Falcon LogScale Collector 1.3.1 GA (2023-3-9)
| Version | Type | Release Date | Config. Changes |
|---|---|---|---|
| 1.3.1 | GA | 2023-3-9 | Yes |
| File | SHA256 Checksum |
|---|---|
| linux_amd64.deb | a52f365af747a2d4eda400392e29540a92ce39cd42dd5c26554d92b5f68ecc4c |
| linux_amd64.rpm | 399cd1c41a5006a4d41f0991d00df3cee4a87b2acc0542b4707bfe01dff89cb1 |
| linux_arm64.deb | 668386f89987c7f2ac10c759e040d6fceebe8c2a30d3435b13e02e4860d9b993 |
| linux_arm64.rpm | bdd8e208551ba220016367a1ff7833fdd1bcf17449725c79e7a069e52c9bc0a1 |
| windows_amd64.msi | 191ec1f4151bf2ffaea93dedfd646974c879a62762a7c63539ab4d5f3bf34b89 |
Bugfix for the Windows event log source, related to an issue with the event data fields.
Improvements, new features and functionality
Configuration
The behaviour in cases where the system HTTP proxy detection fails, has been changed.
If no proxy is configured, the collector will attempt to detect and use the system HTTP proxy. Previously if detection failed the collector would stop, for example this sometimes occurred on older versions of Windows.
Now in case of failure a warning will be logged, and the collector will continue without a proxy (corresponding to the configuration: proxy:none).
When installing on Linux the provided service file allowing to run the collector as a systemd service, now defaults to “Restart=always”. This is to ensure that unless the service is stopped, the collector service will always be restarted in case of e.g. a crash.
Debugging
Usability improvement of the enroll command.
The check for supplied command line arguments is improved and if incorrect/missing arguments are encountered usage is printed.
Bug Fixes
Fleet Overview
Corrected UserAgent in HTTP requests for fleet overview and fleet management (Internal improvement).
Collecting Data
Corrected handling of event templates version for the Windows event log source (type: wineventlog).
When collecting data from a Windows Event, the collector extracts information from event data and maps the data to named fields in LogScale.
Scenarios where an event has multiple versions of its XML template were not handled correctly, potentially resulting in incorrect values being assigned to field names.