Falcon LogScale Collector 1.6.2 GA (2024-02-26)

Version?Type?Release Date?Config.Changes?
1.6.2GA2024-02-26yes

Hide file download links

Show file download links

Hide file hashes

Show file hashes

Improvements and bug fixes regarding handling of the file source and installation on Windows.

Improvements, new features and functionality

  • Collecting Data

    • The file source now supports environment variable expansions in the include/exclude field in the config.

Bug Fixes

  • Collecting Data

    • An requirement has been removed where in previous versions the Windows Event Log source required the existence of at least one channel.

    • An issue has been resolved when the checkpointing component used by the file source. If a file was rotated/moved while the content was read but not yet acknowledged through the network, the unacknowledged content could be re-transmitted, resulting in duplication of ingest to LogScale.

  • Other

    • Fixed a bug where the --allow-insecure-http flag would not take effect for communication with Fleet Management. This caused the collector to enforce using https:// for Fleet Management communication even if the enroll command was executed with the --allow-insecure-http flag.

  • Installation and Deployment

    • Installing the Log Collector on Windows using the Windows installer MSI will install it as a service and set the service start setting to Manual. After enrolling the Collector into Fleet Management using the enroll command, the service start setting will be set to to Automatic. and the service will be started.

      In previous versions of the installer a new install/upgrade using the installer MSI would set the service start setting to Manual. (overriding any current setting), as of 1.6.2 the installer service start setting will be preserved unless you do a fresh install.

      When performing a new enroll command, You will set the start to Automatic option., therefore if you want to set to a custom setting, Automatic (Delayed start) option. This will need to be done after the enroll command is performed.

      Note

      downgrading to version 1.6.1 or earlier will still revert to the initial setting (Manual.).