Known issues in Splunk UBA

This version of Splunk UBA has the following known issues and workarounds.

If no issues are listed, none have been reported.

Date filed	Issue number	Description
2024-04-30	UBA-18862	Error Encountered When Cloning Splunk Datasource and Selecting Source Types Workaround: Re-enter the password on the Connection page for the Splunk endpoint.
2024-04-26	UBA-18851	Benign Error Message on Caspida start - Ncat: Connection Refused
2024-04-25	UBA-18846, UBA-18920	Inconsistent telemetry status when UBA is in FIPS mode
2024-04-03	UBA-18721	UBA identifies end user/service account are accessing hard disk volumes instead of built-in computer account Workaround: Disable the augmented_access rule. Steps to disable rule: - remove (or move to some other location outside of UBA as a backup) the file /etc/caspida/conf/rules/user/ad/augmented_access.rule - restart uba (/opt/caspida/bin/Caspida stop & /opt/caspida/bin/Caspida start)
2022-12-22	UBA-16722	Error in upgrade log, /bin/bash: which: line 1: syntax error: unexpected end of file
2022-06-22	UBA-15882	Benign Spark error message: Could not find CoarseGrainedScheduler in spark-local.log when upgrading UBA
2022-02-14	UBA-15364	Spark HistoryServer running out of memory for large deployments with error: "java.lang.OutOfMemoryError: GC overhead limit exceeded" Workaround: Open the following file to edit on the Spark History Server: /var/vcap/packages/spark/conf/spark-env.sh You can check deployments.conf field spark.history to find out which node runs the Spark History Server. Update the following setting to 3G: SPARK_DAEMON_MEMORY=3G Afterwards, restart the spark services: /opt/caspida/bin/Caspida stop-spark && /opt/caspida/bin/Caspida start-spark
2021-08-30	UBA-14755	Replication.err logging multiple errors - Cannot delete snapshot s_new from path /user: the snapshot does not exist.
2020-04-07	UBA-13804	Kubernetes certificates expire after one year Workaround: Run the following commands on the Splunk UBA master node: /opt/caspida/bin/Caspida remove-containerization /opt/caspida/bin/Caspida setup-containerization /opt/caspida/bin/Caspida stop-all /opt/caspida/bin/Caspida start-all
2017-04-05	UBA-6341	Audit events show up in the UBA UI with 30 minute delay