Falcon LogScale Collector 1.10.0 GA (2025-08-15)

Version?Type?Release Date?Config.Changes?
1.10.0GA2025-08-15no

Hide file hashes

Show file hashes

Support for routing syslog messages to multiple destinations and various security fixes.

Improvements, new features and functionality

  • Collecting Data

    • The internal representation and calculation of batch sizes has been changed to make it more similar to how events are represented in LogScale/NG SIEM. Previously, a batch where all events had identical fields would only report the size of the fields once, now it is reported per event leading to a more correct representation of event sizes. An additional benefit of this change is that the internal batching and queuing system is now independent of the transport protocol used.

    • Added support for routing syslog messages to multiple destinations using a new internal re-routing architecture. You can now configure different processing rules through transformations for each destination path and route logs based on content patterns using regex filters. For complete implementation details, please refer to the documentation.

    • The regex_filter transform now supports filtering on fields. Previously the transform only supported filtering events using regex patterns applied to the event message.

    • Optimized the way that event batches are created to stay within max batch size limits.

  • Other

    • To take advantage of the latest optimizations and security updates the Go version has been updated. Furthermore various security posture hardening improvements have been implemented.

  • Debugging

    • Internal log messages have been improved with additional context, as an example messages regarding sink communication now include sink name.

  • Installation and Deployment

    • Full Install (on Linux) now supports automatically adding capabilities CAP_DAC_READ_SEARCH and CAP_NET_BIND_SERVICE to the Log Collector systemd service file. This allows the collector to read system files and bind to port numbers less than 1024.

      To enable this at installation time use the flag --enable-capabilities

Bug Fixes

  • Installation and Deployment

    • Enhanced the Linux uninstallation process for full installations. Previously, the logscale-collector group remained after uninstallation on certain Linux distributions, which did interfere with subsequent reinstallations. The uninstall script now properly removes both the user and group, ensuring clean reinstallations.

Known Issues

  • Collecting Data

    • Environment variable expansion is not supported when using the static_fields transform in this release.