Falcon LogScale 1.128.0 GA (2024-03-05)
| Version? | Type? | Release Date? | Availability? | End of Support | Security Updates | Upgrades From? | Downgrades To? | Config. Changes? |
|---|---|---|---|---|---|---|---|---|
| 1.128.0 | GA | 2024-03-05 | Cloud | 2025-04-30 | No | 1.70.0 | 1.112.0 | No |
Available for download two days after release.
Bug fixes and updates.
Advance Warning
The following items are due to change in a future release.
Installation and Deployment
We intend to drop support for Java 17, making Java 21 the minimum. We plan to make this change in March 2024.
We aim to stop publishing the
jardistribution of LogScale (e.g.server-1.117.jar) as of LogScale version 1.130.0.Users deploying via Docker images are not affected. Users deploying on bare metal should ensure they deploy the
tarartifact, and not thejarartifact.A migration guide for bare metal deployments is available at How-To: Migrating from server.jar to Launcher Startup.
Deprecation
Items that have been deprecated and may be removed in a future release.
The
anyargument to thetypeparameter ofsort()andtable()has been deprecated and will be removed in version 1.142.Warnings prompts will be shown in queries that fall into either of these two cases:
If you are explicitly supplying an
anyargument, please either simply remove both the parameter and the argument, for example changesort(..., type=any)tosort(...)or supply the argument fortypethat corresponds to your data.If you are sorting hexadecimal values by their equivalent numerical values, please change the argument of
typeparameter tohexe.g.sort(..., type=hex).In all other cases, no action is needed.
The new default value for
sort()andtable()will benumber. Both functions will fall back to lexicographical ordering for values that cannot be understood as the provided argument fortype.In the GraphQL API, the
nameargument to theparserfield on theRepositorydatatype has been deprecated and will be removed in version 1.136 of LogScale.We are deprecating the
humio/kafkaandhumio/zookeeperDocker images due to low use. The planned final release for these images will be with LogScale 1.148.0.Better alternatives are available going forward. We recommend the following:
If you still require
humio/kafkaorhumio/zookeeperfor needs that cannot be covered by these alternatives, please contact Support and share your concerns.The
assetTypeGraphQL field onAlert,Dashboard,Parser,SavedQueryandViewInteractiondatatypes has been deprecated and will be removed in version 1.136 of LogScale.In the GraphQL API, the
ChangeTriggersAndActionenum value for both thePermissionandViewActionenum is now deprecated and will be removed in version 1.136 of LogScale.The
humioDocker image is deprecated in favor ofhumio-core.humiois no longer considered suitable for production use, as it runs Kafka and ZooKeeper on the same host as LogScale, which our deployment guidelines no longer recommend. The final release ofhumioDocker image will be in version 1.130.0.The new
humio-single-node-demoimage is an all-in-one container suitable for quick and easy demonstration setups, but which is entirely unsupported for production use.For more information, see Installing Using Containers.
New features and improvements
Configuration
The new dynamic configuration
MaxOpenSegmentsOnWorkeris implemented to control hard cap on open segment files for the scheduler. The scheduler should in most cases not reach this limit and it only acts as a backstop. Therefore, we recommend that administrators do not modify this setting unless advised to do so by CrowdStrike Support.
Fixed in this release
User Interface
CSV files produced by LogScale for sending as attachments from email actions or uploaded through a LogScale Repository action could contain values where part of the text was duplicated. This would only happen for values that needed to be quoted. This issue is now fixed.
Packages
When attempting to upload a package disguised as a folder, some browsers would get a generic error messages. To fix this issue, only zip files are accepted now.
Improvement
Configuration
The default value for
AUTOSHARDING_MAXhas changed from 128 to 1,024.The default value for
AUTOSHARDING_TRIGGER_DELAY_MShas changed from 1 hour to 4 hours.