Table of Contents

General Feature Release 10.6.10

Tip

Prerequisites

Before you upgrade to this DataMiner version:

Important changes

The following changes may have an impact on your system, so please make sure to check these before you upgrade:

Highlights

DataMiner key vault [ID 44075] [ID 44349] [ID 44350] [ID 44351] [ID 44352] [ID 44353] [ID 44354] [ID 44701] [ID 44702] [ID 44911] [ID 46047] [ID 46061]

From DataMiner 10.7.0/10.6.10 onwards, all credentials managed through the Credentials Library (SNMPv2/community, SNMPv3, username/password, and token credentials) will be protected using encryption at rest.

Key enhancements include:

  • Secure storage of secrets as authenticated ciphertext (AES-256-CBC with HMAC-SHA-256) in a dedicated encrypted store managed by the DataMiner StorageModule, with support for Cassandra, cloud storage, and XML-based deployments. Encryption keys are stored per node and protected using Windows DPAPI.

  • Introduction of the DMS backup password, needed to restore encrypted backups on clean machines while maintaining secure key custody. The restore wizard will automatically detect when the password is required and will validate it during restore operations.

  • Automatic migration of existing credentials from Library.xml to the encrypted store during upgrades, and reconstruction of Library.xml during downgrades for backwards compatibility.

  • Cluster-wide secret re-encryption support through the SLNetClientTest tool, allowing administrators to rotate encryption keys and re-encrypt all stored secrets without changing credential identifiers.

  • Additional security and robustness improvements, including permission enforcement for credential management, duplicate-name protection, decryption failure detection, and extensive reliability enhancements.

Important

The DMS backup password should be stored securely outside DataMiner (for example, in a password manager). If it is lost, encrypted credentials in any backup taken with that password can no longer be recovered on a clean host. In a multi-node cluster, a peer DataMiner Agent can re-synchronize the encryption material to a restored node, but this should not be relied upon as a substitute for a properly configured DMS backup password.

Automation: Credentials can now be added within the XML code of an automation script [ID 44282] [ID 46229]

Automation scripts now support adding credentials from the Credentials Library directly in the script's XML code.

See the following example:

<Credentials>
    <Credential id="1">
        <Name>MyCredential</Name>
        <CredentialId>8d15e7d8-f8f6-41f6-985c-fddbd3ea94ae</CredentialId>
        <Type>Token</Type>
    </Credential>
</Credentials>
Element Attribute Content
Credential id ID of the credential (integer, unique per script)
Name - Name of the credential (string, unique per script)
CredentialId - GUID of the linked credential from the Credentials Library
Type - Type of credential: UserNameAndPassword or Token
Note
  • If users add or import a script, and they do not have access to one or more of the specified credentials, those credentials will be cleared, and the script will becomes non-executable until valid credentials are assigned.
  • At runtime, automation scripts can now use the new engine.GetCredential() method to retrieve secrets from UserNameAndPassword and Token credentials stored in the Credentials Library.

New features

Spectrum analysis: New measurement point cycle parameter and sync event [ID 46183]

In order to notify client applications when the measurement point cycle changes, a new spectrum parameter has been added: SPA_SPARAM_MEASPOINT_CYCLE (PID 64227).

This will especially improve synchronization in shared sessions, keeping measurement point cycle updates aligned across connected clients.

Changes

Enhancements

Cassandra Cluster Migrator tool now supports migrating Credentials Library credential types [ID 45824]

The Cassandra Cluster Migrator tool (SLCCMigrator.exe), which migrates data to Cassandra Cluster from MySQL or Cassandra Single, now also supports migrating credential types that inherit from ACredentialConfig, i.e., all credential types that can be created in the Credentials Library.

Enhanced performance when upgrading the ModelHost DxM [ID 45967]

Because of a number of enhancements, overall performance has increased when upgrading the ModelHost DxM.

ModelHost DxM has been upgraded to Microsoft .NET 10 [ID 45988]

The ModelHost DxM has been upgraded to Microsoft .NET 10.

APIGateway: SLNet authentication [ID 46055]

A new REST endpoint, /APIGateway/api/authentication/ticket, can be used to authenticate a session with APIGateway using an SLNet connection ticket. You can then use this session to access DxM endpoints in an authenticated way, with APIGateway acting as a reverse proxy.

UserDefinableApiEndpoint DxM has been upgraded to Microsoft .NET 10 [ID 46066]

The UserDefinableApiEndpoint DxM has been upgraded to Microsoft .NET 10.

Enhanced performance when recalculating security keys [ID 46077]

Because of a number of enhancements, overall performance has increased when recalculating security keys.

DataMiner Taskbar Utility: Event colors now align with DataMiner Cube [ID 46130]

The colors used by the DataMiner Taskbar Utility for upgrade events now align with the colors used by DataMiner Cube. This makes it easier to identify the status of events such as Finished, Success, LocalComplete, UploadComplete, UpgradeComplete, Notice, and Error.

Load, save, and delete actions for services have been rerouted from SLXml to the StorageModule DcM [ID 46134]

In preparation of service swarming, all load, save, and delete actions for services have been rerouted from SLXml to the StorageModule DcM.

Automation: GetAvailableAutomationScripts now returns additional script information [ID 46140]

The GetAvailableAutomationScripts call now returns the following additional information for each script:

  • IsInteractive: Indicates whether the script can show UI elements.
  • CanBeExecuted: Indicates whether the script can be run on its own. Scripts that only contain reusable libraries return false.

User-Defined APIs: IIS rewrite rules are now validated and repaired by the UserDefinableApiEndpoint DxM [ID 46143]

The UserDefinableApiEndpoint DxM now owns the IIS rewrite rule that reroutes requests sent to /api/custom to the endpoint. It now validates the rule when the process starts and keeps checking it while the service runs, repairing it automatically if needed.

If the rewrite rule is missing, disabled, or no longer matches the expected routing behavior, the DxM will restore it with the correct configuration. This ensures that user-defined API requests keep working even if the IIS configuration has been changed outside the installer.

Scheduler: SkipStartedInformationEvent is now returned when retrieving scheduled tasks [ID 46161]

When you retrieve scheduled tasks using a GetInfoMessage with type set to "SchedulerTasks", the returned AutomationScriptInstance will now include the SkipStartedInformationEvent property.

This will allow you to verify whether the property was enabled when the scheduled task was saved.

CloudStorageMigrationFinalize script will now migrate all credentials stored in the Credentials Library [ID 46204]

The CloudStorageMigrationFinalize script, which should be run when migrating existing data to STaaS, will now migrate all credentials stored in the Credentials Library.

User-Defined APIs: Optional notice generation when token rate limits are reached [ID 46244]

On ApiToken objects, you can now enable notice generation when a token reaches its configured rate limit by setting ApiTokenRateLimit.GenerateNotice to true.

When enabled, one notice can be generated per token when its rate limit is reached. Notices are not cleared automatically. If you clear a notice manually and the token hits its rate limit again, a new notice can be generated.

Security enhancements [ID 46368] [ID 46411] [ID 46510] [ID 46515]

A number of security enhancements have been made.

Fixes

Agent element alarm and masking information could be out of sync after a Failover switch [ID 45601]

Up to now, when a DataMiner Agent came online after a Failover switch, the Agent element alarm tree and mask state could remain stale in memory. As a result, alarm and masking information for the Agent element could temporarily differ from what was stored in the database.

From now on, when the Agent comes online after the Failover switch, the Agent element's alarm and masking information are explicitly reloaded from the database. This ensures that the incoming Agent immediately reflects the correct alarm tree, correlated alarms, and mask state.

SLDataGateway select paging handlers were not cleaned up correctly [ID 45937]

When SLDataGateway performed a select read page by page, the database-specific paging handler could remain active after the read completed. In addition, query limits were not consistently enforced across the returned pages.

From now on, select reads use the same paging lifecycle and limit handling as regular reads. This ensures that limits are applied consistently, the final partial page is returned correctly, and the paging handlers are cleaned up when paging finishes.

Table subscriptions with forceFullTable filter did not deliver updates for newly added rows on regular tables [ID 45970]

Up to now, when you created a subscription on a regular (non-partial) table and included the forceFullTable=true extra filter, updates for rows that did not yet exist at subscription creation time were not delivered.

From now on, this filter will be ignored for regular tables. As a result, subscriptions that include this filter now behave the same as subscriptions without it, and updates for newly added rows are delivered correctly.

View tables, direct view tables, partial tables, and matrixes are not affected.

SLAutomation deadlock when many subscripts were launched rapidly [ID 46056]

SLAutomation could deadlock when many subscripts were launched in a short time. This issue has been resolved.

DataMiner upgrade: Legacy NAS and NATS services and files would not be removed [ID 46094]

Up to now, a DataMiner upgrade could leave behind the legacy NAS and NATS services as well as the C:\Skyline DataMiner\NATS folder.

From now on, on systems that have already been upgraded successfully to a DataMiner 10.6 version at some point in time, a new upgrade action named CleanupNatsServices will make sure these legacy services and that folder are removed. This ensures that the BrokerGateway-managed NATS solution can be used without the obsolete components.

SLAutomation could hang during shutdown [ID 46123]

In some cases, a race condition could cause the SLAutomation process to hang during shutdown.

As a result, a DataMiner upgrade could be delayed unnecessarily by up to 5 minutes.

DataMiner Agent Minimum Requirements BPA test incorrectly checked physical CPU cores [ID 46154]

Up to now, the DataMiner Agent Minimum Requirements BPA test would incorrectly check physical CPU cores instead of logical CPU cores. As a result, virtualized environments such as a DaaS system could incorrectly be reported as not meeting the minimum CPU core requirements.

This issue has now been fixed. The test now checks logical CPU cores.

Elasticsearch re-indexing tool did not preserve the correct name for the newest index [ID 46168]

When the Elasticsearch re-indexing tool processed TTL rollover indices, up to now, it would not preserve the provided index name on the newest empty index. As a result, re-indexing could lead to data loss and the generation of erroneous indices.

The re-indexing tool has been updated to Microsoft .NET 10 and now forces a rollover for TTL rollover indices when re-indexing is complete. This ensures that the newest empty index retains the correct provided name and is marked as the write index.

Invalid cleared correlated alarms could be generated when DVE linking changed [ID 46174]

When a correlation rule with the AutoClear option disabled generated an alarm for base alarms on a linked DVE table, DataMiner could generate invalid cleared alarms if the linked row disappeared and reappeared or was unlinked and relinked.

gRPC connections could fail when the User-Agent value was invalid [ID 46192]

Custom applications using the SLNet gRPC client could fail to establish a connection when their product version contained characters that led to an invalid User-Agent value during the APIGateway health check.

As a result, the connection could incorrectly be reported as APIGateway is unavailable.

From now on, invalid User-Agent values are skipped, so the health check can continue and the gRPC connection can be established correctly.

ManagerStore: Fixed limit logic when adding objects from the DatabaseCacheLayer [ID 46205]

When DOM reads were executed, the result from the database could be enriched with objects that were still present in the DatabaseCacheLayer. This cache keeps recently written objects available before they are fully indexed in the database, but in some cases it did not correctly keep the configured query limit in mind when paged reads were carried out.

This could cause more objects than expected to be returned in the result, especially when data was still available in the cache for a later page. The limit is now reapplied correctly when objects are added from the DatabaseCacheLayer, and the number of objects already returned on previous pages is tracked correctly.

This fixes the issue for paged DOM reads with a configured limit, ensuring the returned result always respects the requested limit even when cached objects are added to the response.

Spectrum preset update events did not work when the preset name contained a dot [ID 46241]

Up to now, the spectrum preset update event on parameter SPA_SPARAM_PRESET_UPDATE (PID 64216) could fail when the preset name contained a dot (.).

Service property updates through class libraries could create invalid duplicate system-managed properties [ID 46370]

When a class library incorrectly sent system-managed service properties as read-write, duplicate invalid properties could be created while preserving the original read-only properties, causing DataMiner to block the properties update.

From now on, a compatibility safeguard removes invalid read-write duplicates before restoring the correct read-only system-managed properties. Custom service properties remain unaffected.

Persistent element timeout caused by failed WMI actions [ID 46396]

Up to now, a WMI action that was not included in a poll group could fail. For example, this could occur when a QAction updated a parameter, and a trigger on that parameter executed a WMI action. As a result, the element would go into timeout and be unable to recover from the timeout status. This issue has now been fixed.

Improve this page
Advanced search syntax