Full Falcon LogScale Collector Release Notes Index

This section contains a single page with all release notes on the same page.

Falcon LogScale Collector 1.4.0 GA (2023-5-08)
VersionTypeRelease DateConfig. Changes
1.4.0GA2023-5-08no
FileSHA256 Checksum
linux_amd64.debdb4ea1ad653c1c1563e9f8729a7383af01c38b739ae7df75ee24a747c57f22cf
linux_amd64.rpm260e8106189e924877b5f126ccc63bd651bf9ae40f5d16844cbe715a43a50ffa
linux_arm64.deb2278f9b10ed6547cc7814e6a7e26e26912eac8ddebc3739d09190f60a16e4100
linux_arm64.rpmd704e464b71b8514912b31d8b8b0db08fc0ff81c7a54a75bdc8d23cdb7e32da7
windows_amd64.msiecbcb5a29e24a39749598419d13d17c3483cf6b1ea0121bea1027667577eac53

Bugfix for the Windows event log source, improvements to fleet Management.

Improvements, new features and functionality

  • Other

    • Checkpointer has been improved

      In preparation for future improvements, the checkpoint database has been changed from a JSON file to a binary database format. The existing checkpoints.json file will be automatically imported into the new database. The LogScale Collector will now write a backwards compatible checkpoints.json file on shutdown, which will not be re-imported.

    • Command line arguments

      The LogScale Collector command line interface has been changed to use -- (double dash) for each option. Existing - (single dash) options will be converted in a transition period. A deprecation warning is emitted when options are provided with only a single dash.

  • Fleet Overview

    • Fleet Management Improvements

      • When enrolling a LogScale Collector to Fleet management, the enroll process will now stop and start the service during the enrollment process. This behaviour can be omitted by using the flag to the humio-log-collector enroll command.

      • After a successful enrollment, the LogScale Collector service will be configured to automatically start after a reboot. This behaviour can be omitted by using the --no-service flag to the humio-log-collector enroll command.

      • The LogScale Collector process will now exit if it receives an 401 Unauthorized error code during a Fleet management poll operation. The error code signals that the instance no longer has access to the LogScale cluster and cannot be managed. The service manager will automatically restart the LogScale Collector after exiting.

      • When enrolled in Fleet Management, the LogScale Collector will now collect diagnostics from the sinks and send them to Fleet management. The diagnostics will contain various warning and error states that might occur when sending events to LogScale. The diagnostics is available for viewing in the Fleet management tab in LogScale.

Bug Fixes

  • Managing Data

    • Corrected the handling of subscription to more than 64 channels in a single Windows event log source.

      The wineventlog source sometimes encountered issues when configured with more than 64 channels in a single Windows event log source (type: wineventlog). In this scenario it would not collect any events, and the following error message was observed: "extNext: The operation identifier is not valid.". .

Falcon LogScale Collector 1.3.4 GA (2023-3-30)
VersionTypeRelease DateConfig. Changes
1.3.4GA2023-3-30no
FileSHA256 Checksum
linux_amd64.debf0a6612a103765ff2f54121d1520290dabac64aabbd21eca423f7cd79105f230
linux_amd64.rpma9e1d4174a8b7af93da72c01aae68e7d1a1db66fb29a40bc16bd3cafc62ef14a
linux_arm64.debe82c6c21fe2a0704c42c564cddba39337044247e82cdd5f701658c35bce6bc20
linux_arm64.rpme70248e5caca2c2b8a44b39baf69136d2301dbdcab02269fb74a88084199c34c
windows_amd64.msi3a925d65b753bdcf4ee5724c37925a32805943f8a75b5bddf82e874d3588ff8c

Bugfix for the Windows event log source, related to an issue with forwarded events.

Bug Fixes

  • Collecting Data

    • Using the enroll command, to enroll a new collector to fleet management in a linux environment,would previously cause an error if the collector had not been running before, i.e. if the enroll command is the first action.

      When enrolling a new collector, the collector would use an empty machine id value due to incorrect permissions set up by the enroll command. This is not a problem when enrolling collectors that have already been run.

      Starting with this release the enroll command no longer has this issue. In case the above error is encountered, a manual fix is required to give the service user the correct permissions:

      sudo chown humio-log-collector:humio-log-collector /var/lib/humio-log-collector/.machine-id

    • In a setup using the Windows event log source for collecting forwarded events, the collector has been seen to crash while parsing forwarded events.

      This may occur in a scenario where the remote WEF (Windows Event Forwarding client) and the WEC (Windows Event Collector) go online after a restart. The re-initiated event subscription causes an exception, which stops the collector. This has now been corrected.

Known Issues

  • Collecting Data

    • When collecting data from a Windows event, the collector extracts information from event data and maps the data to named fields in LogScale.

      In scenarios with forwarded events containing empty data values, the indexing of values and names can become misaligned. In this case the current parsing approach is not possible due to misalignment of field names and values. Previously this would result in incorrect values being assigned to field names.

      Starting with this release the collector appends these values as indexed fields (windows.EventData[0..n]) instead of named fields, and introduces a new field @collect.error with the value: "wineventlog: couldn’t parse names for event data".

Falcon LogScale Collector 1.3.3 Withdrawn (2023-3-21)
VersionTypeRelease DateConfig. Changes
1.3.3Withdrawn2023-3-21no
FileSHA256 Checksum
linux_amd64.deb2d0ae5a2f90cbef19c1058393a45ab1007f47d97e907d04505a682a75c943e3e
linux_amd64.rpmc52c11f09f139b17f9389dbb3d6221a9a81715df1faf92453730708dd6963c81
linux_arm64.deb657479d94673417eb1422e8d7f22d5a25718dd88a83db0b20caf5324b1fb2aa7
linux_arm64.rpm011323a48d3675e7cbc3bbbf7ae54c394e43d2d53bd48c380e5a462c1c3967a1
windows_amd64.msi416efe329da3c35a7b2f5f02811595f93a002fb8a0d8637655ca79686245f9d6

This release has been withdrawn due to the introduction of a regression which could result in missing @rawstring for the Windows event log source.

If you are using this version we recommend you upgrade to 1.3.4.

Falcon LogScale Collector 1.3.2 GA (2023-3-16)
VersionTypeRelease DateConfig. Changes
1.3.2GA2023-3-16No
FileSHA256 Checksum
linux_amd64.debe66ae46ded76c53259fc901af0a6139c3c7884007c9f10afe22c570236b7f5f8
linux_amd64.rpm8c00a22e39161a5e8564a47712673447e014f950d41e22aa049907d653621771
linux_arm64.deb255bfefbb886567eb3a698fb0c59cd502f0946b947fa4ff8a0a4e5caf6da921c
linux_arm64.rpmc4c0f7d2b25269f18429411b4d78662f084c97aefd899d51782d68145bdd2afb
windows_amd64.msiefe31334621d59610d3c533b9fdd0f6cde00024c8ded3ecb645c2879a7ea1f3d

Bugfix for the Fleet Management communication, eliminating excessive retries.

Bug Fixes

  • Fleet Overview

    • If Fleet Management communication with LogScale is unsuccessful the LogScale Collector will do exponential backoff.

      In some scenarios, an error in the backoff implementation caused the retry timeout to drop to zero, resulting in excessive retries. This is now corrected.

Falcon LogScale Collector 1.3.1 GA (2023-3-9)
VersionTypeRelease DateConfig. Changes
1.3.1GA2023-3-9Yes
FileSHA256 Checksum
linux_amd64.deba52f365af747a2d4eda400392e29540a92ce39cd42dd5c26554d92b5f68ecc4c
linux_amd64.rpm399cd1c41a5006a4d41f0991d00df3cee4a87b2acc0542b4707bfe01dff89cb1
linux_arm64.deb668386f89987c7f2ac10c759e040d6fceebe8c2a30d3435b13e02e4860d9b993
linux_arm64.rpmbdd8e208551ba220016367a1ff7833fdd1bcf17449725c79e7a069e52c9bc0a1
windows_amd64.msi191ec1f4151bf2ffaea93dedfd646974c879a62762a7c63539ab4d5f3bf34b89

Bugfix for the Windows event log source, related to an issue with the event data fields.

Improvements, new features and functionality

  • Configuration

    • The behaviour in cases where the system HTTP proxy detection fails, has been changed.

      If no proxy is configured, the collector will attempt to detect and use the system HTTP proxy. Previously if detection failed the collector would stop, for example this sometimes occurred on older versions of Windows.

      Now in case of failure a warning will be logged, and the collector will continue without a proxy (corresponding to the configuration: proxy:none).

    • When installing on Linux the provided service file allowing to run the collector as a systemd service, now defaults to “Restart=always”. This is to ensure that unless the service is stopped, the collector service will always be restarted in case of e.g. a crash.

  • Debugging

    • Usability improvement of the enroll command.

      The check for supplied command line arguments is improved and if incorrect/missing arguments are encountered usage is printed.

Bug Fixes

  • Collecting Data

    • Corrected handling of event templates version for the Windows event log source (type: wineventlog).

      When collecting data from a Windows Event, the collector extracts information from event data and maps the data to named fields in LogScale.

      Scenarios where an event has multiple versions of its XML template were not handled correctly, potentially resulting in incorrect values being assigned to field names.

  • Fleet Overview

    • Corrected UserAgent in HTTP requests for fleet overview and fleet management (Internal improvement).

Falcon LogScale Collector 1.3.0 GA (2023-2-7)
VersionTypeRelease DateConfig. Changes
1.3.0GA2023-2-7Yes
FileSHA256 Checksum
linux_amd64.deb80588964a8437e653ac0a1b9a9cf7636d287bbf2314611e09c9d5b00a28f82c4
linux_amd64.rpma4861915f09280a16b4674ad148f61554d35da00b2683b52647473ca7f347a34
linux_arm64.debfec6fc2f2ab5e883781531b384fd2adeca37967f97bd5ae25d44e2ea94f73baa
linux_arm64.rpm7fb71e45dab7dd5334f866e7724c39cd0291b921cb766c0630ed13051837534e
windows_amd64.msi43d999b34e702049edd281c63f142af7b4a69fb52270f9670a826b8600401209

Fleet management now supports remote configuration of LogScale Collectors. This gives an administrator the option of managing the configuration of LogScale Collector instances in LogScale, instead of managing configuration files directly on the device where LogScale Collector is installed.

Improvements, new features and functionality

  • Configuration

    • The configuration of LogScale Collectors can be managed in LogScale. This is accomplished using configurations and enrollment tokens stored in LogScale.

      To be able to manage the configuration of collectors in LogScale, collectors need to be enrolled to remote configuration, this is done using enrollment tokens.

      Two new pages have been added to the Fleet Management tab in the LogScale user interface.

      • The Config overview page, lists all available configurations and the number of LogScale Collectors using each configuration. The page furthermore allows you to create new configurations. See Creating a Configuration - Fleet Management for more information.

      • The Enrollment tokens page lists all available enrollment tokens, and allows for creating new enrollment tokens.

        The actual enrollment of a LogScale Collector is performed by executing an enrollment command on the device with the installed LogScale collector instance. The command to be executed can be grabbed from the enrollment token page. See Managing LogScale Collector Instance Enrollment for more information.

      The Fleet overview page, which displays the status of all LogScale Collector instances, now includes the name of the assigned configuration to each LogScale Collector.

      It is still possible to use the Fleet Overview without enrolling LogScale Collector instances in remote configuration, in which case configuration will need to be managed directly on the device with installed collector. See LogScale Collector Fleet Management Overview for more information.

Falcon LogScale Collector 1.2.3 GA (2023-1-23)
VersionTypeRelease DateConfig. Changes
1.2.3GA2023-1-23No
FileSHA256 Checksum
linux_amd64.debc1e7e6608e3ef67793d4d23226dbb771b5c8e3a932358728519f8e9d52034da4
linux_amd64.rpm98ba2862e925513721b0f856712787a522fea1ed5b0eb34c7a20008b7a233fc7
linux_arm64.deb4234b9d340569872528eaa9eed5bb9aaa1b7130317f89e32c48550e655764e13
linux_arm64.rpm89344a58c18bb914d8ce8bbe688eac3cf2c9ba236098dd2baeddad9b2a394f59
windows_amd64.msi7571d07dac0240d9620ef1a9a1c7dace12473ddfc09d3d0f327ff281fb928785

This version contains bug fixes.

Bug Fixes

  • Collecting Data

    • Fixed a bug on Windows where the Log Collector locks open log files, preventing applications from rotating log files via rename or delete.

Falcon LogScale Collector 1.2.2 GA (2023-1-16)
VersionTypeRelease DateConfig. Changes
1.2.2GA2023-1-16Yes
FileSHA256 Checksum
linux_amd64.deb9fabeb63439db16d6c425d73497809963260670a72564da7f068dd667aff8605
linux_amd64.rpm732aaa87dfa023fc64efd1c1f211f828ee32af8901dd97c34186cf39c51d071e
linux_arm64.debf8f0ea531620160112452f4dd6d158137be829d8b93f4c042bb1d562991d6733
linux_arm64.rpm49ddd2dcc179a47c10f16aaa747f0148dd82137b488ec125ae7bc94422f6e7fe
windows_amd64.msifa41725bc6ebc425db6fec0c81eb895c9a4239cfa18511e6abbc30588bc64913

Bug fixes, improvements and Windows log format collecting features.

Improvements, new features and functionality

  • Collecting Data

    • Moved default program data directory on Windows to prevent possible conflicts with Falcon Sensor.

    • Added an option to WinEventLog source for including/excluding the XML.

    • Improved performance of the WinEventLog source.

    • Added an option to WinEventLog source for excluding eventIDs.

Bug Fixes

  • Collecting Data

    • Fixed a bug which caused the checkpointer for WinEventLog source to not update all of the configured channels.

Falcon LogScale Collector 1.2.1 GA (2022-11-10)
VersionTypeRelease DateConfig. Changes
1.2.1GA2022-11-10No
FileSHA256 Checksum
linux_amd64.debdc7bf952be2ff5c541de2d9d927d03bec578f84fe0cb7214db428f3f4638dafb
linux_amd64.rpm3cd03e99fcf1f6061941c6b38e68656325d0b5c945571715bdd65381ca488370
linux_arm64.deb6e85664f54c84154d1c9b3f4f3b48ae8961e13a643b86981ceba927c733590d1
linux_arm64.rpm904845aef96db4a40b83a3bbe1dcf1e79cceb6e072375ee4c0b3eb4695effb3d
windows_amd64.msi992cbdda12353a4cd4e7bc1672fb31a0033e46096438bed71c4869314ed54ace

Bug fix for an issue related to file source which caused it to stop monitoring files.

Bug Fixes

  • Collecting Data

    • Fixed a bug which could cause the file source to stop monitoring files due to a race condition in file creation, update or deletion scenarios.

Falcon LogScale Collector 1.2.0 GA (2022-10-27)
VersionTypeRelease DateConfig. Changes
1.2.0GA2022-10-27Yes
FileSHA256 Checksum
linux_amd64.deb34ebabca8336e6e84a97684dea8a6592eb893dc1db026096845fc1ff596996c3
linux_amd64.rpm2bcae521ba78bbdd54db0b8b77d536e80eca4a6bd1d3247e757e06ed424be93dd
linux_arm64.deb137f2d376a4d45045258ace6c8c7f9efb5bab808b67c195f98544862cbbf976a
linux_arm64.rpm93f3d1d37c86971ddf6e503e0832f361a98b34b93fecb3f92d696bb7d7355743
windows_amd64.msi9c47b0c008cd5ef83d5569132181d49c8ad929b59cf29e3a65a787bd88e9cce9

This version of the humio log collector offers the Fleet Overview functionality, which allows you to monitor the status of log collector instances and the following improvements:

  • Improved configuration file validation

  • Improved error logging

  • Reload configuration file feature

  • Using environment variables as the sink url

  • The file source now has more include and exclude patterns and uses less resources by waiting for changes to the file

  • the CMD source can now create single multiline events

  • the wineventlog can now filter events by provider and keep bookmarks of its progress

  • Performance improvements

  • improved batch handling

  • Enforces the use of HTTPS.

Improvements, new features and functionality

  • Configuration

    • Improved configuration file validation - The collector is now more thorough when validating its configuration file. An example of this is that unknown options in the configuration are invalid and will prevent running the program. Upon detection of an invalid configuration, the collecter will attempt to provide a descriptive error, some examples of this are:

      error reading config file "my_config.yaml" sources:
              name must consist of only alphanumeric characters or '.', '_'
              and '-'
      
                  error reading config file "my_config.yaml": 
                  sources.cmd_uname_scheduled.interval: invalid type string,
                  wanted int` 
      
                  error reading config file "my_config.yaml"
        : sources.dummy_logs.sink: missing value for required field`
                  
    • The collector now reloads the configuration file when it receives a SIGHUP. This does not apply to the logLevel and dataDirectory options. If the new configuration is invalid, the program will stop.

    • The collector now enforces using https:// for URLs, this can be overridden by adding the -allow-insecure-http command line flag.

  • Collecting Data

    • Improved batch handling

      • The sinks now have additional configuration options to change the maximum event size maxEventSize (default 1MB) and the maximum batch size maxBatchSize (default: 16 MB). The limits are propagated to the queue, where it replaces the previous maxEventsPerRequest option. The limits are also propagated to all the sources that reference the sink.

      • The memory queue no longer supports configuration of maxEventsPerRequest, it inherits the maximum bytes per request from the sink maxBatchSize.

      • The memory queue no longer waits before flushing a batch that is larger than the maximum batch size.

      • The collector now warns you when a memory queue reaches 50% and 80% of capacity.

      • The collector now sends a warning after 2 retry attempts when sending events to a http sink.

    • The wineventlog source can now filter events based on the provider name. Set the option providers to an array of provider names that should be included to enable this feature. This source also keeps a bookmark of its progress in the Windows event log, and resumes from there when the collector is restarted.

    • The cmd source can now create a single multiline event when running in the schedule mode. Set the option consolidateOutput to true to enable this feature.

    • The file source can now have additional include and exclude patterns in the same configuration. Specifically, the options exclude and include can be either a string or an array of strings.

    • The url option in the sinks part of the configuration can now refer to an environment variable by using the ${ENVVAR} syntax.

  • Managing Data

    • If a file monitored by the file source is inactive (not written for a configurable period default: 60 seconds, the file descriptor is closed to release system resources, and watched for changes instead. Whenever the file changes, it is re-opened. This is configurable by the inactivityTimeout option in the file source.

    • Improved serialization performance in the humiosink leading to lower memory usage and faster serialization of events.

    • Improved memory usage of the memory queue component by removing an upfront buffer that caused it to store more events than specified by the maxLimitInMB option.

  • Debugging

    • The default log level is now set to warnings, previously only errors were logged by default.

  • Fleet Overview

    • The collector now supports reporting to the fleet overview of LogScale. Configure the fleetManagement part of the configuration to enable this feature, see Fleet Management (fleetManagement) for more information.

      When the feature is enabled, the collector will periodically send metrics to LogScale, including the OS version, the collector version, how much data is ingested, and a description of the configured log sources.

Bug Fixes

  • Collecting Data

    • Events from the wineventlog source which contain fields of the type hexadecimal integer were presented as a base 10 number, they are now presented as a base 16 number.

Humio Log Collector 1.1.4 GA (2022-10-12)
VersionTypeRelease DateConfig. Changes
1.1.4GA2022-10-12No
FileSHA256 Checksum
linux_amd64.debbd486f2ad1facb7d77fbe19a529f276d5229f60b1a2bbe8aeef8688afd87110a
linux_amd64.rpm67d8242b89df0fc9751153b0d989efaaf913e1db89e027d9246e2229a446bebf
linux_arm64.debadc9a57861c9076c3ff2b123a114ea5590ae973cf00c23486325349693ac11b0
linux_arm64.rpm034aad8e7be0180cf5b8ec22b7f5f976baf8ea1f812fc47345bc9bdb1dcc5065
windows_amd64.msiec99bfb404c297e45d67843c10f6c9960d95adb11fa6bf39837ab98171e4e6d1

Fixed a bug with the Windows event log source.

Bug Fixes

  • Collecting Data

    • Fixed a bug which made the log collector stop when it encountered a Windows event that contained a binary property of zero-length.

Humio Log Collector 1.1.3 GA (2022-10-03)
VersionTypeRelease DateConfig. Changes
1.1.3GA2022-10-03No
FileSHA256 Checksum
linux_amd64.deb5be06657ddddaa365fc4cf3fbfa568f6f2e898f1b47510ba9331d8429ad4f4f8
linux_amd64.rpm662ffdeb1647084d70d6f6a7d6a46c41599320cfc620f9d7770836eab6cc06a8
linux_arm64.debfba12903af198ae7004bbc93d81bdc973fa4fa18d1c47106d233b3787850d7db
linux_arm64.rpm22641197a84f7924a1e5d6f5975318846958bd4601d9f7e7b7893c6dfbe2ea01
windows_amd64.msi3c43952dae2dc726d1a1cb6862ced922893454d4e019984e0b2efe5419319337

Improved troubleshooting on Windows, improved checkpointing on disk and fix for a bug on the data sink type.

Improvements, new features and functionality

  • Debugging

    • Improved Checkpointing to disk -- In case of failure writing checkpoints to disk, an error will be logged and writing to disk will be retried with exponential backoff for up to 1 second. This avoids a potential race condition, in which an external program (e.g. an anti-virus program) locks a file that is being simultaneously accessed by the Log Collector.

    • Improved troubleshooting On Windows platforms -- the Log Collector will send errors and warnings to the Windows event log.

Bug Fixes

  • Collecting Data

    • When sending data to a configured sink the http-header: Content-Type is now set to application/json.

Humio Log Collector 1.1.2 Not Released (2022-09-29)
VersionTypeRelease DateConfig. Changes
1.1.2Not Released2022-09-29No

Important

This release has been withdrawn due to an issue on Windows, where, in certain configurations, it will continuously log the same event.

If you upgraded to this version we recommend you downgrade to 1.1.1. If you have not installed 1.1.2 upgrade directly to 1.1.3 when it is available.

Humio Log Collector 1.1.1 GA (2022-09-19)
VersionTypeRelease DateConfig. Changes
1.1.1GA2022-09-19Yes
FileSHA256 Checksum
linux_amd64.debaceca7f505bc044b275077fa20f9ee565dbc85a48e2454834cbc31a65c3c73aa
linux_amd64.rpmab8afd8cbab28d9072e5d1c5dee1b59acc4aeef640dbf7d9284bf44424fef6e9
linux_arm64.deb9fc3968c093dd341e61b09694fb504f9d1e5116c22d4cc519e3389bcf9148dfe
linux_arm64.rpm26fb2eee00c61903095ea5daab3f3b9e30f0ec0841a13e826c17f2683f714fb9
windows_amd64.msifaab7fb9f935ae4b184debae3cb1310821c5bdc7c3a1ede3a96ce8c4156d8120

Fixed issues on Syslog and JournalD data collection and improved the queue.

Improvements, new features and functionality

  • Managing Data

    • Improved the way events are being queued in order to better respect the maximum limit of the queue.

Bug Fixes

  • Collecting Data

    • The Syslog source now limits events to 2 KB (configurable via the maxEventSize parameter on the source).

    • Fixed an issue with Syslog data where the source would allocate more memory than was needed.

    • Fixed a JournalD source issue where the collector would stop collecting new events after journal files have been rotated.

    • Fixed an issue when using Syslog source where syslog messages were silently discarded.

Humio Log Collector 1.1.0 GA (2022-06-25)
VersionTypeRelease DateConfig. Changes
1.1.0GA2022-06-25Yes
FileSHA256 Checksum
linux_amd64.deb2788c0c46fb6d91c33c9564ef93d8f9d25eb1c711075951784da74661b675c15
linux_amd64.rpm0dda3ece37b7c85be69b2c766b671dd9cfb94248b93159e43a0d266b54df8fe1
linux_arm64.deb6e599f88f53765babfe08a759297a235224b29ff9dd1b6571803a80ac694ca34
linux_arm64.rpm71f7be590748b3030dd716d03ea015d84867910724c7e1ba6b26cb678c3a0cea
windows_amd64.msi7492cf419ac1bfad63917e509a513f38363f2854c0edeeaf0f5852c9b2bc3adc

Extended support and functionalities.

Improvements, new features and functionality

  • Collecting Data

    • The log collector supports for reading gzip and bzip2 compressed files by default.

    • Support for Multiline logs

    • Updated cmd source support

    • JournalD source support

  • Managing Data

    • Disk queue support

    • The queue configuration option fullAction: deleteLatest has been removed are set to the default pause.

    • The user can use environment variables to configure:

      • ingest tokens

      • the field values in the static field transform

      • the environment for any command run through the cmd source

    • Transform Static fields

    • Filter Windows event log by EventID

Humio Log Collector 1.0.2 Stable (2022-05-05)
VersionTypeRelease DateConfig. Changes
1.0.2Stable2022-05-05No
FileSHA256 Checksum
linux_amd64.deb2ed466469b51768b2c3f46c465a23bb0c867fe684adf5715688d223af40d276a
linux_amd64.rpm43d93110a6a365dbd01044a142a4add813c95e37491d8053129dc4bd1fba1bf2
linux_amd64.zip62eaaf9bcf42b986717c8123e65ff9ea4788162757f7ae8f518941ddcb338825
linux_arm64.debbc9a7dc9f2688adbae7d071f7225e6ebeef3e2def88ebccbc5dc290056f7aa7a
linux_arm64.rpm238249181ca038f81cef90855b90f2ed608d8164fbd347c42935db8dc624abf5
linux_arm64.zip9fe71e0409a1e94c8ce225ab90af3f46115210043221e0d6f1570e427cd40f2e

Bug Fixes

  • Other

    • Automatically reload the systemd daemon after install on Linux.

    • Fixed a bug that caused the log collector to start from the beginning of all files after being restarted.

Humio Log Collector 1.0.1 Stable (2022-04-25)
VersionTypeRelease DateConfig. Changes
1.0.1Stable2022-04-25No
FileSHA256 Checksum
linux_amd64.deb7e3addbfd503339afb032dc92da25a6aff0a6fb7ee8b516e90c81666a8127923
linux_amd64.rpm43d93110a6a365dbd01044a142a4add813c95e37491d8053129dc4bd1fba1bf2
linux_amd64.zipd7191c83ec5c95bc5213ec1dbee6f831205755c1ab1bdd0b69443ee19e268a04
linux_arm64.deb44355e8cce6e7db84cf1d43e75b17a7a6b3118744c8582fcf5852be6c44dc0a8
linux_arm64.rpm08b4ef1eb37dea3902694e2ef3b4cbe69dcc9633dce95e19a00cd60f739aeaa3
linux_arm64.zipa88e7dc6183004b8c5c7a167400b6d351489a7bbd93fece1466ab21d6408d1fd

Bug Fixes

  • Other

    • Fixed a bug where the log collector would get stuck when encountering a long line (131,072 B) and use 100 % CPU.

Humio Log Collector 1.0.0 Stable (2022-04-23)
VersionTypeRelease DateConfig. Changes
1.0.0Stable2022-04-23Yes
FileSHA256 Checksum
linux_amd64.debcd65f255943e03f5ad01bed20196742a25e48240ee3dadfeeb363911afe8b8ab
linux_amd64.rpm 8482625c6795954d137609b77737c7c719ce457d4a4b78aace0b5a2cd09df5e6
linux_amd64.zip888d95ec898eb16a528c5537836a4ec42cc543dff206539741816d7c0f564bde
linux_arm64.deb348a3be0ccb4b5c11e88ea18ce8a858814f4d568b5a8b43082811db4e7aa8e9e
linux_arm64.rpm39da26f504af0aa20a40d3c8d08803eecd474163d9650a71803344b85672fe54
linux_arm64.zip3f37407ead2a2e712a9bfcd307b1c6e5ef256d2cb9968dd86bfe70d50aedb634

The first release of Humio Log Collector our native Log shipper which can be used to ship local files to a Humio repository by specifying an ingest token. This version of the log collector offers the following features.

Improvements, new features and functionality

  • Network

    • Supports HTTP(S) proxies.

    • Offers network compression which defaults to ON.

  • Managing Data

    • @collect.* metadata attached to the events including unique collector ID, hostname, @collect.timestamp etc

    • Offers a sub-second ingest lag between a line being written and sent to Humio (configurable)

    • Buffers in memory.

    • Collects from local files using a glob pattern (so single file, directory, recursive, etc) and from windows eventlogs and system logs.

    • Tails for new events in the file.

    • Only handles single line events

    • Ships all existing events in the file.