Falcon LogScale Collector 1.12.2 GA (2026-11-05)

Version?Type?Release Date?Config.Changes?
1.12.2GA2026-11-05no

Hide file hashes

Show file hashes

Highlights

  • Bug fixes and security updates

  • Improvements to the Syslog UDP source for high-volume traffic environments

Improvements, new features and functionality

  • Collecting Data

    • This release optimizes the Syslog UDP source for high-volume and bursty traffic.

      OS receive buffer handling

      Under sustained load, the kernel's default socket receive buffer can overflow before the collector reads the queued datagrams. This causes silent packet loss. This release adds control over the OS-level receive buffer and reduces per-packet CPU cost on Linux.

      For the Syslog UDP source, the configuration parameter receiveBufferSize now controls the OS socket receive buffer.

      On Linux, the collector uses SO_RCVBUF to set the receive buffer size, which the kernel caps at net.core.rmem_max. If the process has the CAP_NET_ADMIN capability, this limit is bypassed via SO_RCVBUFFORCE. If the effective size is smaller than requested, the collector logs a warning. To get the full buffer size, either raise net.core.rmem_max or grant the capability.

      UDP datagram sender handling (Linux only)

      This release optimizes UDP syslog processing for multiple senders.

      Additional metrics

      The Syslog source in UDP mode now reports new metrics. They are visible via the logscale-collector monitor and logscale-collector query metrics commands, which connect to the running collector on the host for local diagnostics.

      • workers: How many UDP read workers are configured.

      • dropped_datagrams (Linux only): The number of datagrams the operating system dropped because the collector could not read them from the socket fast enough. When drops are detected, the collector emits a rate-limited warning (no more than once per hour), for example: 

        "UDP datagrams dropped by the kernel before they could be read;
consider raising receiveBufferSize, net.core.rmem_max or workers
droppedDatagrams=542 requestedBytes=16777216"

      • receive_stalls: The number of times all UDP read workers were busy processing a batch simultaneously, leaving no worker waiting on the socket. During a stall, incoming datagrams queue in the kernel buffer and will be dropped if the buffer fills before a worker becomes available again. A sustained or growing stall count indicates that the configured number of workers is not enough to keep up with the ingest rate; adding more workers in the source configuration will help. An occasional stall under short bursts is normal and harmless as long as dropped_datagrams stays at zero.

  • Other

    • This release updates the Go build version for the latest optimizations and security updates.

Bug Fixes

  • Collecting Data

    • Syslog TLS handling (FIPS variant only)

      For the syslog_tls source, SHA-1 certificate fingerprints are now rejected in FIPS variants. syslog_tls sources that use sha-1: fingerprints will fail to start and log the following error: 

      "cannot use sha-1 fingerprints in FIPS140-3 mode"

      Previously, SHA-1 fingerprints were accepted at source start-up. The Go runtime would panic when computing the digest at connection time, crashing the collector. The error is now caught early with a clear message. Replace sha-1: fingerprints with sha-256: fingerprints before you upgrade to this version. Non-FIPS builds are unaffected.

  • Fleet Management

    • Fixed a bug where the Fleet Management Insights Ingest By Source widget under-reported collected bytes, events, and batches per log source. This affected reporting only and had no impact on actual ingest.