Falcon LogScale Collector 1.8.2 GA (2025-03-12)

Version?Type?Release Date?Config.Changes?
1.8.2GA2025-03-12no

Hide file hashes

Show file hashes

Highlights

  • Improved disk queue memory management to reduce memory usage.

  • Optimizations and security updates.

Improvements, new features and functionality

  • Collecting Data

    • The disk queue implementation has been optimized to reduce memory usage. This enhancement addresses potential out-of-memory issues some customers experienced when using disk queues. The update maintains performance while providing more efficient memory utilization, allowing for better stability and resource management in high-volume logging scenarios.

      Internal tests demonstrate a reduction in memory usage by a factor of 2 to 4 in scenarios using a disk queue.

  • Other

    • Error handling when loading a new configuration has been made more consistent.

      • If using a remote configuration and reloading an invalid configuration, the collector will continue waiting for a new remote configuration.

      • If using a local configuration and reloading an invalid configuration, the service will exit. Previously, it would keep running without collecting data.

    • When reloading the config file (by sending SIGHUP), running pipelines are only restarted if the config file has been changed (comparison on the string contents, white space changes cause restarts). This used to be the case when running with a remote configuration, but when running with a local config, the pipelines were always restarted.

    • The Go version has been updated to take advantage of the latest optimizations and security updates.

  • Debugging

    • Internal log messages have been improved, and additional debug level messages regarding disk queue handling have been added.

  • Fleet Management

    • The Falcon LogScale Collector now sends a shorter OS string to Fleet Management. This is in preparation for an upcoming Fleet Management feature which allows categorizing collectors by their OS (Windows, Linux or macOS) instead of relying on an arbitrary string.

  • Installation and Deployment

    • Helm chart: The helm chart now supports overriding the sink type to allow sending data to a data connector in Next-gen SIEM.