Falcon LogScale Collector 1.9.0 GA (2025-04-14)

Version?Type?Release Date?Config.Changes?
1.9.0GA2025-04-14yes

Hide file hashes

Show file hashes

Highlights

  • Various new data collection features, including more fine-grained control over the wineventlog source and support for UTF-16 encoded files in the file source.

  • Several new commands to improve troubleshooting and monitoring of the Falcon LogScale Collector.

Deprecation

These items have been deprecated and may be removed in a future release:

  • The includeXML property is now deprecated and will be removed in version 1.10.0. Users are strongly encouraged to transition to the new format property to ensure compatibility with future updates and to take advantage of the more flexible configuration options.

Improvements, new features and functionality

  • Collecting Data

    • Added support for UTF-16 encoded files in the file source. By default, encoding will be auto-detected by BOM (Byte Order Mark). Both UTF-16BE and UTF-16LE are supported.

      • BOM is also skipped in UTF-8 encoded files that start with the BOM.

      • When reading files that do not contain a BOM, it is necessary to specify the encoding in the file source config using: encoding: UTF-16LE, or encoding: UTF-16BE

    • For wineventlog source this update allows more control over the collected data, potentially reducing data volume and improving performance by selecting only the necessary information for your use case.

      A new parameter format has been introduced, providing more fine-grained control over the local rendering. This addition offers four options:

      • xmlOnly: Collect events in XML format only using @rawstring

      • xmlWithMessage: Collect events in XML format (@rawstring ) with the rendered message included (windows.Message)

      • renderFieldsOnly: Collect events with rendered fields only (corresponding to includeXML: false)

      • renderFieldsWithXML: Collect events with rendered fields and XML (corresponding the previous default behaviour)

    • Added a feature to the Syslog source in UDP mode, which makes it possible to combine events from separate datagrams that share a common message ID. The feature is useful to receive Syslog messages from Cisco devices that implement a header containing the following data: `<ID> <Index> <Total>` describing the datagram's position in the final message and total number of datagrams.

  • Other

    • When reloading config the diff now ignores YAML indentation

    • On Linux, listening sockets are now kept active between config reloads that specify the same syslog sources. This reduces the amount of logs that are dropped due to config reloads.

    • To take advantage of the latest optimizations and security updates the Go version has been updated.

  • Debugging

    • This release introduces several new commands that improve troubleshooting and monitoring of the Falcon LogScale Collector.

      For more information, see Debug Commands.

  • Fleet Management

    • Support for sending two new metrics - sources and problemsReport which contain configured log sources and collector errors. When enabled server side it replaces the usage of a deprecated system metric.

  • Installation and Deployment

    • Added a new config validation command to enhance configuration management. This feature allows users to verify the validity of YAML configuration files and ensures compatibility with Falcon LogScale Collector. While it confirms the config's structural correctness and Falcon LogScale Collector's ability to run with it, it does not guarantee successful data collection or transmission.

      For more information, see Debug Commands.

Known Issues

  • Debugging

    • The debugging commands have a limitation on Linux and macOS that requires the dataDirectory max path length to be <80 to work.

    • On Windows, the new interactive monitor is experiencing a visual issue where debug messages flood the screen when the mouse cursor is moved over the terminal. The messages are in the format <timestamp> Unknown msg: teag.MouseMsg{X: , Y:...}. To clear the screen, press the h key twice. This will reset the display. A permanent fix for this issue is being addressed in the next release.

    • The internal metric sink time to send is not calculated correctly.