14.6 Patch 10

Agent Release Notes 7

 Agent Release Notes

Database Support - Data Security Coverage Tool

Imperva database coverage is now available through the Imperva Data Security Coverage Tool, a dynamic intuitive
and easy to use interface that helps you identify coverage requirements for your agent deployment.

The tool lists supported coverage for all Imperva database products (DAM, DRA, Sonar).

See the tool at https://www.imperva.com/data-security-coverage-tool/

Using the tool is simple:

• Click an item, for example Database Cloudera Hadoop (CDH) 6.2; all supported environment variables become
highlighted
• Scroll down the page to see those variables such as Agent version, MX and Gateway version, supported
hypervisor and cloud platforms, etc.

Note: The Data Security Coverage Tool is replacing the database and OS coverage tables in the
Release Notes, those tables are no longer available.

Agent Release Notes 8

 Agent Release Notes

Agent Release Notes 9

 Agent Release Notes

Database Agent Installation

Database Agent Installation Files

This section reviews topics related to the Database Agent installation files and includes the following:

• Note on Agent Package Numbers

• Determining Which non-Windows Database Agent Package to Install
• Database Agent Package Installation File Names

Note on Agent Package Numbers

Starting with v13.0, Agent version build numbers (all digits that appear in the last part of the version string) are
composed of six numbers, they were previously composed of four numbers. This change has no impact on operation.

Determining Which non-Windows Database Agent Package to Install

Note: This section is not relevant to Windows Database Agents, because there is only one installation
package for all supported versions of Windows.

To determine which non-Windows Database Agent package to download and install, see Database Agent Package.

Alternatively, you can use the which_ragent_package_xxxx.sh script (where xxxx is the version number of the script).
The script is available at Imperva Customer Portal: click Downloads, then navigate to /Downloads/
SecureSphere_Agents/Misc/.

The script should be run on the database server and takes a single parameter,
-v
, the Database Agent version number you want to install.

For example:

Agent Release Notes 10

 Agent Release Notes

[root@agents-system tmp]# ./which_ragent_package_[version].sh -v 14.0

This means that you want the script to return the name of the Database Agent version 14 package for the platform on
which the script is run.

The script returns the OS, OS version, platform, kernel version and the name of the Database Agent package you
should download and install.

The following is an example of the output. Real output will reflect the current version.

[root@prod-rhel6-64-smp ~]# ./which_ragent_package_0157.sh -v 13.0

OS: RHEL

Version: 6

Platform: x86_64

Kernel: SMP

Latest DAM Agent package is: Imperva-ragent-RHEL-v6-kSMP-px86_64-b13.3.0.10.0.55

1148.tar.gz

Latest Big Data Agent package is: Imperva-ragent-bigdata-RHEL-v6-kSMP-px86_64-b1

3.3.0.10.0.551148.tar.gz

The above is a recommendation only. It is not a guarantee of agent support.

For an official list of agent packages and their supported platforms, please see
the latest SecureSphere Agent Release Notes.

*** Please verify that you run the latest version of which_ragent_package availa
ble at https://ftp-us.imperva.com ***

Notes:

• For servers that can host both regular and Big Data Agents, output includes the requisite
package for both scenarios, as seen in the above example.
• Always download the latest version of the which_ragent_package_xxxx.sh before using it,
otherwise it may point you to an out-of-date Imperva Agent package.
• Before downloading the Imperva Agent package, verify that the script has correctly identified
your OS, OS version, platform and kernel version.

Agent Release Notes 11

 Agent Release Notes

Database Agent Package Installation File Names

The installation package is used to install the Database Agent.

• For a list of standard agents for Database, see:

• Database Agent Packages Released with v14.6 Patch 130
• Database Agent Packages Released with v14.6 Patch 120
• Database Agent Packages Released with v14.6 Patch 110
• Database Agent Packages Released with v14.6 Patch 100
• Database Agent Packages Released with v14.6 Patch 90
• Database Agent Packages Released with v14.6 Patch 80
• Database Agent Packages Released with v14.6 Patch 70
• Database Agent Packages Released with v14.6 Patch 60
• Database Agent Packages Released with v14.6 Patch 50
• Database Agent Packages Released with v14.6 Patch 40
• Database Agent Packages Released with v14.6 Patch 30
• Database Agent Packages Released with v14.6 Patch 20
• Database Agent Packages Released with v14.6 Patch 10

The Database Agent’s build number is embedded in the name of the installation file.

Notes:

• The Database Agent for DB2 z/OS installation files and procedure are given in the Imperva
Administration Guide.
• Other Database Agents are available in this release only for the OS Versions listed in the table
below.

For minimum Database Agent disk space and memory requirements, see Agent Installation Requirements. Once the
Database Agent begins to monitor traffic, it requires additional memory and disk space, depending on the volume of
monitored traffic. For additional information, see the "Database Agents" chapter in the relevant product's User Guide,
under the Advanced Configuration section of the Settings tab.

Database Agent Packages Released with v14.8 Patch 50

OS / Version Installation File Name

Note: All platforms listed below additionally support patches installed on the listed versions.

Agent Release Notes 12

 Agent Release Notes

OS / Version Installation File Name

Suse

Note: These agents require downloading both the installation file listed here and the kabi_<n>.txt file. For more
information, see Special Considerations for Certain Linux Platforms.

SUSE 12 64-bit Imperva-ragent-SLE-v12-kSMP-px86_64-b14.8.0.50.0.649445.tar.gz

SUSE 15 64-bit Imperva-ragent-SLE-v15-kSMP-px86_64-b14.8.0.50.0.649445.tar.gz

Database Agent Packages Released with v14.8 Patch 40

OS / Version Installation File Name

Note: All platforms listed below additionally support patches installed on the listed versions.

AIX

AIX 7.1 64-bit Imperva-ragent-AIX-v71-ppowerpc64-b14.8.0.40.0.648342.tar.gz

AIX 7.2 64-bit Imperva-ragent-AIX-v72-ppowerpc64-b14.8.0.40.0.648342.tar.gz

AIX 7.3 64-bit Imperva-ragent-AIX-v73-ppowerpc64-b14.6.0.70.0.639352.tar.gz

OEL

Agent Release Notes 13

 Agent Release Notes

OS / Version Installation File Name

Note: These agents require downloading both the installation file listed here and the kabi_<n>.txt file. For
more information, see Special Considerations for Certain Linux Platforms.

OEL 9 UEK 64-bit Imperva-ragent-OEL-v9-kUEK-px86_64-b14.8.0.40.0.648342.tar.gz

Database Agent Packages Released with v14.8 Patch 30

OS / Version Installation File Name

Note: All platforms listed below additionally support patches installed on the listed versions.

Ubuntu

Ubuntu 16.04+ Imperva-ragent-UBN-px86_64-b14.8.0.30.0.647100.tar.gz

OEL

Note: These agents require downloading both the installation file listed here and the kabi_<n>.txt file. For
more information, see Special Considerations for Certain Linux Platforms.

OEL 8 UEK 64-bit (5.4.17-2011.2.2 to

the latest version of 5.4.17 UEK Imperva-ragent-OEL-v8-kUEK-px86_64-b14.8.0.30.0.647100.tar.gz
kernel series supported by Oracle)

Agent Release Notes 14

 Agent Release Notes

Database Agent Packages Released with v14.8 Patch 21

OS / Version Installation File Name

Note: All platforms listed below additionally support patches installed on the listed versions.

Red Hat (includes Oracle Linux and

CentOS)

RHEL 7 64-bit SMP Imperva-ragent-RHEL-v7-kSMP-px86_64-b14.8.0.21.0.647922.tar.gz

Database Agent Packages Released with v14.8 Patch 20

OS / Version Installation File Name

Note: All platforms listed below additionally support patches installed on the listed versions.

Red Hat (includes Oracle Linux and

CentOS)

Imperva-ragent-bigdata-RHEL-kSMP-px86_64-
RHEL 64-bit SMP BigData
b14.8.0.20.0.646164.tar.gz

RHEL 64-bit SMP BigData PowerPC Imperva-ragent-bigdata-RHEL-kSMP-pppc64le-

LE b14.8.0.20.0.646164.tar.gz

RHEL 7 64-bit SMP Imperva-ragent-RHEL-v7-kSMP-px86_64-b14.8.0.20.0.646161.tar.gz

Agent Release Notes 15

 Agent Release Notes

Database Agent Packages Released with v14.8 Patch 10

OS / Version Installation File Name

Note: All platforms listed below additionally support patches installed on the listed versions.

Red Hat (includes Oracle Linux and

CentOS)

RHEL 8 64-bit SMP Imperva-ragent-RHEL-v8-kSMP-px86_64-b14.8.0.10.0.645052.tar.gz

Solaris

Sun 5.11 SPARC Imperva-ragent-SunOS-v5.11-psparcv9-b14.8.0.10.0.645052.tar.gz

Agent Installation Requirements

This section reviews Database Agent installation requirements, including the following:

• Agent Memory Requirements

• Agent Disk Space Requirements
• Platform Specific Notes for the Database Agent

Agent Memory Requirements

The Database Agent requires memory for operation based on different factors. The following lists the amount of
memory that is required for operation based on the number of CPU cores:

Agent Release Notes 16

 Agent Release Notes

Name Windows Linux/Unix

1-32 cores 300MB 360MB

32-128 cores 500MB 660MB

>128 cores 2GB 2GB

Agent Disk Space Requirements

The Database Agent uses up to 500 MB of database server disk space for its normal operation, logging, storing
configuration, and more. In addition, to ensure audit information is preserved in the event of network problems, the
Database Agent reserves 8 GB of database server disk space by default. You can change the amount of disk space
being reserved, as well as the location where this information is saved. For information on how to change this value,
see the article Agents - Modifying the PCAP quota created on the Database in the Imperva Customer Portal.

Diskspace Requirements

Operation AIX Solaris Linux Windows

Normal operation, logging, storing

configuration, and more 500 MB 500 MB 500 MB 500 MB
(Installation folder)

Ensure audit information is

preserved in the event of network 8 GB 8 GB 8 GB 8 GB
problems

Required when Upgrading Agents* 750 MB 1500 MB 250 MB 300 MB

*Disk space allocation used when upgrading is divided between the tmp folder and Agent folder. For more
information see the following article titled What is the minimum disk space requirement to install the agent in the
Imperva Customer Portal.

Agent Release Notes 17

 Agent Release Notes

Platform Specific Notes for the Database Agent

This section reviews platform specific information for Database Agents.

Note: The topics in this section explicitly related to standard Database Agents, they are not relevant
for Database Agent for Big Data.

This section reviews the following:

• Special Considerations for Certain Linux Platforms

• Database Agents on Microsoft Windows
• Database Agents on Ubuntu
• Prerequisites when Installing the Database Agent for Big Data

Special Considerations for Certain Linux Platforms

Some Linux platforms maintain several versions of their OS, and service packs for each version. Additionally, SUSE,
Teradata, and OEL UEK, periodically release updates to service packs, which sometimes include updated versions of
the kernel.

As such, there are a number of items that should be taken into account and understood before installing Imperva Data
Security Agents on these Operating Systems. For more information, see:

• Obtaining the Latest Version of the SecureSphere Agent

• Verifying Prerequisites for non-Windows Agents

in the DAM Administration Guide.

Database Agents on Microsoft Windows

When working with the Database Agent on Microsoft Windows 2008 and newer, Base Filtering Engine (BFE) service
must be enabled on the database server. For more information, see Microsoft Windows documentation.

Agent Release Notes 18

 Agent Release Notes

Database Agents on Ubuntu

Please note the following considerations for the Database Agent when installed on Ubuntu:

• The installation folder for the Database Agent on Ubuntu is /usr/imperva and cannot be modified.
• Databases that support the Database Agent on Ubuntu include Postgre SQL and MySQL.

Prerequisites when Installing the Database Agent for Big Data

DataStax Enterprise Cassandra: To run the Database Agent for Big Data on Cassandra databases, Cassandra must be
run with Java Development Kit (JDK). For more information, see the article titled Installing OpenJDK on RHEL-based
Systems on the Datastax website.

Installing Database Agents

This section reviews topics related to the installing of Database Agents and includes the following:

• Installing and Upgrading Database Agents

• Required Permissions for Agent Installation/Configuration
• Database Agent Package
• Upgrading Database Agents
• After Installing the Database Agent

Installing and Upgrading Database Agents

Before downloading the Database Agent installation file(s), please read carefully the "Installing Database Agents"
chapter in the Imperva Administration Guide.

Notes:

• To understand which Agent versions work with which Gateway versions, refer to the Data
Security Coverage Tool at https://www.imperva.com/data-security-coverage-tool/ before
upgrading your Agents.
• In Unix and Unix-like systems, the bash shell must be available before installing the Database
Agent.

Agent Release Notes 19

 Agent Release Notes

Required Permissions for Agent Installation/Configuration

To install and configure agents, you require administrator privileges. To run with administrator privileges:

• In Windows: Open the Windows Start Menu, search for ‘cmd,’ then right-click cmd.exe and select "Run as
administrator." In command window, navigate to location of installation package and run as required.
• In Unix/Linux: Run as root user (uid=0)

Database Agent Package

Imperva supports downloading and deploying agents from the Software Updates screen in the Management Server
GUI. The agent is provided as a compressed file (.tar.gz for Unix, .zip for Windows), which includes a number of other
files.

The content of the compressed file include:

• An installation file for the Database Agent. This file is a .bsx for Unix or .msi for Windows and its name contains
the string ragent.
• An installation file for the Database Agent Installation Manager. This file is a .bsx for Unix or .msi for Windows
and its name contains the string ragentinstaller.
• An installation batch file (install.sh). This file is only part of the Unix installation package. It is not included with
the Windows installation package.
• A readme file.
• A file with the suffix "metadata" which is used by the agent installation manager.

Upgrading Database Agents

Note: For information on upgrading Database Agent via Software Update see the Administration Guide.

In Windows, install the Database Agent and if there is an existing Database Agent installed, it will be upgraded. In Unix,
use the -u parameter in the installation command.

Notes:

• In both Windows and Unix, there is no need to re-register an upgraded Database Agent.
• When upgrading Database Agent's for AIX, you need to restart the database after agent upgrade is complete.

To upgrade a Unix Agent to v14.6:

1. Download the new agent package.

◦ To determine what installation package you need to download, see Determining Which non-Windows
Database Agent Package to Install
◦ For a list of available agent package file names, see Database Agent Package Installation File Names
2. Untar (uncompress) the agent package as follows:

Agent Release Notes 20

 Agent Release Notes

cd <folder>

gunzip <filename>.tar.gz | xargs tar xvf <agent-tar-filename>

3. Install the new Database Agent using the following upgrade parameters:

./install.sh

Note: If installing or upgrading on SUSE or UEK systems, you need to add the following to the above command:

-k kabi_<n>.txt

Example:

./Imperva-ragent-OEL-v7-kUEK-v5-px86_64-b14.6.0.120.0.643876.bsx -u -k kabi_
0081.txt

For more information on using this command see the Imperva Admin Guide.

To upgrade a Windows agent to v14.6:

1. Download and unzip the new agent package file (.zip).

2. Double-click the file named Imperva-ragent-Windows-<fileversion>.msi, the agent is upgraded.
3. Install the installation manager: Double-click the file named Imperva-ragentinstaller-Windows-
<fileversion>.msi, the agent installation manager is installed. Note: this step is only relevant when installing
with a management server version 10.5 or newer.

After Installing the Database Agent

The following topics review important post installation information for the Database Agent:

• AIX Post Installation Information

• Locally Caching Monitored Traffic
• The Agent Compatibility Package (ACP)

AIX Post Installation Information

If you have installed the Database Agent on a machine on which no Database Agent was previously installed, then:

• You must restart all database instances and processes after the first time you start the SecureSphere Agent. For
example, in Oracle, the main listener process “tnslsnr” should also be restarted.
• If you want to enable the source IP address feature, you must restart the login servers (SSH, Telnet, Rlogin) after
the first time you start the Database Agent.

Agent Release Notes 21

 Agent Release Notes

There is no need to reboot the server.

Locally Caching Monitored Traffic

When the Database Agent is unable to send database traffic to the Gateway (for example, if the communication link to
the Gateway is down) it stores the data to disk until such time as the data can be sent to the Gateway. Parameters
controlling the location and size of these disk files can be configured in the Advanced Configuration section of the
Database Agent’s Settings tab. For more information, see the Settings Tab - Database Settings Section topic DAM User
Guide.

The Agent Compatibility Package (ACP)

Every four-to-six weeks, Imperva provides a new Agent Compatibility Package (ACP) which contains all the
information that agents need to work with the latest database releases. For more information, see the Using the
Agent Compatibility Package topic in the Imperva DAM User Guide.

Agent Release Notes 22

 Agent Release Notes

Agent Patch Open Issues

This section includes information regarding bugs that were open at the time of the release of each patch including the
following:

• Open Issues with Imperva Data Protection Agent - v14.6 Patch 130
• Open Issues with Imperva Data Protection Agent - v14.6 Patch 120
• Open Issues with Imperva Data Protection Agent - v14.6 Patch 110
• Open Issues with Imperva Data Protection Agent - v14.6 Patch 100

Open Issues with Imperva Data Protection Agent - v14.6 Patch

130

Agent Database/
ID Agent OS Description
Product

On AIX, in order to audit correctly the remote user of

local connections, processes which handle remote
AGNT-10788 AIX All Databases
login (such as sshd and telnet) must be restarted after
the agent installation.

'User name' was not part of the process argument,

AGNT-7542 AIX All Databases and therefore could not be excluded as part of the
'argument' in the process details criteria.

When monitoring Informix SHM, audit data may be

AGNT-7249 AIX Informix
missing for large responses.

In AIX 7.1, in rare cases, when monitoring Informix

AGNT-7513 AIX Informix SHM large responses, part of the response is missing
in the audit.

Agent Release Notes 23

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product

Traffic might not be audited for local connections for

AGNT-9115 AIX Informix
Informix v10.

When Oracle DB is configured in 'shared mode' there

AGNT-10796 AIX Oracle
is no audit.

The Exclude operation doesn't work with agent and

AGNT-11278 AIX Oracle
gateway combined criteria with BEQ connections.

Watchdog/InjectionManager/crashes counter might

AGNT-11539 AIX Oracle
increase due to early wakeup of Injection manager.

In rare cases there is no audit in open mode ASO

AGNT-11973 AIX Oracle
connections.

Audit loss of up to 0.3% of the traffic was

AGNT-8223 AIX Oracle
encountered.

AGNT-8446 AIX Oracle Limitation: ASO is not supported on AIX WPAR.

Open mode ASO connections are not being monitored

AGNT-9353 AIX Oracle after Agent upgrade or after uninstalling and then
installing a different Agent version.

Only 126 ASO connections out of 200 that are opened

AGNT-9801 AIX Oracle
concurrently are monitored.

Agent Release Notes 24

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product

If ASO interception is disabled in the Agent, and there

AIX, Linux,
AGNT-10234 Oracle are ASO connections in the Database, alarm won't be
Solaris
generated until a new ASO connection starts.

If the RemoteAgent listener in the Imperva Gateway is

changed from non SSL to SSL, the Imperva Agents
AGNT-10194 All All Databases registered to this Gateway will no longer be able to
communicate with the gateway. Workaround: re-
register relevant Imperva Agents.

On rare occasions, when unregistering an Agent from

the gateway that was in 'full-trust' trust mode, and
AGNT-10206 All All Databases then registering it without trust enabled, the agent
will not be able to start. Workaround: uninstall and
reinstall the agent.

Combining two or more monitoring rules, with some

AGNT-10228 All All Databases of them Agent criteria and others gateway criteria
does not work properly.

The equals sign (=) is not supported for the password

of the Imperva user when registering agent to the
AGNT-10281 All All Databases
gateway using command line. Using the equals sign in
the password when registering from the CLI works.

The Imperva Agent cannot be installed in a root

AGNT-10908 All All Databases
directory (C:\ for example), but only in a subfolder.

After deleting the CloudFormation stack, there are

AGNT-12976 All All Databases
files leftover in the S3 bucket.

Agent Release Notes 25

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product

When moving an agent, make sure the target gateway

AGNT-13796 All All Databases
has the agent listener .

When moving an agent, the agent-cluster does not

AGNT-13802 All All Databases
move to the target gateway.

After gateway restart, wrong event capture time is

AGNT-7676 All All Databases
reported for logout operations.

In cases when the system parameter max_pid was

AGNT-8084 All All Databases modified after ragent was loaded, some audit will be
lost.

During agent move, Agent status might temporarily

AGNT-8151 All All Databases change to Running With Errors 'Data connection to
gateway has been lost'.

Agent and gateway cannot communicate when the

AGNT-8268 All All Databases gateway is configured as Reverse Proxy and to accept
only ECDH ciphers.

During an automatic agent move, the agent's status

AGNT-8395 All All Databases
might temporarily change to "Bad Connectivity."

When the agent is disconnected from the Gateway,

AGNT-8487 All All Databases
audit loss may occur.

In cases where the server had no free disk space, after

freeing some space the RACLI interface may show
AGNT-8558 All All Databases
errors. Agent stop/start via the Agent CLI may resolve
the issue.

Agent Release Notes 26

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product

On rare occasions, the Remote Agent process crashes

AGNT-8559 All All Databases
during shutdown.

After re-registering the agent to a different MX, the

AGNT-8790 All All Databases
hostname might not be correctly reflected in the MX.

When installing the SecureSphere Agent Installation

AGNT-8981 All All Databases Manager only, users cannot change the path of the
download directory in the MX GUI.

Advanced configuration of "kernel-max-pid" and of

"kernel-max-pid-limit" will not affect the agent if their
AGNT-9034 All All Databases
value is higher than maximum number of process
defined in the operating system.

Agent crashes when enabling "send-ack"

AGNT-9151 All All Databases configuration from additional-configuration.
Workaround: disable configuration.

In rare cases the agent may fail to get a valid

AGNT-9362 All All Databases
certificate when starting trust migration.

Remote Agent CTRL process uses high CPU when

AGNT-9850 All All Databases
setup has trust and gateway cluster.

In rare scenarios, agent log files can take more disk

AGNT-9882 All All Databases
space than defined.

Using the Dbeaver client, when setting inline sniffing

AGNT-11524 All All RDBMS Databases and the followed action after blocking is IP/User block
the Dbeaver may accept few more queries until
blocking is applied. This could happen when the

Agent Release Notes 27

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product

Dbeaver opens more than 1 connection to the Server

and each open connection will accept one query
before being blocked.

AGNT-11565 All DB2 All Import/export were not audited in DB2.

When monitoring DB2 Shared memory connections,

AGNT-7232 All DB2 All
the response size in audit appears as 0.

When configuring Traffic Monitoring Rule with Process

AGNT-7272 All Informix details - Agent criteria, and using the arguments
parameter, the character @ is not supported.

"An active shared server has been detected" alert

AGNT-10844 All Oracle could appear even though Oracle is not in shared
server mode.

AGNT-11507 All PostgreSQL Import/export were not audited in PostgreSql.

SecureSphere doesn't audit activity that takes place

AGNT-9919 All Progress in shared memory, for example activity of the
Progress Openedge utility.

On rare occasions, when there are issues with the rpm

AGNT-10315 Linux All Databases database, the agent can cause performance
degradation.

Large responses are sometime not audited if the

AGNT-11244 Linux All Databases
database is monitored in the user-space.

Agent Release Notes 28

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product

RHEL6 K0 (kernel patches lower than p5): the

AGNT-7660 Linux All Databases SecureSphere Agent cannot coexist with the
Vormetric Agents.

Changing the ragent installation directory while

AGNT-10072 Linux All RDBMS Databases upgrading ragent version may cause audit loss until
next database restart.

If Data Interface discovery is disabled, there is no

AGNT-10128 Linux All RDBMS Databases audit for MsSQL on Linux and Teradata version 16.1
and up.

User space monitoring will not work when the agent

AGNT-10195 Linux All RDBMS Databases
installation directory is larger than 75 characters.

Audit loss may be experienced with connections that

AGNT-10705 Linux All RDBMS Databases are opened shortly (seconds) after database restart
when user-space interception is active.

AGNT-12838 Linux Cloudera Impala Impala failed login is not captured in MX.

The DataBase field in MX audit data might be

AGNT-12054 Linux DataStax Cassandra incorrect when running commands without explicitly
specifying the relevant keyspace.

Create Function statements might not be displayed in

AGNT-12102 Linux DataStax Cassandra
MX audit.

The DataBase field in MX audit data might be

AGNT-13783 Linux DataStax Cassandra incorrect when running commands without explicitly
specifying the relevant keyspace.

Agent Release Notes 29

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product

The DataBase field in MX audit data might be

AGNT-13787 Linux DataStax Cassandra incorrect when running commands without explicitly
specifying the relevant keyspace.

After agent restart, audit of few transactions might be

AGNT-11743 Linux DB2 for LUW
lost.

"Object" column in audit for "db.collection.copyTo()"

AGNT-11747 Linux MongoDB command shows the database name instead of the
collection name.

"Object" column in audit is empty for commands

adb.testData.storageSize(),
AGNT-11748 Linux MongoDB
db.testData.totalIndexSize() and
db.testData.totalSize().

Failed authentication using to disabled

AGNT-13734 Linux MongoDB
authentication mechanisms are not monitored.

Connections that are established just after the

AGNT-10127 Linux MSSQL database starts might be audited as a 'connected
user.'

AGNT-11757 Linux MSSQL No audit is available for IPC connections.

MySQL upgrade fails with errors in collector log

starting with
[ERROR]UnifiedLogsPeriodicThread.cpp:218 Cant
AGNT-11641 Linux MySQL
open dir for scan. Workaround is available in the
customer knowledgebase at https://
docs.imperva.com/howto/6be1fc2c

Agent Release Notes 30

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product

On rare occasions while the server is highly loaded,

AGNT-13743 Linux MySQL and the agent restarts many times, the agent stops
monitoring traffic.

On rare occasions while the server is highly loaded,

AGNT-13929 Linux MySQL and the agent restarts many times, it is not possible to
stop the database MySQL.

When inline mode is configured, ASO shared mode

AGNT-10561 Linux Oracle
results in a connection delay.

SQL exception is not detected for non-existing table

AGNT-10942 Linux Oracle
on Diffie Hellman open mode connections.

Oracle Recovery Manager (RMAN) jobs might get stuck

AGNT-11324 Linux Oracle when agent is active and ASO Monitoring is enabled in
the agent.

On rare occasions, logout notification missing for tcp

AGNT-11654 Linux, Unix Oracle
connections of DB2.

When an Agent reconnects to the gateway, some of

Linux,
AGNT-11851 All Databases the traffic audit that was intercepted during the
Windows
disconnection time might be lost.

Missing audit may be encountered when a query

OEL (non- command hasn't fetched all the data that the query
Cloudera Hive,
AGNT-11581 UEK), OEL- returned, e.g., when using Hue UI, the fetches are
Hortonworks Hive
UEK, RHEL done in chunks of 1000 rows and the next fetch is
done when the user scrolls down the UI.

Agent Release Notes 31

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product

Vendor Meltdown patches for RHELv7 and for RHELv6

AGNT-9964 RHEL All Databases operating systems cause the SecureSphere Agent to
fail during start.

When performing an operation in HDFS through REST

Cloudera HDFS,
AGNT-10655 RHEL API, the source IP in MX audit is always be the local IP
Hortonworks HDFS
of the server.

A few types of SQL exceptions are not reported in

AGNT-10006 RHEL Cloudera Impala
Impala.

Some failed login events on connecting with x.509

AGNT-13650 RHEL MongoDB certificate authentication might not be monitored on
MongoDB 4.4 and above.

When working with Diffie Hellman on Postgres on

AGNT-12787 RHEL PostgreSQL RHEL 8, audit for connections that were opened when
the agent was down won't be seen.

When running GTI on Solaris 10, the error message

AGNT-7856 Solaris All Databases
"ln: cannot create [...]: File exists" may appear.

If Oracle is configured to work in shared-server-mode,

AGNT-10042 Solaris Oracle
Diffie-Hellman connections will not be monitored.

When upgrade from v13.0 to v13.1 or later, open

AGNT-10249 Solaris Oracle mode connections won't be audited. Workaround:
Restart the Database after the upgrade.

'Source of activity' field mistakenly displays 'remote'

AGNT-8958 Solaris Oracle
for local connection on Solaris global zone.

Agent Release Notes 32

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product

GTI doesn't collect ASO logs when "shared" folder is

AGNT-9378 Solaris Oracle
defined in non default location.

When 200 simultaneous ASO connections are open,

AGNT-9785 Solaris Oracle
some are not being monitored.

When the Oracle database is installed on a Solaris

zone which isn't Global and the Agent ASO is enabled,
AGNT-9847 Solaris Oracle
Agent may display error with message "Oracle ASO
monitoring failed".

In rare cases, due to startup scheduling, a complete

AGNT-10146 SUSE All Databases loss of audit data may occur. Workaround: restart the
agent.

Vendor Meltdown patches for SUSE Operating

AGNT-9946 SUSE All Databases Systems cause the SecureSphere Agent to fail during
startup.

When Oracle is configured to work in shared mode

with ASO encryption, connections might not be
audited after agent restart when the database server
AGNT-11850 SUSE Oracle
had been started before the agent and there were no
external connections to the database when the agent
went up.

If kernel option 'kptr_restric' is set to '2', the Imperva

AGNT-11795 SUSE PostgreSQL kernel module will fail to load. Workaround - set
kptr_restric to 1.

When layer-C is enabled, there might be invalid audit

AGNT-11801 SUSE SAP-HANA
of the responses from the database.

Agent Release Notes 33

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product

When using SAP-HANA 12, moving from sniffing to

AGNT-8696 SUSE SAP-HANA inline mode and vise versa doesn't work with local
TCP connections.

In Teradata 16.1 and above the CPU consumption of

ragent process is higher than in older Teradata
AGNT-9471 SUSE Teradata versions. Work around: Client may disable TD-API
method using advanced config in order to work the
same as older Teradata versions.

On rare occasions, uninstalling the SecureSphere

AGNT-9959 SUSE Teradata Agent might cause the Teradata database to freeze
up.

If more than a single PDE is installed on the machine,

AGNT-11611 SUSE-Teradata Teradata GTI will fail. Workaround: Collect the required
information manually.

The Ubuntu 14.04 agent can't be installed or

AGNT-9947 Ubuntu All Databases
upgraded using Software Update.

When systemd in enabled, a permission issue is

encountered that requires restarting the database to
AGNT-12205 Ubuntu MariaDB, MySQL resolve. In Ubuntu, systemd is enabled by default.
Workaround: After starting the agent, restart the
database.

First queries received with an Agent with open mode

AGNT-10165 Unix All Databases
connections are not audited.

When connecting to a machine before the agent is

AGNT-9265 Unix All Databases
working, the remote login isn't detected. Some
applications (such as SecureCRT) reuse previous SSH

Agent Release Notes 34

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product

connections thereby preventing the remote login

from being detected.

Agent fails to start if the agent folder is located on XFS

AGNT-9456 Unix All Databases
with 64bit i-nodes.

Incomplete audit for TCP local traffic. Workaround:

Add the following item in the SecureSphere Agent's
AGNT-10266 Unix MySQL Advanced Configuration pane:
<kernel_support_local_traffic_in_server_side>0</
kernel_support_local_traffic_in_server_side>.

Open mode is not supported for encrypted and non-

encrypted Oracle connections during upgrade from
AGNT-8409 Unix Oracle Agent version less than v12 to Agent version v12 and
newer, when ASO monitoring is enabled prior to the
upgrade.

If monitoring Diffie-Helman traffic while ASO in the

agent is disabled, agent enters running with errors. If
AGNT-9389 Unix Oracle
disabling DH traffic on the database while ASO is still
disabled in the agent, running-with-errors persists.

When working with connections that utilize high ports

AGNT-8054 Unix Progress
with Progress DB, open mode is not supported.

No IPv6 listener system event is generated if the

AGNT-11916 Windows All Databases
channel is added manually.

When upgrading from agent versions earlier than

11.0, server might cause lower agent performance.
AGNT-6189 Windows All Databases
Workaround: Reboot the database server after
upgrade.

Agent Release Notes 35

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product

AGNT-6256 Windows All Databases On rare occasions, agent uninstall may fail.

Upgrading the Windows Agent to the same Agent

AGNT-7084 Windows All Databases
version will fail.

When executing first time installation of the

SecureSphere Agent or upgrading from v11.0 and
AGNT-7369 Windows All Databases earlier and working with EIK on Windows Server 2012
and newer, SecureSphere cannot monitor previously
established connections.

AGNT-7533 Windows All Databases On rare occasions, process details are missing.

When a MySQL, Oracle or DB2 database is accessed

using Windows authentication and Kerberos
AGNT-8680 Windows All Databases
authentication is used, the username will not be
audited.

On Windows Server 2012, if open connections exist

prior to installing the agent, running new short
AGNT-8764 Windows All Databases
connections could cause non-existent logouts to
appear in audit of open mode connections.

Updating a channel (etc. disabling then re-enabling)

AGNT-8765 Windows All Databases
causes audit loss.

DrWeb antivirus mistakenly detects Imperva agent as

AGNT-8915 Windows All Databases
a Trojan.

AGNT-8920 Windows All Databases When external traffic is monitored by pcap on

windows platforms, disabling and enabling network

Agent Release Notes 36

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product

interface while agent is running will cause complete

audit loss. Workaround: restart the Agent.

If the DB client connects to the DB server via 'shared

AGNT-8678 Windows DB2 All
memory,' the source IP address in audit is missing.

AGNT-8393 Windows MariaDB Maria DB IPC channel is not supported.

Certificate discovery might not work properly if two

AGNT-10137 Windows MSSQL different databases are running with the same user
but with different domains.

If Advanced Monitoring Mode is enabled, open-mode

AGNT-10575 Windows MSSQL connections are not monitored with some clients
(such as the Querier).

Channel over LocalTCP traffic is displayed on MX as

AGNT-11228 Windows MSSQL
MsSqlIPC.

The client remote session IP address might be missing

if the MSSQL server user has insufficient permissions
AGNT-11241 Windows MSSQL
to obtain it. This results in the inability to block the
connection by its source IP.

After blocking in sniffing mode for local TCP

AGNT-6398 Windows MSSQL connections, it takes about a minute for the client to
close the local TCP session.

When changing the login user of MSSQL server, its

AGNT-7994 Windows MSSQL corresponding IPC channel log directory needs to be
manually deleted. Otherwise, there will be no audit.

Agent Release Notes 37

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product

In cases where there is more than one MSSQL

database on a server, all databases are running and
AGNT-8087 Windows MSSQL
RC4 user is used for Kerberos, Hashed Users may
appear in audit.

Agent fails to discover certificate after changing user

that runs the MSSQL service. Workaround: Restart the
AGNT-8923 Windows MSSQL
database to discover the new certificate. Relevant for
MSSQL 2016.

In advanced mode, if a user ignores IPC channel and

AGNT-8988 Windows MSSQL then un-ignores it, existing connections are not
monitored.

Open mode connections are not monitored on

AGNT-9032 Windows MSSQL
remote-named-pipe channel.

When a machine has more than one MsSql server

installed that are running under the same user name
AGNT-9874 Windows MSSQL but from different domains, the default MsSql
certificate might not be extracted for some of the
servers.

On Windows with Postgres monitoring in user space

AGNT-13217 Windows PostgreSQL
mode the OS User Chain might not be correct.

On Windows with Postgres monitoring in user space

AGNT-13218 Windows PostgreSQL mode, on occasion the agent might fail to exclude TCP
local traffic based on the process details criteria.

Agent Release Notes 38

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product

On Windows with Postgres monitoring in user space

AGNT-13219 Windows PostgreSQL mode encrypted local connections, the connection
might not be blocked in sniffing mode.

On Windows with Postgres monitoring in user space

AGNT-13220 Windows PostgreSQL mode, a filtered connection might not stay filtered
after agent restart.

When sending a query from a client in one domain to

an MSSQL server in another domain with MSSQL
AGNT-8913 Windows 2012 All Databases
service running an AD user in the first domain, hashed
user is received.

Open Issues with Imperva Data Protection Agent - v14.6 Patch

120

Agent Database/
ID Agent OS Description
Product)

On AIX, in order to audit correctly the remote user of

local connections, processes which handle remote
AGNT-10788 AIX All Databases
login (such as sshd and telnet) must be restarted after
the agent installation.

'User name' was not part of the process argument, and

AGNT-7542 AIX All Databases therefore could not be excluded as part of the
'argument' in the process details criteria.

Agent Release Notes 39

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product)

When monitoring Informix SHM, audit data may be

AGNT-7249 AIX Informix
missing for large responses.

In AIX 7.1, in rare cases, when monitoring Informix SHM

AGNT-7513 AIX Informix large responses, part of the response is missing in the
audit.

Traffic might not be audited for local connections for

AGNT-9115 AIX Informix
Informix v10.

When Oracle DB is configured in 'shared mode' there is

AGNT-10796 AIX Oracle
no audit.

The Exclude operation doesn't work with agent and

AGNT-11278 AIX Oracle
gateway combined criteria with BEQ connections.

Watchdog/InjectionManager/crashes counter might

AGNT-11539 AIX Oracle
increase due to early wakeup of Injection manager.

In rare cases there is no audit in open mode ASO

AGNT-11973 AIX Oracle
connections.

AGNT-8223 AIX Oracle Audit loss of up to 0.3% of the traffic was encountered.

AGNT-8446 AIX Oracle Limitation: ASO is not supported on AIX WPAR.

Open mode ASO connections are not being monitored

AGNT-9353 AIX Oracle after Agent upgrade or after uninstalling and then
installing a different Agent version.

Agent Release Notes 40

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product)

Only 126 ASO connections out of 200 that are opened

AGNT-9801 AIX Oracle
concurrently are monitored.

If ASO interception is disabled in the Agent, and there

AIX, Linux,
AGNT-10234 Oracle are ASO connections in the Database, alarm won't be
Solaris
generated until a new ASO connection starts.

If the RemoteAgent listener in the Imperva Gateway is

changed from non SSL to SSL, the Imperva Agents
AGNT-10194 All All Databases registered to this Gateway will no longer be able to
communicate with the gateway. Workaround: re-
register relevant Imperva Agents.

On rare occasions, when unregistering an Agent from

the gateway that was in 'full-trust' trust mode, and
AGNT-10206 All All Databases then registering it without trust enabled, the agent will
not be able to start. Workaround: uninstall and reinstall
the agent.

Combining two or more monitoring rules, with some of

AGNT-10228 All All Databases them Agent criteria and others gateway criteria does
not work properly.

The equals sign (=) is not supported for the password

of the Imperva user when registering agent to the
AGNT-10281 All All Databases
gateway using command line. Using the equals sign in
the password when registering from the CLI works.

The Imperva Agent cannot be installed in a root

AGNT-10908 All All Databases
directory (C:\ for example), but only in a subfolder.

Agent Release Notes 41

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product)

After deleting the CloudFormation stack, there are files

AGNT-12976 All All Databases
leftover in the S3 bucket.

When moving an agent, make sure the target gateway

AGNT-13796 All All Databases
has the agent listener .

When moving an agent, the agent-cluster does not

AGNT-13802 All All Databases
move to the target gateway.

After gateway restart, wrong event capture time is

AGNT-7676 All All Databases
reported for logout operations.

In cases when the system parameter max_pid was

AGNT-8084 All All Databases modified after ragent was loaded, some audit will be
lost.

During agent move, Agent status might temporarily

AGNT-8151 All All Databases change to Running With Errors 'Data connection to
gateway has been lost'.

Agent and gateway cannot communicate when the

AGNT-8268 All All Databases gateway is configured as Reverse Proxy and to accept
only ECDH ciphers.

During an automatic agent move, the agent's status

AGNT-8395 All All Databases
might temporarily change to "Bad Connectivity."

When the agent is disconnected from the Gateway,

AGNT-8487 All All Databases
audit loss may occur.

Agent Release Notes 42

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product)

In cases where the server had no free disk space, after

freeing some space the RACLI interface may show
AGNT-8558 All All Databases
errors. Agent stop/start via the Agent CLI may resolve
the issue.

On rare occasions, the Remote Agent process crashes

AGNT-8559 All All Databases
during shutdown.

After re-registering the agent to a different MX, the

AGNT-8790 All All Databases
hostname might not be correctly reflected in the MX.

When installing the SecureSphere Agent Installation

AGNT-8981 All All Databases Manager only, users cannot change the path of the
download directory in the MX GUI.

Advanced configuration of "kernel-max-pid" and of

"kernel-max-pid-limit" will not affect the agent if their
AGNT-9034 All All Databases
value is higher than maximum number of process
defined in the operating system.

Agent crashes when enabling "send-ack" configuration

AGNT-9151 All All Databases from additional-configuration. Workaround: disable
configuration.

In rare cases the agent may fail to get a valid certificate

AGNT-9362 All All Databases
when starting trust migration.

Remote Agent CTRL process uses high CPU when setup

AGNT-9850 All All Databases
has trust and gateway cluster.

Agent Release Notes 43

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product)

In rare scenarios, agent log files can take more disk

AGNT-9882 All All Databases
space than defined.

Using the Dbeaver client, when setting inline sniffing

and the followed action after blocking is IP/User block
the Dbeaver may accept few more queries until
AGNT-11524 All All RDBMS Databases blocking is applied. This could happen when the
Dbeaver opens more than 1 connection to the Server
and each open connection will accept one query
before being blocked.

AGNT-11565 All DB2 All Import/export were not audited in DB2.

When monitoring DB2 Shared memory connections,

AGNT-7232 All DB2 All
the response size in audit appears as 0.

When configuring Traffic Monitoring Rule with Process

AGNT-7272 All Informix details - Agent criteria, and using the arguments
parameter, the character @ is not supported.

"An active shared server has been detected" alert could

AGNT-10844 All Oracle appear even though Oracle is not in shared server
mode.

AGNT-11507 All PostgreSQL Import/export were not audited in PostgreSql.

SecureSphere doesn't audit activity that takes place in

AGNT-9919 All Progress shared memory, for example activity of the Progress
Openedge utility.

Agent Release Notes 44

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product)

On rare occasions, when there are issues with the rpm

AGNT-10315 Linux All Databases database, the agent can cause performance
degradation.

Large responses are sometime not audited if the

AGNT-11244 Linux All Databases
database is monitored in the user-space.

RHEL6 K0 (kernel patches lower than p5): the

AGNT-7660 Linux All Databases SecureSphere Agent cannot coexist with the Vormetric
Agents.

Changing the ragent installation directory while

AGNT-10072 Linux All RDBMS Databases upgrading ragent version may cause audit loss until
next database restart.

If Data Interface discovery is disabled, there is no audit

AGNT-10128 Linux All RDBMS Databases
for MsSQL on Linux and Teradata version 16.1 and up.

User space monitoring will not work when the agent

AGNT-10195 Linux All RDBMS Databases
installation directory is larger than 75 characters.

Audit loss may be experienced with connections that

AGNT-10705 Linux All RDBMS Databases are opened shortly (seconds) after database restart
when user-space interception is active.

AGNT-12838 Linux Cloudera Impala Impala failed login is not captured in MX.

The DataBase field in MX audit data might be incorrect

AGNT-12054 Linux DataStax Cassandra when running commands without explicitly specifying
the relevant keyspace.

Agent Release Notes 45

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product)

Create Function statements might not be displayed in

AGNT-12102 Linux DataStax Cassandra
MX audit.

The DataBase field in MX audit data might be incorrect

AGNT-13783 Linux DataStax Cassandra when running commands without explicitly specifying
the relevant keyspace.

The DataBase field in MX audit data might be incorrect

AGNT-13787 Linux DataStax Cassandra when running commands without explicitly specifying
the relevant keyspace.

After agent restart, audit of few transactions might be

AGNT-11743 Linux DB2 for LUW
lost.

"Object" column in audit for "db.collection.copyTo()"

AGNT-11747 Linux MongoDB command shows the database name instead of the
collection name.

"Object" column in audit is empty for commands

AGNT-11748 Linux MongoDB adb.testData.storageSize(), db.testData.totalIndexSize()
and db.testData.totalSize().

Failed authentication using to disabled authentication

AGNT-13734 Linux MongoDB
mechanisms are not monitored.

Connections that are established just after the

AGNT-10127 Linux MSSQL
database starts might be audited as a 'connected user.'

AGNT-11757 Linux MSSQL No audit is available for IPC connections.

Agent Release Notes 46

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product)

MySQL upgrade fails with errors in collector log starting

with [ERROR]UnifiedLogsPeriodicThread.cpp:218 Cant
AGNT-11641 Linux MySQL open dir for scan. Workaround is available in the
customer knowledgebase at https://
docs.imperva.com/howto/6be1fc2c

On rare occasions while the server is highly loaded,

AGNT-13743 Linux MySQL and the agent restarts many times, the agent stops
monitoring traffic.

On rare occasions while the server is highly loaded,

AGNT-13929 Linux MySQL and the agent restarts many times, it is not possible to
stop the database MySQL.

When inline mode is configured, ASO shared mode

AGNT-10561 Linux Oracle
results in a connection delay.

SQL exception is not detected for non-existing table on

AGNT-10942 Linux Oracle
Diffie Hellman open mode connections.

Oracle Recovery Manager (RMAN) jobs might get stuck

AGNT-11324 Linux Oracle when agent is active and ASO Monitoring is enabled in
the agent.

On rare occasions, logout notification missing for tcp

AGNT-11654 Linux, Unix Oracle
connections of DB2.

When an Agent reconnects to the gateway, some of the

Linux,
AGNT-11851 All Databases traffic audit that was intercepted during the
Windows
disconnection time might be lost.

Agent Release Notes 47

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product)

Missing audit may be encountered when a query

OEL (non- command hasn't fetched all the data that the query
Cloudera Hive,
AGNT-11581 UEK), OEL- returned, e.g., when using Hue UI, the fetches are done
Hortonworks Hive
UEK, RHEL in chunks of 1000 rows and the next fetch is done when
the user scrolls down the UI.

Vendor Meltdown patches for RHELv7 and for RHELv6

AGNT-9964 RHEL All Databases operating systems cause the SecureSphere Agent to
fail during start.

When performing an operation in HDFS through REST

Cloudera HDFS,
AGNT-10655 RHEL API, the source IP in MX audit is always be the local IP
Hortonworks HDFS
of the server.

A few types of SQL exceptions are not reported in

AGNT-10006 RHEL Cloudera Impala
Impala.

Some failed login events on connecting with x.509

AGNT-13650 RHEL MongoDB certificate authentication might not be monitored on
MongoDB 4.4 and above.

When working with Diffie Hellman on Postgres on RHEL

AGNT-12787 RHEL PostgreSQL 8, audit for connections that were opened when the
agent was down won't be seen.

When running GTI on Solaris 10, the error message "ln:

AGNT-7856 Solaris All Databases
cannot create [...]: File exists" may appear.

If Oracle is configured to work in shared-server-mode,

AGNT-10042 Solaris Oracle
Diffie-Hellman connections will not be monitored.

Agent Release Notes 48

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product)

When upgrade from v13.0 to v13.1 or later, open mode

AGNT-10249 Solaris Oracle connections won't be audited. Workaround: Restart
the Database after the upgrade.

'Source of activity' field mistakenly displays 'remote'

AGNT-8958 Solaris Oracle
for local connection on Solaris global zone.

GTI doesn't collect ASO logs when "shared" folder is

AGNT-9378 Solaris Oracle
defined in non default location.

When 200 simultaneous ASO connections are open,

AGNT-9785 Solaris Oracle
some are not being monitored.

When the Oracle database is installed on a Solaris zone

which isn't Global and the Agent ASO is enabled, Agent
AGNT-9847 Solaris Oracle
may display error with message "Oracle ASO
monitoring failed".

In rare cases, due to startup scheduling, a complete

AGNT-10146 SUSE All Databases loss of audit data may occur. Workaround: restart the
agent.

Vendor Meltdown patches for SUSE Operating Systems

AGNT-9946 SUSE All Databases
cause the SecureSphere Agent to fail during startup.

When Oracle is configured to work in shared mode with

ASO encryption, connections might not be audited
AGNT-11850 SUSE Oracle after agent restart when the database server had been
started before the agent and there were no external
connections to the database when the agent went up.

Agent Release Notes 49

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product)

If kernel option 'kptr_restric' is set to '2', the Imperva

AGNT-11795 SUSE PostgreSQL kernel module will fail to load. Workaround - set
kptr_restric to 1.

When layer-C is enabled, there might be invalid audit

AGNT-11801 SUSE SAP-HANA
of the responses from the database.

When using SAP-HANA 12, moving from sniffing to

AGNT-8696 SUSE SAP-HANA inline mode and vise versa doesn't work with local TCP
connections.

In Teradata 16.1 and above the CPU consumption of

ragent process is higher than in older Teradata
AGNT-9471 SUSE Teradata versions. Work around: Client may disable TD-API
method using advanced config in order to work the
same as older Teradata versions.

On rare occasions, uninstalling the SecureSphere Agent

AGNT-9959 SUSE Teradata
might cause the Teradata database to freeze up.

If more than a single PDE is installed on the machine,

AGNT-11611 SUSE-Teradata Teradata GTI will fail. Workaround: Collect the required
information manually.

The Ubuntu 14.04 agent can't be installed or upgraded

AGNT-9947 Ubuntu All Databases
using Software Update.

When systemd in enabled, a permission issue is

encountered that requires restarting the database to
AGNT-12205 Ubuntu MariaDB, MySQL resolve. In Ubuntu, systemd is enabled by default.
Workaround: After starting the agent, restart the
database.

Agent Release Notes 50

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product)

First queries received with an Agent with open mode

AGNT-10165 Unix All Databases
connections are not audited.

When connecting to a machine before the agent is

working, the remote login isn't detected. Some
AGNT-9265 Unix All Databases applications (such as SecureCRT) reuse previous SSH
connections thereby preventing the remote login from
being detected.

Agent fails to start if the agent folder is located on XFS

AGNT-9456 Unix All Databases
with 64bit i-nodes.

Incomplete audit for TCP local traffic. Workaround: Add

the following item in the SecureSphere Agent's
AGNT-10266 Unix MySQL Advanced Configuration pane:
<kernel_support_local_traffic_in_server_side>0</
kernel_support_local_traffic_in_server_side>.

Open mode is not supported for encrypted and non-

encrypted Oracle connections during upgrade from
AGNT-8409 Unix Oracle Agent version less than v12 to Agent version v12 and
newer, when ASO monitoring is enabled prior to the
upgrade.

If monitoring Diffie-Helman traffic while ASO in the

agent is disabled, agent enters running with errors. If
AGNT-9389 Unix Oracle
disabling DH traffic on the database while ASO is still
disabled in the agent, running-with-errors persists.

When working with connections that utilize high ports

AGNT-8054 Unix Progress
with Progress DB, open mode is not supported.

Agent Release Notes 51

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product)

No IPv6 listener system event is generated if the

AGNT-11916 Windows All Databases
channel is added manually.

When upgrading from agent versions earlier than 11.0,

server might cause lower agent performance.
AGNT-6189 Windows All Databases
Workaround: Reboot the database server after
upgrade.

AGNT-6256 Windows All Databases On rare occasions, agent uninstall may fail.

Upgrading the Windows Agent to the same Agent

AGNT-7084 Windows All Databases
version will fail.

When executing first time installation of the

SecureSphere Agent or upgrading from v11.0 and
AGNT-7369 Windows All Databases earlier and working with EIK on Windows Server 2012
and newer, SecureSphere cannot monitor previously
established connections.

AGNT-7533 Windows All Databases On rare occasions, process details are missing.

When a MySQL, Oracle or DB2 database is accessed

using Windows authentication and Kerberos
AGNT-8680 Windows All Databases
authentication is used, the username will not be
audited.

On Windows Server 2012, if open connections exist

prior to installing the agent, running new short
AGNT-8764 Windows All Databases
connections could cause non-existent logouts to
appear in audit of open mode connections.

Agent Release Notes 52

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product)

Updating a channel (etc. disabling then re-enabling)

AGNT-8765 Windows All Databases
causes audit loss.

DrWeb antivirus mistakenly detects Imperva agent as a

AGNT-8915 Windows All Databases
Trojan.

When external traffic is monitored by pcap on windows

platforms, disabling and enabling network interface
AGNT-8920 Windows All Databases
while agent is running will cause complete audit loss.
Workaround: restart the Agent.

If the DB client connects to the DB server via 'shared

AGNT-8678 Windows DB2 All
memory,' the source IP address in audit is missing.

AGNT-8393 Windows MariaDB Maria DB IPC channel is not supported.

Certificate discovery might not work properly if two

AGNT-10137 Windows MSSQL different databases are running with the same user but
with different domains.

If Advanced Monitoring Mode is enabled, open-mode

AGNT-10575 Windows MSSQL connections are not monitored with some clients (such
as the Querier).

Channel over LocalTCP traffic is displayed on MX as

AGNT-11228 Windows MSSQL
MsSqlIPC.

The client remote session IP address might be missing

if the MSSQL server user has insufficient permissions to
AGNT-11241 Windows MSSQL
obtain it. This results in the inability to block the
connection by its source IP.

Agent Release Notes 53

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product)

After blocking in sniffing mode for local TCP

AGNT-6398 Windows MSSQL connections, it takes about a minute for the client to
close the local TCP session.

When changing the login user of MSSQL server, its

AGNT-7994 Windows MSSQL corresponding IPC channel log directory needs to be
manually deleted. Otherwise, there will be no audit.

In cases where there is more than one MSSQL database

AGNT-8087 Windows MSSQL on a server, all databases are running and RC4 user is
used for Kerberos, Hashed Users may appear in audit.

Agent fails to discover certificate after changing user

that runs the MSSQL service. Workaround: Restart the
AGNT-8923 Windows MSSQL
database to discover the new certificate. Relevant for
MSSQL 2016.

In advanced mode, if a user ignores IPC channel and

AGNT-8988 Windows MSSQL then un-ignores it, existing connections are not
monitored.

Open mode connections are not monitored on remote-

AGNT-9032 Windows MSSQL
named-pipe channel.

When a machine has more than one MsSql server

installed that are running under the same user name
AGNT-9874 Windows MSSQL but from different domains, the default MsSql
certificate might not be extracted for some of the
servers.

On Windows with Postgres monitoring in user space

AGNT-13217 Windows PostgreSQL
mode the OS User Chain might not be correct.

Agent Release Notes 54

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product)

On Windows with Postgres monitoring in user space

AGNT-13218 Windows PostgreSQL mode, on occasion the agent might fail to exclude TCP
local traffic based on the process details criteria.

On Windows with Postgres monitoring in user space

AGNT-13219 Windows PostgreSQL mode encrypted local connections, the connection
might not be blocked in sniffing mode.

On Windows with Postgres monitoring in user space

AGNT-13220 Windows PostgreSQL mode, a filtered connection might not stay filtered
after agent restart.

When sending a query from a client in one domain to

an MSSQL server in another domain with MSSQL
AGNT-8913 Windows 2012 All Databases
service running an AD user in the first domain, hashed
user is received.

Open Issues with Imperva Data Protection Agent - v14.6 Patch

110

Agent Database/
ID Agent OS Description
Product

On AIX, in order to audit correctly the remote user of

local connections, processes which handle remote
AGNT-10788 AIX All Databases
login (such as sshd and telnet) must be restarted after
the agent installation.

Agent Release Notes 55

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product

'User name' was not part of the process argument, and

AGNT-7542 AIX All Databases therefore could not be excluded as part of the
'argument' in the process details criteria.

When monitoring Informix SHM, audit data may be

AGNT-7249 AIX Informix
missing for large responses.

In AIX 7.1, in rare cases, when monitoring Informix SHM

AGNT-7513 AIX Informix large responses, part of the response is missing in the
audit.

Traffic might not be audited for local connections for

AGNT-9115 AIX Informix
Informix v10.

When Oracle DB is configured in 'shared mode' there is

AGNT-10796 AIX Oracle
no audit.

The Exclude operation doesn't work with agent and

AGNT-11278 AIX Oracle
gateway combined criteria with BEQ connections.

Watchdog/InjectionManager/crashes counter might

AGNT-11539 AIX Oracle
increase due to early wakeup of Injection manager.

In rare cases there is no audit in open mode ASO

AGNT-11973 AIX Oracle
connections.

AGNT-8223 AIX Oracle Audit loss of up to 0.3% of the traffic was encountered.

AGNT-8446 AIX Oracle Limitation: ASO is not supported on AIX WPAR.

Agent Release Notes 56

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product

Open mode ASO connections are not being monitored

AGNT-9353 AIX Oracle after Agent upgrade or after uninstalling and then
installing a different Agent version.

Only 126 ASO connections out of 200 that are opened

AGNT-9801 AIX Oracle
concurrently are monitored.

If ASO interception is disabled in the Agent, and there

AIX, Linux,
AGNT-10234 Oracle are ASO connections in the Database, alarm won't be
Solaris
generated until a new ASO connection starts.

If the RemoteAgent listener in the Imperva Gateway is

changed from non SSL to SSL, the Imperva Agents
AGNT-10194 All All Databases registered to this Gateway will no longer be able to
communicate with the gateway. Workaround: re-
register relevant Imperva Agents.

On rare occasions, when unregistering an Agent from

the gateway that was in 'full-trust' trust mode, and
AGNT-10206 All All Databases then registering it without trust enabled, the agent will
not be able to start. Workaround: uninstall and reinstall
the agent.

Combining two or more monitoring rules, with some of

AGNT-10228 All All Databases them Agent criteria and others gateway criteria does
not work properly.

The equals sign (=) is not supported for the password

of the Imperva user when registering agent to the
AGNT-10281 All All Databases
gateway using command line. Using the equals sign in
the password when registering from the CLI works.

Agent Release Notes 57

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product

The Imperva Agent cannot be installed in a root

AGNT-10908 All All Databases
directory (C:\ for example), but only in a subfolder.

After deleting the CloudFormation stack, there are files

AGNT-12976 All All Databases
leftover in the S3 bucket.

When moving an agent, make sure the target gateway

AGNT-13796 All All Databases
has the agent listener .

When moving an agent, the agent-cluster does not

AGNT-13802 All All Databases
move to the target gateway.

After gateway restart, wrong event capture time is

AGNT-7676 All All Databases
reported for logout operations.

In cases when the system parameter max_pid was

AGNT-8084 All All Databases modified after ragent was loaded, some audit will be
lost.

During agent move, Agent status might temporarily

AGNT-8151 All All Databases change to Running With Errors 'Data connection to
gateway has been lost'.

Agent and gateway cannot communicate when the

AGNT-8268 All All Databases gateway is configured as Reverse Proxy and to accept
only ECDH ciphers.

During an automatic agent move, the agent's status

AGNT-8395 All All Databases
might temporarily change to "Bad Connectivity."

Agent Release Notes 58

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product

When the agent is disconnected from the Gateway,

AGNT-8487 All All Databases
audit loss may occur.

In cases where the server had no free disk space, after

freeing some space the RACLI interface may show
AGNT-8558 All All Databases
errors. Agent stop/start via the Agent CLI may resolve
the issue.

On rare occasions, the Remote Agent process crashes

AGNT-8559 All All Databases
during shutdown.

After re-registering the agent to a different MX, the

AGNT-8790 All All Databases
hostname might not be correctly reflected in the MX.

When installing the SecureSphere Agent Installation

AGNT-8981 All All Databases Manager only, users cannot change the path of the
download directory in the MX GUI.

Advanced configuration of "kernel-max-pid" and of

"kernel-max-pid-limit" will not affect the agent if their
AGNT-9034 All All Databases
value is higher than maximum number of process
defined in the operating system.

Agent crashes when enabling "send-ack" configuration

AGNT-9151 All All Databases from additional-configuration. Workaround: disable
configuration.

In rare cases the agent may fail to get a valid certificate

AGNT-9362 All All Databases
when starting trust migration.

Agent Release Notes 59

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product

Remote Agent CTRL process uses high CPU when setup

AGNT-9850 All All Databases
has trust and gateway cluster.

In rare scenarios, agent log files can take more disk

AGNT-9882 All All Databases
space than defined.

Using the Dbeaver client, when setting inline sniffing

and the followed action after blocking is IP/User block
the Dbeaver may accept few more queries until
AGNT-11524 All All RDBMS Databases blocking is applied. This could happen when the
Dbeaver opens more than 1 connection to the Server
and each open connection will accept one query
before being blocked.

AGNT-11565 All DB2 All Import/export were not audited in DB2.

When monitoring DB2 Shared memory connections,

AGNT-7232 All DB2 All
the response size in audit appears as 0.

When configuring Traffic Monitoring Rule with Process

AGNT-7272 All Informix details - Agent criteria, and using the arguments
parameter, the character @ is not supported.

"An active shared server has been detected" alert could

AGNT-10844 All Oracle appear even though Oracle is not in shared server
mode.

AGNT-11507 All PostgreSQL Import/export were not audited in PostgreSql.

Agent Release Notes 60

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product

SecureSphere doesn't audit activity that takes place in

AGNT-9919 All Progress shared memory, for example activity of the Progress
Openedge utility.

On rare occasions, when there are issues with the rpm

AGNT-10315 Linux All Databases database, the agent can cause performance
degradation.

Large responses are sometime not audited if the

AGNT-11244 Linux All Databases
database is monitored in the user-space.

RHEL6 K0 (kernel patches lower than p5): the

AGNT-7660 Linux All Databases SecureSphere Agent cannot coexist with the Vormetric
Agents.

Changing the ragent installation directory while

AGNT-10072 Linux All RDBMS Databases upgrading ragent version may cause audit loss until
next database restart.

If Data Interface discovery is disabled, there is no audit

AGNT-10128 Linux All RDBMS Databases
for MsSQL on Linux and Teradata version 16.1 and up.

User space monitoring will not work when the agent

AGNT-10195 Linux All RDBMS Databases
installation directory is larger than 75 characters.

Audit loss may be experienced with connections that

AGNT-10705 Linux All RDBMS Databases are opened shortly (seconds) after database restart
when user-space interception is active.

AGNT-12838 Linux Cloudera Impala Impala failed login is not captured in MX.

Agent Release Notes 61

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product

The DataBase field in MX audit data might be incorrect

AGNT-12054 Linux DataStax Cassandra when running commands without explicitly specifying
the relevant keyspace.

Create Function statements might not be displayed in

AGNT-12102 Linux DataStax Cassandra
MX audit.

The DataBase field in MX audit data might be incorrect

AGNT-13783 Linux DataStax Cassandra when running commands without explicitly specifying
the relevant keyspace.

The DataBase field in MX audit data might be incorrect

AGNT-13787 Linux DataStax Cassandra when running commands without explicitly specifying
the relevant keyspace.

After agent restart, audit of few transactions might be

AGNT-11743 Linux DB2 for LUW
lost.

"Object" column in audit for "db.collection.copyTo()"

AGNT-11747 Linux MongoDB command shows the database name instead of the
collection name.

"Object" column in audit is empty for commands

AGNT-11748 Linux MongoDB adb.testData.storageSize(), db.testData.totalIndexSize()
and db.testData.totalSize().

Failed authentication using to disabled authentication

AGNT-13734 Linux MongoDB
mechanisms are not monitored.

Connections that are established just after the

AGNT-10127 Linux MSSQL
database starts might be audited as a 'connected user.'

Agent Release Notes 62

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product

AGNT-11757 Linux MSSQL No audit is available for IPC connections.

MySQL upgrade fails with errors in collector log starting

with [ERROR]UnifiedLogsPeriodicThread.cpp:218 Cant
AGNT-11641 Linux MySQL open dir for scan. Workaround is available in the
customer knowledgebase at https://
docs.imperva.com/howto/6be1fc2c

On rare occasions while the server is highly loaded,

AGNT-13743 Linux MySQL and the agent restarts many times, the agent stops
monitoring traffic.

On rare occasions while the server is highly loaded,

AGNT-13929 Linux MySQL and the agent restarts many times, it is not possible to
stop the database MySQL.

When inline mode is configured, ASO shared mode

AGNT-10561 Linux Oracle
results in a connection delay.

SQL exception is not detected for non-existing table on

AGNT-10942 Linux Oracle
Diffie Hellman open mode connections.

Oracle Recovery Manager (RMAN) jobs might get stuck

AGNT-11324 Linux Oracle when agent is active and ASO Monitoring is enabled in
the agent.

On rare occasions, logout notification missing for tcp

AGNT-11654 Linux, Unix Oracle
connections of DB2.

Agent Release Notes 63

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product

When an Agent reconnects to the gateway, some of the

AGNT-11851 Linux, Windows All Databases traffic audit that was intercepted during the
disconnection time might be lost.

Missing audit may be encountered when a query

command hasn't fetched all the data that the query
OEL (non-UEK), Cloudera Hive,
AGNT-11581 returned, e.g., when using Hue UI, the fetches are done
OEL-UEK, RHEL Hortonworks Hive
in chunks of 1000 rows and the next fetch is done when
the user scrolls down the UI.

Vendor Meltdown patches for RHELv7 and for RHELv6

AGNT-9964 RHEL All Databases operating systems cause the SecureSphere Agent to
fail during start.

When performing an operation in HDFS through REST

Cloudera HDFS,
AGNT-10655 RHEL API, the source IP in MX audit is always be the local IP
Hortonworks HDFS
of the server.

A few types of SQL exceptions are not reported in

AGNT-10006 RHEL Cloudera Impala
Impala.

Some failed login events on connecting with x.509

AGNT-13650 RHEL MongoDB certificate authentication might not be monitored on
MongoDB 4.4 and above.

When working with Diffie Hellman on Postgres on RHEL

AGNT-12787 RHEL PostgreSQL 8, audit for connections that were opened when the
agent was down won't be seen.

When running GTI on Solaris 10, the error message "ln:

AGNT-7856 Solaris All Databases
cannot create [...]: File exists" may appear.

Agent Release Notes 64

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product

If Oracle is configured to work in shared-server-mode,

AGNT-10042 Solaris Oracle
Diffie-Hellman connections will not be monitored.

When upgrade from v13.0 to v13.1 or later, open mode

AGNT-10249 Solaris Oracle connections won't be audited. Workaround: Restart
the Database after the upgrade.

'Source of activity' field mistakenly displays 'remote'

AGNT-8958 Solaris Oracle
for local connection on Solaris global zone.

GTI doesn't collect ASO logs when "shared" folder is

AGNT-9378 Solaris Oracle
defined in non default location.

When 200 simultaneous ASO connections are open,

AGNT-9785 Solaris Oracle
some are not being monitored.

When the Oracle database is installed on a Solaris zone

which isn't Global and the Agent ASO is enabled, Agent
AGNT-9847 Solaris Oracle
may display error with message "Oracle ASO
monitoring failed".

In rare cases, due to startup scheduling, a complete

AGNT-10146 SUSE All Databases loss of audit data may occur. Workaround: restart the
agent.

Vendor Meltdown patches for SUSE Operating Systems

AGNT-9946 SUSE All Databases
cause the SecureSphere Agent to fail during startup.

When Oracle is configured to work in shared mode with

AGNT-11850 SUSE Oracle
ASO encryption, connections might not be audited
after agent restart when the database server had been

Agent Release Notes 65

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product

started before the agent and there were no external

connections to the database when the agent went up.

If kernel option 'kptr_restric' is set to '2', the Imperva

AGNT-11795 SUSE PostgreSQL kernel module will fail to load. Workaround - set
kptr_restric to 1.

When layer-C is enabled, there might be invalid audit

AGNT-11801 SUSE SAP-HANA
of the responses from the database.

When using SAP-HANA 12, moving from sniffing to

AGNT-8696 SUSE SAP-HANA inline mode and vise versa doesn't work with local TCP
connections.

In Teradata 16.1 and above the CPU consumption of

ragent process is higher than in older Teradata
AGNT-9471 SUSE Teradata versions. Work around: Client may disable TD-API
method using advanced config in order to work the
same as older Teradata versions.

On rare occasions, uninstalling the SecureSphere Agent

AGNT-9959 SUSE Teradata
might cause the Teradata database to freeze up.

If more than a single PDE is installed on the machine,

AGNT-11611 SUSE-Teradata Teradata GTI will fail. Workaround: Collect the required
information manually.

The Ubuntu 14.04 agent can't be installed or upgraded

AGNT-9947 Ubuntu All Databases
using Software Update.

When systemd in enabled, a permission issue is

AGNT-12205 Ubuntu MariaDB, MySQL
encountered that requires restarting the database to
resolve. In Ubuntu, systemd is enabled by default.

Agent Release Notes 66

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product

Workaround: After starting the agent, restart the

database.

First queries received with an Agent with open mode

AGNT-10165 Unix All Databases
connections are not audited.

When connecting to a machine before the agent is

working, the remote login isn't detected. Some
AGNT-9265 Unix All Databases applications (such as SecureCRT) reuse previous SSH
connections thereby preventing the remote login from
being detected.

Agent fails to start if the agent folder is located on XFS

AGNT-9456 Unix All Databases
with 64bit i-nodes.

Incomplete audit for TCP local traffic. Workaround: Add

the following item in the SecureSphere Agent's
AGNT-10266 Unix MySQL Advanced Configuration pane:
<kernel_support_local_traffic_in_server_side>0</
kernel_support_local_traffic_in_server_side>.

Open mode is not supported for encrypted and non-

encrypted Oracle connections during upgrade from
AGNT-8409 Unix Oracle Agent version less than v12 to Agent version v12 and
newer, when ASO monitoring is enabled prior to the
upgrade.

If monitoring Diffie-Helman traffic while ASO in the

agent is disabled, agent enters running with errors. If
AGNT-9389 Unix Oracle
disabling DH traffic on the database while ASO is still
disabled in the agent, running-with-errors persists.

Agent Release Notes 67

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product

When working with connections that utilize high ports

AGNT-8054 Unix Progress
with Progress DB, open mode is not supported.

No IPv6 listener system event is generated if the

AGNT-11916 Windows All Databases
channel is added manually.

When upgrading from agent versions earlier than 11.0,

server might cause lower agent performance.
AGNT-6189 Windows All Databases
Workaround: Reboot the database server after
upgrade.

AGNT-6256 Windows All Databases On rare occasions, agent uninstall may fail.

Upgrading the Windows Agent to the same Agent

AGNT-7084 Windows All Databases
version will fail.

When executing first time installation of the

SecureSphere Agent or upgrading from v11.0 and
AGNT-7369 Windows All Databases earlier and working with EIK on Windows Server 2012
and newer, SecureSphere cannot monitor previously
established connections.

AGNT-7533 Windows All Databases On rare occasions, process details are missing.

When a MySQL, Oracle or DB2 database is accessed

using Windows authentication and Kerberos
AGNT-8680 Windows All Databases
authentication is used, the username will not be
audited.

AGNT-8764 Windows All Databases On Windows Server 2012, if open connections exist
prior to installing the agent, running new short

Agent Release Notes 68

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product

connections could cause non-existent logouts to

appear in audit of open mode connections.

Updating a channel (etc. disabling then re-enabling)

AGNT-8765 Windows All Databases
causes audit loss.

DrWeb antivirus mistakenly detects Imperva agent as a

AGNT-8915 Windows All Databases
Trojan.

When external traffic is monitored by pcap on windows

platforms, disabling and enabling network interface
AGNT-8920 Windows All Databases
while agent is running will cause complete audit loss.
Workaround: restart the Agent.

If the DB client connects to the DB server via 'shared

AGNT-8678 Windows DB2 All
memory,' the source IP address in audit is missing.

AGNT-8393 Windows MariaDB Maria DB IPC channel is not supported.

Certificate discovery might not work properly if two

AGNT-10137 Windows MSSQL different databases are running with the same user but
with different domains.

If Advanced Monitoring Mode is enabled, open-mode

AGNT-10575 Windows MSSQL connections are not monitored with some clients (such
as the Querier).

Channel over LocalTCP traffic is displayed on MX as

AGNT-11228 Windows MSSQL
MsSqlIPC.

Agent Release Notes 69

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product

The client remote session IP address might be missing

if the MSSQL server user has insufficient permissions to
AGNT-11241 Windows MSSQL
obtain it. This results in the inability to block the
connection by its source IP.

After blocking in sniffing mode for local TCP

AGNT-6398 Windows MSSQL connections, it takes about a minute for the client to
close the local TCP session.

When changing the login user of MSSQL server, its

AGNT-7994 Windows MSSQL corresponding IPC channel log directory needs to be
manually deleted. Otherwise, there will be no audit.

In cases where there is more than one MSSQL database

AGNT-8087 Windows MSSQL on a server, all databases are running and RC4 user is
used for Kerberos, Hashed Users may appear in audit.

Agent fails to discover certificate after changing user

that runs the MSSQL service. Workaround: Restart the
AGNT-8923 Windows MSSQL
database to discover the new certificate. Relevant for
MSSQL 2016.

In advanced mode, if a user ignores IPC channel and

AGNT-8988 Windows MSSQL then un-ignores it, existing connections are not
monitored.

Open mode connections are not monitored on remote-

AGNT-9032 Windows MSSQL
named-pipe channel.

When a machine has more than one MsSql server

AGNT-9874 Windows MSSQL
installed that are running under the same user name
but from different domains, the default MsSql

Agent Release Notes 70

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product

certificate might not be extracted for some of the

servers.

On Windows with Postgres monitoring in user space

AGNT-13217 Windows PostgreSQL
mode the OS User Chain might not be correct.

On Windows with Postgres monitoring in user space

AGNT-13218 Windows PostgreSQL mode, on occasion the agent might fail to exclude TCP
local traffic based on the process details criteria.

On Windows with Postgres monitoring in user space

AGNT-13219 Windows PostgreSQL mode encrypted local connections, the connection
might not be blocked in sniffing mode.

On Windows with Postgres monitoring in user space

AGNT-13220 Windows PostgreSQL mode, a filtered connection might not stay filtered
after agent restart.

When sending a query from a client in one domain to

an MSSQL server in another domain with MSSQL
AGNT-8913 Windows 2012 All Databases
service running an AD user in the first domain, hashed
user is received.

Open Issues with Imperva Data Protection Agent - v14.6 Patch

100

Agent Release Notes 71

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product

On AIX, in order to audit correctly the remote user of

local connections, processes which handle remote login
AGNT-10788 AIX All Databases
(such as sshd and telnet) must be restarted after the
agent installation.

'User name' was not part of the process argument, and

AGNT-7542 AIX All Databases therefore could not be excluded as part of the
'argument' in the process details criteria.

When monitoring Informix SHM, audit data may be

AGNT-7249 AIX Informix
missing for large responses.

In AIX 7.1, in rare cases, when monitoring Informix SHM

AGNT-7513 AIX Informix large responses, part of the response is missing in the
audit.

Traffic might not be audited for local connections for

AGNT-9115 AIX Informix
Informix v10.

When Oracle DB is configured in 'shared mode' there is

AGNT-10796 AIX Oracle
no audit.

The Exclude operation doesn't work with agent and

AGNT-11278 AIX Oracle
gateway combined criteria with BEQ connections.

Watchdog/InjectionManager/crashes counter might

AGNT-11539 AIX Oracle
increase due to early wakeup of Injection manager.

In rare cases there is no audit in open mode ASO

AGNT-11973 AIX Oracle
connections.

Agent Release Notes 72

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product

AGNT-8223 AIX Oracle Audit loss of up to 0.3% of the traffic was encountered.

AGNT-8446 AIX Oracle Limitation: ASO is not supported on AIX WPAR.

Open mode ASO connections are not being monitored

AGNT-9353 AIX Oracle after Agent upgrade or after uninstalling and then
installing a different Agent version.

Only 126 ASO connections out of 200 that are opened

AGNT-9801 AIX Oracle
concurrently are monitored.

If ASO interception is disabled in the Agent, and there

AIX, Linux,
AGNT-10234 Oracle are ASO connections in the Database, alarm won't be
Solaris
generated until a new ASO connection starts.

If the RemoteAgent listener in the Imperva Gateway is

changed from non SSL to SSL, the Imperva Agents
AGNT-10194 All All Databases registered to this Gateway will no longer be able to
communicate with the gateway. Workaround: re-
register relevant Imperva Agents.

On rare occasions, when unregistering an Agent from

the gateway that was in 'full-trust' trust mode, and then
AGNT-10206 All All Databases registering it without trust enabled, the agent will not be
able to start. Workaround: uninstall and reinstall the
agent.

Combining two or more monitoring rules, with some of

AGNT-10228 All All Databases them Agent criteria and others gateway criteria does not
work properly.

Agent Release Notes 73

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product

The equals sign (=) is not supported for the password of

the Imperva user when registering agent to the gateway
AGNT-10281 All All Databases
using command line. Using the equals sign in the
password when registering from the CLI works.

The Imperva Agent cannot be installed in a root

AGNT-10908 All All Databases
directory (C:\ for example), but only in a subfolder.

After deleting the CloudFormation stack, there are files

AGNT-12976 All All Databases
leftover in the S3 bucket.

After gateway restart, wrong event capture time is

AGNT-7676 All All Databases
reported for logout operations.

In cases when the system parameter max_pid was

AGNT-8084 All All Databases modified after ragent was loaded, some audit will be
lost.

During agent move, Agent status might temporarily

AGNT-8151 All All Databases change to Running With Errors 'Data connection to
gateway has been lost'.

Agent and gateway cannot communicate when the

AGNT-8268 All All Databases gateway is configured as Reverse Proxy and to accept
only ECDH ciphers.

During an automatic agent move, the agent's status

AGNT-8395 All All Databases
might temporarily change to "Bad Connectivity."

When the agent is disconnected from the Gateway,

AGNT-8487 All All Databases
audit loss may occur.

Agent Release Notes 74

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product

In cases where the server had no free disk space, after

freeing some space the RACLI interface may show
AGNT-8558 All All Databases
errors. Agent stop/start via the Agent CLI may resolve
the issue.

On rare occasions, the Remote Agent process crashes

AGNT-8559 All All Databases
during shutdown.

After re-registering the agent to a different MX, the

AGNT-8790 All All Databases
hostname might not be correctly reflected in the MX.

When installing the SecureSphere Agent Installation

AGNT-8981 All All Databases Manager only, users cannot change the path of the
download directory in the MX GUI.

Advanced configuration of "kernel-max-pid" and of

"kernel-max-pid-limit" will not affect the agent if their
AGNT-9034 All All Databases
value is higher than maximum number of process
defined in the operating system.

Agent crashes when enabling "send-ack" configuration

AGNT-9151 All All Databases from additional-configuration. Workaround: disable
configuration.

In rare cases the agent may fail to get a valid certificate

AGNT-9362 All All Databases
when starting trust migration.

Remote Agent CTRL process uses high CPU when setup

AGNT-9850 All All Databases
has trust and gateway cluster.

Agent Release Notes 75

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product

In rare scenarios, agent log files can take more disk

AGNT-9882 All All Databases
space than defined.

When moving an agent, make sure the target gateway

AGNT-13796 All All Databases
has the agent listener.

When moving an agent, the agent-cluster does not move

AGNT-13802 All All Databases
to the target gateway.

Using the Dbeaver client, when setting inline sniffing

and the followed action after blocking is IP/User block
the Dbeaver may accept few more queries until blocking
AGNT-11524 All All RDBMS Databases
is applied. This could happen when the Dbeaver opens
more than 1 connection to the Server and each open
connection will accept one query before being blocked.

AGNT-11565 All DB2 All Import/export were not audited in DB2.

When monitoring DB2 Shared memory connections, the

AGNT-7232 All DB2 All
response size in audit appears as 0.

When configuring Traffic Monitoring Rule with Process

AGNT-7272 All Informix details - Agent criteria, and using the arguments
parameter, the character @ is not supported.

"An active shared server has been detected" alert could

AGNT-10844 All Oracle appear even though Oracle is not in shared server
mode.

AGNT-11507 All PostgreSQL Import/export were not audited in PostgreSql.

Agent Release Notes 76

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product

SecureSphere doesn't audit activity that takes place in

AGNT-9919 All Progress shared memory, for example activity of the Progress
Openedge utility.

On rare occasions, when there are issues with the rpm

AGNT-10315 Linux All Databases database, the agent can cause performance
degradation.

Large responses are sometime not audited if the

AGNT-11244 Linux All Databases
database is monitored in the user-space.

RHEL6 K0 (kernel patches lower than p5): the

AGNT-7660 Linux All Databases SecureSphere Agent cannot coexist with the Vormetric
Agents.

Changing the ragent installation directory while

AGNT-10072 Linux All RDBMS Databases upgrading ragent version may cause audit loss until next
database restart.

If Data Interface discovery is disabled, there is no audit

AGNT-10128 Linux All RDBMS Databases
for MsSQL on Linux and Teradata version 16.1 and up.

User space monitoring will not work when the agent

AGNT-10195 Linux All RDBMS Databases
installation directory is larger than 75 characters.

Audit loss may be experienced with connections that

AGNT-10705 Linux All RDBMS Databases are opened shortly (seconds) after database restart
when user-space interception is active.

AGNT-12838 Linux Cloudera Impala Impala failed login is not captured in MX.

Agent Release Notes 77

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product

The DataBase field in MX audit data might be incorrect

AGNT-12054 Linux DataStax Cassandra when running commands without explicitly specifying
the relevant keyspace.

Create Function statements might not be displayed in

AGNT-12102 Linux DataStax Cassandra
MX audit.

The DataBase field in MX audit data might be incorrect

AGNT-13783 Linux DataStax Cassandra when running commands without explicitly specifying
the relevant keyspace.

The DataBase field in MX audit data might be incorrect

AGNT-13787 Linux DataStax Cassandra when running commands without explicitly specifying
the relevant keyspace.

After agent restart, audit of few transactions might be

AGNT-11743 Linux DB2 for LUW
lost.

"Object" column in audit for "db.collection.copyTo()"

AGNT-11747 Linux MongoDB command shows the database name instead of the
collection name.

"Object" column in audit is empty for commands

AGNT-11748 Linux MongoDB adb.testData.storageSize(), db.testData.totalIndexSize()
and db.testData.totalSize().

Failed authentication using to disabled authentication

AGNT-13734 Linux MongoDB
mechanisms are not monitored.

Connections that are established just after the database

AGNT-10127 Linux MSSQL
starts might be audited as a 'connected user.'

Agent Release Notes 78

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product

AGNT-11757 Linux MSSQL No audit is available for IPC connections.

MySQL upgrade fails with errors in collector log starting

with [ERROR]UnifiedLogsPeriodicThread.cpp:218 Cant
AGNT-11641 Linux MySQL open dir for scan. Workaround is available in the
customer knowledgebase at https://docs.imperva.com/
howto/6be1fc2c

On rare occasions while the server is highly loaded, and

AGNT-13743 Linux MySQL the agent restarts many times, the agent stops
monitoring traffic.

On rare occasions while the server is highly loaded, and

AGNT-13929 Linux MySQL the agent restarts many times, it is not possible to stop
the database MySQL.

When inline mode is configured, ASO shared mode

AGNT-10561 Linux Oracle
results in a connection delay.

SQL exception is not detected for non-existing table on

AGNT-10942 Linux Oracle
Diffie Hellman open mode connections.

Oracle Recovery Manager (RMAN) jobs might get stuck

AGNT-11324 Linux Oracle when agent is active and ASO Monitoring is enabled in
the agent.

On rare occasions, logout notification missing for tcp

AGNT-11654 Linux, Unix Oracle
connections of DB2.

Agent Release Notes 79

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product

When an Agent reconnects to the gateway, some of the

AGNT-11851 Linux, Windows All Databases traffic audit that was intercepted during the
disconnection time might be lost.

Missing audit may be encountered when a query

command hasn't fetched all the data that the query
OEL (non-UEK), Cloudera Hive,
AGNT-11581 returned, e.g., when using Hue UI, the fetches are done
OEL-UEK, RHEL Hortonworks Hive
in chunks of 1000 rows and the next fetch is done when
the user scrolls down the UI.

Vendor Meltdown patches for RHELv7 and for RHELv6

AGNT-9964 RHEL All Databases operating systems cause the SecureSphere Agent to fail
during start.

When performing an operation in HDFS through REST

Cloudera HDFS,
AGNT-10655 RHEL API, the source IP in MX audit is always be the local IP of
Hortonworks HDFS
the server.

A few types of SQL exceptions are not reported in

AGNT-10006 RHEL Cloudera Impala
Impala.

Some failed login events on connecting with x.509

AGNT-13650 RHEL MongoDB certificate authentication might not be monitored on
MongoDB 4.4 and above.

When working with Diffie Hellman on Postgres on RHEL

AGNT-12787 RHEL PostgreSQL 8, audit for connections that were opened when the
agent was down won't be seen.

When running GTI on Solaris 10, the error message "ln:

AGNT-7856 Solaris All Databases
cannot create [...]: File exists" may appear.

Agent Release Notes 80

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product

If Oracle is configured to work in shared-server-mode,

AGNT-10042 Solaris Oracle
Diffie-Hellman connections will not be monitored.

When upgrade from v13.0 to v13.1 or later, open mode

AGNT-10249 Solaris Oracle connections won't be audited. Workaround: Restart the
Database after the upgrade.

'Source of activity' field mistakenly displays 'remote' for

AGNT-8958 Solaris Oracle
local connection on Solaris global zone.

GTI doesn't collect ASO logs when "shared" folder is

AGNT-9378 Solaris Oracle
defined in non default location.

When 200 simultaneous ASO connections are open,

AGNT-9785 Solaris Oracle
some are not being monitored.

When the Oracle database is installed on a Solaris zone

which isn't Global and the Agent ASO is enabled, Agent
AGNT-9847 Solaris Oracle
may display error with message "Oracle ASO monitoring
failed".

In rare cases, due to startup scheduling, a complete loss

AGNT-10146 SUSE All Databases
of audit data may occur. Workaround: restart the agent.

Vendor Meltdown patches for SUSE Operating Systems

AGNT-9946 SUSE All Databases
cause the SecureSphere Agent to fail during startup.

When Oracle is configured to work in shared mode with

AGNT-11850 SUSE Oracle
ASO encryption, connections might not be audited after
agent restart when the database server had been

Agent Release Notes 81

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product

started before the agent and there were no external

connections to the database when the agent went up.

If kernel option 'kptr_restric' is set to '2', the Imperva

AGNT-11795 SUSE PostgreSQL kernel module will fail to load. Workaround - set
kptr_restric to 1.

When layer-C is enabled, there might be invalid audit of

AGNT-11801 SUSE SAP-HANA
the responses from the database.

When using SAP-HANA 12, moving from sniffing to inline

AGNT-8696 SUSE SAP-HANA mode and vise versa doesn't work with local TCP
connections.

In Teradata 16.1 and above the CPU consumption of

ragent process is higher than in older Teradata versions.
AGNT-9471 SUSE Teradata Work around: Client may disable TD-API method using
advanced config in order to work the same as older
Teradata versions.

On rare occasions, uninstalling the SecureSphere Agent

AGNT-9959 SUSE Teradata
might cause the Teradata database to freeze up.

If more than a single PDE is installed on the machine,

AGNT-11611 SUSE-Teradata Teradata GTI will fail. Workaround: Collect the required
information manually.

The Ubuntu 14.04 agent can't be installed or upgraded

AGNT-9947 Ubuntu All Databases
using Software Update.

When systemd in enabled, a permission issue is

AGNT-12205 Ubuntu MariaDB, MySQL
encountered that requires restarting the database to
resolve. In Ubuntu, systemd is enabled by default.

Agent Release Notes 82

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product

Workaround: After starting the agent, restart the

database.

First queries received with an Agent with open mode

AGNT-10165 Unix All Databases
connections are not audited.

When connecting to a machine before the agent is

working, the remote login isn't detected. Some
AGNT-9265 Unix All Databases applications (such as SecureCRT) reuse previous SSH
connections thereby preventing the remote login from
being detected.

Agent fails to start if the agent folder is located on XFS

AGNT-9456 Unix All Databases
with 64bit i-nodes.

Incomplete audit for TCP local traffic. Workaround: Add

the following item in the SecureSphere Agent's
AGNT-10266 Unix MySQL Advanced Configuration pane:
<kernel_support_local_traffic_in_server_side>0</
kernel_support_local_traffic_in_server_side>.

Open mode is not supported for encrypted and non-

encrypted Oracle connections during upgrade from
AGNT-8409 Unix Oracle Agent version less than v12 to Agent version v12 and
newer, when ASO monitoring is enabled prior to the
upgrade.

If monitoring Diffie-Helman traffic while ASO in the

agent is disabled, agent enters running with errors. If
AGNT-9389 Unix Oracle
disabling DH traffic on the database while ASO is still
disabled in the agent, running-with-errors persists.

Agent Release Notes 83

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product

When working with connections that utilize high ports

AGNT-8054 Unix Progress
with Progress DB, open mode is not supported.

No IPv6 listener system event is generated if the channel

AGNT-11916 Windows All Databases
is added manually.

When upgrading from agent versions earlier than 11.0,

AGNT-6189 Windows All Databases server might cause lower agent performance.
Workaround: Reboot the database server after upgrade.

AGNT-6256 Windows All Databases On rare occasions, agent uninstall may fail.

Upgrading the Windows Agent to the same Agent

AGNT-7084 Windows All Databases
version will fail.

When executing first time installation of the

SecureSphere Agent or upgrading from v11.0 and earlier
AGNT-7369 Windows All Databases and working with EIK on Windows Server 2012 and
newer, SecureSphere cannot monitor previously
established connections.

AGNT-7533 Windows All Databases On rare occasions, process details are missing.

When a MySQL, Oracle or DB2 database is accessed

using Windows authentication and Kerberos
AGNT-8680 Windows All Databases
authentication is used, the username will not be
audited.

AGNT-8764 Windows All Databases On Windows Server 2012, if open connections exist prior
to installing the agent, running new short connections

Agent Release Notes 84

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product

could cause non-existent logouts to appear in audit of

open mode connections.

Updating a channel (etc. disabling then re-enabling)

AGNT-8765 Windows All Databases
causes audit loss.

DrWeb antivirus mistakenly detects Imperva agent as a

AGNT-8915 Windows All Databases
Trojan.

When external traffic is monitored by pcap on windows

platforms, disabling and enabling network interface
AGNT-8920 Windows All Databases
while agent is running will cause complete audit loss.
Workaround: restart the Agent.

If the DB client connects to the DB server via 'shared

AGNT-8678 Windows DB2 All
memory,' the source IP address in audit is missing.

AGNT-8393 Windows MariaDB Maria DB IPC channel is not supported.

Certificate discovery might not work properly if two

AGNT-10137 Windows MSSQL different databases are running with the same user but
with different domains.

If Advanced Monitoring Mode is enabled, open-mode

AGNT-10575 Windows MSSQL connections are not monitored with some clients (such
as the Querier).

Channel over LocalTCP traffic is displayed on MX as

AGNT-11228 Windows MSSQL
MsSqlIPC.

Agent Release Notes 85

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product

The client remote session IP address might be missing if

the MSSQL server user has insufficient permissions to
AGNT-11241 Windows MSSQL
obtain it. This results in the inability to block the
connection by its source IP.

After blocking in sniffing mode for local TCP

AGNT-6398 Windows MSSQL connections, it takes about a minute for the client to
close the local TCP session.

When changing the login user of MSSQL server, its

AGNT-7994 Windows MSSQL corresponding IPC channel log directory needs to be
manually deleted. Otherwise, there will be no audit.

In cases where there is more than one MSSQL database

AGNT-8087 Windows MSSQL on a server, all databases are running and RC4 user is
used for Kerberos, Hashed Users may appear in audit.

Agent fails to discover certificate after changing user

that runs the MSSQL service. Workaround: Restart the
AGNT-8923 Windows MSSQL
database to discover the new certificate. Relevant for
MSSQL 2016.

In advanced mode, if a user ignores IPC channel and

AGNT-8988 Windows MSSQL then un-ignores it, existing connections are not
monitored.

Open mode connections are not monitored on remote-

AGNT-9032 Windows MSSQL
named-pipe channel.

AGNT-9874 Windows MSSQL When a machine has more than one MsSql server
installed that are running under the same user name

Agent Release Notes 86

 Agent Release Notes

Agent Database/
ID Agent OS Description
Product

but from different domains, the default MsSql certificate

might not be extracted for some of the servers.

On Windows with Postgres monitoring in user space

AGNT-13217 Windows PostgreSQL
mode the OS User Chain might not be correct.

On Windows with Postgres monitoring in user space

AGNT-13218 Windows PostgreSQL mode, on occasion the agent might fail to exclude TCP
local traffic based on the process details criteria.

On Windows with Postgres monitoring in user space

AGNT-13219 Windows PostgreSQL mode encrypted local connections, the connection
might not be blocked in sniffing mode.

On Windows with Postgres monitoring in user space

AGNT-13220 Windows PostgreSQL mode, a filtered connection might not stay filtered after
agent restart.

When sending a query from a client in one domain to an

MSSQL server in another domain with MSSQL service
AGNT-8913 Windows 2012 All Databases
running an AD user in the first domain, hashed user is
received.

Agent Release Notes 87

 Agent Release Notes

Agent Patch Bug Fixes

This section includes information regarding bugs that were resolved in the following patches. Note that a bug fixed in
any patch is considered fixed in later patches, unless it appears in the Open Issues section of a later patch.

• Fixed Issues with Imperva Data Protection Agent - v14.6 Patch 130
• Fixed Issues with Imperva Data Protection Agent - v14.6 Patch 120
• Fixed Issues with Imperva Data Protection Agent - v14.6 Patch 110
• Fixed Issues with Imperva Data Protection Agent - v14.6 Patch 100
• Fixed Issues with Imperva Data Protection Agent - v14.6 Patch 90
• Fixed Issues with Imperva Data Protection Agent - v14.6 Patch 80
• Fixed Issues with Imperva Data Protection Agent - v14.6 Patch 70
• Fixed Issues with Imperva Data Protection Agent - v14.6 Patch 60
• Fixed Issues with Imperva Data Protection Agent - v14.6 Patch 50
• Fixed Issues with Imperva Data Protection Agent - v14.6 Patch 40
• Fixed Issues with Imperva Data Protection Agent - v14.6 Patch 30
• Fixed Issues with Imperva Data Protection Agent - v14.6 Patch 20
• Fixed Issues with Imperva Data Protection Agent - v14.6 Patch 10

Fixed Issues with Imperva Data Protection Agent - v14.6 Patch

130

ID Agent OS Agent DB Description

Occasionally, during an upgrade, for an MS-SQL agent running in

AGNT-13867 Windows MSSQL user space mode, the database would hang and would need to be
restarted.

AGNT-13676 Windows MSSQL The OS user was incorrectly populated.

Agent Release Notes 88

 Agent Release Notes

Fixed Issues with Imperva Data Protection Agent - v14.6 Patch

120
There are no fixed issues with v14.6 Patch 120. The release content is exclusively what is reported in the release
highlights for patch 30. For more information see Features Released with Agent v14.6.

Fixed Issues with Imperva Data Protection Agent - v14.6 Patch

110

ID Agent OS Agent DB Description

In rare scenarios, when there are over 30K local connections, the
AGNT-13903 Linux, Unix All Databases agent working in kernel mode had a memory leak that could result
in an increased latency on the server.

Fixed Issues with Imperva Data Protection Agent - v14.6 Patch

100
There are no fixed issues with v14.6 Patch 100. The release content is exclusively what is reported in the release
highlights for patch 30. For more information see Features Released with Agent v14.6.

Fixed Issues with Imperva Data Protection Agent - v14.6 Patch

90

ID Agent OS Agent DB Description

The which_ragent_package script did not give a recommendation

AGNT-13899 OEL-EUK All databases
for a ueknano 6 or above kernels.

Agent Release Notes 89

 Agent Release Notes

Fixed Issues with Imperva Data Protection Agent - v14.6 Patch

80

ID Agent OS Agent DB Description

The big data agent was not able to monitor a process using a non
AGNT-13679 Linux All Big Data Databases
default tmp directory.

AGNT-13798 Linux All Big Data Databases Big Data Agent might have created world writeable files.

The Agent working in user space mode sometimes create a

AGNT-13612 Linux DB2 for LUW
memory leak in the DB2 process.

Login through X.509 certificate authentication might not have

AGNT-13684 Linux MongoDB
been monitored.

Running mongosh locally with parameters in the command line

AGNT-13835 Linux MongoDB
would cause incorrect RWE.

Login through X.509 certificate authentication on session start was

AGNT-13505 RHEL MongoDB
not monitored.

Fixed Issues with Imperva Data Protection Agent - v14.6 Patch

70

Agent Release Notes 90

 Agent Release Notes

ID Agent OS Agent DB Description

In rare scenarios when the system is overloaded the agent had a

AGNT-13665 Linux Oracle
memory leak.

Sometimes on the Oracle user space there was false running with
AGNT-13669 Linux Oracle
an error message.

In certain scenarios, the agent could have caused issues to some

AGNT-13760 Linux Oracle
Oracle utilities.

AGNT-13600 Windows MSSQL On Windows servers with kerberos, the agent controller crashed.

Fixed Issues with Imperva Data Protection Agent - v14.6 Patch

60

ID Agent OS Agent DB Description

In rare scenarios when the agent failed to monitor a specific Oracle

AGNT-13652 Linux Oracle
connection, the Oracle connection process would crash.

In rare scenarios when the system is overloaded the agent had a

AGNT-13134 Linux Oracle, PostgreSQL
memory leak.

In rare scenarios, there was excessive CPU usage.

From this version, Oracle grid is no longer monitored by default.

AGNT-13375 Linux Oracle
To enable monitoring Oracle grid the advanced config parameter
"userspace-monitor-oracle-grid" should be changed to true.

Agent Release Notes 91

 Agent Release Notes

ID Agent OS Agent DB Description

In rare scenarios, there was a dead lock on the Oracle process

during high load.
AGNT-13567 Linux Oracle
From this version the dead lock was fixed.

AGNT-13540 RHEL Oracle There was no audit after an Oracle patch

Fixed Issues with Imperva Data Protection Agent - v14.6 Patch

50

ID Agent OS Agent DB Description

On high load servers, occasionally there are hanging/dormant

AGNT-13597 Linux Oracle connections. In case this happens, there is now an advanced
configuration option that can help mitigate the situation.

DB discovery was running too long a time, delaying the start of the
AGNT-13571 All Oracle
agent.

Agent Release Notes 92

 Agent Release Notes

Fixed Issues with Imperva Data Protection Agent - v14.6 Patch

40

ID Agent OS Agent DB Description

In rare cases, when the agent works in ASO in the kernel, the agent
AGNT-13516 Linux Oracle
could have caused the server to crash.

Fixed Issues with Imperva Data Protection Agent - v14.6 Patch

30
There are no fixed issues with v14.6 Patch 30. The release content is exclusively what is reported in the release
highlights for patch 30. For more information see Features Released with Agent v14.6.

Fixed Issues with Imperva Data Protection Agent - v14.6 Patch

20

ID Agent OS Agent DB Description

In rare scenarios, Oracle and Postgres connections would become

AGNT-13437 Linux Oracle, PostgreSQL
unresponsive.

A large number of log messages were generated by the agent

AGNT-13417 Linux PostgreSQL
to /var/messages when PostgreSQL was installed.

In large servers running Postgres, the database discovery would

AGNT-13407 Linux PostgreSQL
sometimes fail with timeout.

Agent Release Notes 93

 Agent Release Notes

Fixed Issues with Imperva Data Protection Agent - v14.6 Patch

10

ID Agent OS Agent DB Description

In rare scenarios, when the database was very busy, the agent
AGNT-13387 Linux All Databases
could have caused it to crash.

While monitoring Sybase SSL traffic, connections that were

AGNT-13336 Linux Sybase ASE
opened before the agent were not monitored.

Agent Release Notes 94

 Agent Release Notes

Proprietary Rights Notice

© 2002 - 2023 Imperva, Inc. All Rights Reserved.

Follow this link to see the Imperva copyright notices and certain open source license terms:

https://docs.imperva.com/bundle/z-kb-articles-km/page/656407b1.html

THIS DOCUMENT IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT
LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. IN
NO EVENT SHALL IMPERVA BE LIABLE FOR ANY CLAIM OR DAMAGES OR OTHER LIABILITY, INCLUDING BUT NOT
LIMITED TO DIRECT, INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY KIND ARISING FROM ANY
ERROR IN THIS DOCUMENT, INCLUDING WITHOUT LIMITATION ANY LOSS OR INTERRUPTION OF BUSINESS, PROFITS,
USE OR DATA.

No part of this document may be used, disclosed, modified, reproduced, displayed, performed, distributed, stored in
a retrieval system, or translated into any language in any form or by any means without the written permission of
Imperva, Inc. To obtain this permission, write to the attention of the Imperva Legal Department at: 3400 Bridge
Parkway, Suite 200, Redwood Shores, CA 94065.

Information in this document is subject to change without notice and does not represent a commitment on the part of
Imperva, Inc. Imperva reserves the right to modify or remove any of the features or components described in this
document for the final product or a future version of the product, without notice. The software described in this
document is furnished under a license agreement. The software may be used only in accordance with the terms of this
agreement.

This document contains proprietary and confidential information of Imperva, Inc. Imperva and its licensors retain all
ownership and intellectual property rights to this document. This document is solely for the use of authorized
Imperva customers.

TRADEMARK ATTRIBUTIONS

Imperva, the Imperva logo, SecureSphere, Incapsula, CounterBreach, ThreatRadar, Camouflage, Attack Analytics,
Prevoty and design are trademarks of Imperva, Inc. and its subsidiaries.

All other brand and product names are trademarks or registered trademarks of their respective owners.

PATENT INFORMATION

The software described by this document may be covered by one or more of the following patents:

US Patent Nos. 7,640,235, 7,743,420, 7,752,662, 8,024,804, 8,051,484, 8,056,141, 8,135,948, 8,181,246, 8,392,963,
8,448,233, 8,453,255, 8,713,682, 8,752,208, 8,869,279 and 8,904,558, 8,973,142, 8,984,630, 8,997,232, 9,009,832,
9,027,136, 9,027,137, 9,128,941, 9,148,440, 9,148,446, 9,401,927, and 11, 579, 859..

Imperva Inc.

Agent Release Notes 95

 Agent Release Notes

One Curiosity Way

San Mateo, CA 94403
United States

Tel: +1 (650) 345-9000

Fax: +1 (650) 345-9004

• Website: http://www.imperva.com
• General Information: [email protected]
• Sales: [email protected]
• Professional Services: [email protected]
• Technical Support: https://support.imperva.com/s/

v14.6-Agent-Release-Notes-Patch-80

Agent Release Notes 96