Falcon LogScale 1.234.5 LTS (2026-08-20)

Version?Type?Release Date?Availability?End of SupportSecurity UpdatesUpgrades From?Downgrades To?Config. Changes?
1.234.5LTS2026-08-20

Cloud

On-Prem

2027-05-31Yes1.177.01.177.0No

Hide file download links

Show file download links

Hide file hashes

Show file hashes

These notes include entries from the following previous releases: 1.234.4, 1.234.3, 1.234.4, 1.234.3, 1.234.4, 1.234.3, 1.234.4

Bug fixes and updates.

Breaking Changes

The following items create a breaking change in the behavior, response or operation of this release.

  • Configuration

    • LogScale will now throw an error on boot if SECONDARY_DATA_DIRECTORY variable is configured. This change is intended to help administrators identify that they are using this deprecated feature that is now being removed.

Advance Warning

The following items are due to change in a future release.

  • Security

    • Starting from LogScale version 1.237, support for insecure ldap connections will be removed. Self-Hosted customers using LDAP will only be able to use ldaps secure connections.

  • Fleet Management

Removed

Items that have been removed as of this release.

GraphQL API

Storage

  • Secondary storage support has been entirely removed. The following configuration options are no longer available:

  • Secondary storage support has been removed from the redactEvents functionality, the health check functionality, and the internal segment fetching endpoint. This includes the removal of the secondary-disk-usage health check response from the health check API.

Metrics and Monitoring

  • The schedulesegments metric has been removed due to the data it provided no longer being of significant use. Previously, this metric measured the execution time for a particular piece of code that has now experienced significant changes since the metric's inception. Performance issues for that piece of code can now be observed via thread dumps, making a dedicated metric obsolete.

  • The humio-metrics repository metric secondary-disk-usage has been removed, as it measured functionality that is no longer present in the product.

Deprecation

Items that have been deprecated and may be removed in a future release.

Upgrades

Changes that may occur or be required during an upgrade.

  • Functions

    • The underlying data structure for the following query functions have been updated to improve cardinality estimation:

      This represents no change in operations for users.

New features and improvements

  • Automation and Triggers

    • It is now possible to schedule reruns of scheduled searches that have already been executed. This functionality is currently available through the GraphQL API using the new rerunScheduledSearch mutation, and the cancelScheduledSearchRerun mutation for canceling a rerun. Scheduled reruns can be viewed in the executionTimesToRerun field on the ScheduledSearch type. Reruns run in parallel with normal runs, with at most one rerun per scheduled search at a time.

      A maximum of 50 reruns can be scheduled per scheduled search. This limit is configurable using the SCHEDULED_SEARCH_MAX_NUMBER_OF_RERUNS configuration variable.

    • The new Interval scheduling option has been added as an alternative to cron expressions for scheduled searches. This new option uses Relative Time Syntax modifiers such as @every 5d, allowing searches to run at regular intervals.

      For more information, see Scheduling.

  • GraphQL API

    • The GraphQL mutation unsetRetention has been added, allowing individual retention settings on a repository to be restored to their default values. Previously, once retention settings such as timeBasedBackupRetention were set to a positive value, the only way to restore them to the default was to pass null via the updateRetention mutation, which some API clients do not support.

      The new mutation accepts boolean flags for each retention setting and restores those set to true back to their default values. The supported flags are:

      • timeBasedRetention

      • ingestSizeBasedRetention

      • storageSizeBasedRetention

      • timeBasedBackupRetention

  • Configuration

    • The feature flag EnableCompleteStateCache has been replaced with the dynamic configuration parameter QueryStateCacheCompleteEnabled.

Fixed in this release

  • Installation and Deployment

    • Fixed an issue where nodes could occasionally lose connection to Kafka clusters if the node was started with the environment variable KAFKA_COMMON_METADATA_RECOVERY_STRATEGY set to none.

  • User Interface

    • Web interface's table components could display stale data when filters were changed rapidly by users. For example, this issue might have occurred when entering data in a search box, toggling column filters, and/or clearing all filters in rapid succession, resulting in responses arriving out of order and causing outdated results to overwrite more recent data.

      To address this issue, table components in the UI now track request versions and ignore stale responses, ensuring only the most recent filtered results are displayed. Also, the previous/next pagination buttons are now disabled while a search is in progress.

      Before the fix, affected pages included:

    • The documentation link in the error message for aggregate alerts containing prohibited functions has been repaired.

  • Automation and Triggers

    • In rare cases, Email actions would fail to send emails when the following conditions occurred:

      • The email action sent results as an attached CSV.

      • The name of the trigger activating the actions contained one of the {field:FIELD_NAME} or the {field_raw:FIELD_NAME} message templates.

      • The name of the trigger with an unexpanded message template was longer than 30 characters.

      • The part of the name of the trigger coming before the message template was at most 30 characters.

      This issue has now been fixed and Email actions are now sent correctly even when the above conditions are met.

    • Fixed an issue where a filter alert could trigger on two events sharing the same @id field value, depending on timing. Filter alerts now deduplicate events using the @id field and will trigger on only one of them.

  • Storage

    • Fixed an issue with segment file validation on startup, where the validation process could end up blocking segment operations for an extended period of time. On nodes with a slow disk and many segment files, all segments could become locked for validation immediately instead of validating groups of files in smaller batches.

  • Ingestion

    • Fixed an issue where live queries that referenced a parser were not restarted when parser updates occurred. Changes to a parser referenced by a live query now cause the live query to be restarted similar to saved queries.

    • In the parser editor, when validating test cases against the CrowdStrike Parsing Standard (CPS), the parser schema validation would report a violation against the wrong field name in some cases. This issue has now been fixed.

  • Queries

    • A minor issue regarding prioritization in LogScale's query scheduler has been fixed. When starting work on scanning a segment piece, a query is effectively charged for the expected cost of the work. Previously, the total estimate was being incorrectly multiplied by the number of blocks in the segment, causing the query to temporarily appear more expensive than it should, resulting in a more strict deprioritization than necessary.

    • A minor issue introduced in version 1.134.0 has been fixed where streaming queries were not being throttled correctly, leading to individual streaming queries consuming too much capacity.

    • The query prioritization code used for humio-metrics has been adjusted to ensure all costs incurred by a user or organization is accounted for in the metrics gathered by LogScale. Previously, the final work completed by the last query performed was not counted, eliminating it from the final total.

    • Fixed an issue where unrelated, incorrect auto-completion suggestions would be provided by the Query editor when writing regex flags, for example in cases where the user's cursor was positioned after the regex flag in /foo/i. This issue has been fixed and auto-suggestions are now disabled in these cases.

    • An issue in the Query Editor> has been fixed where auto-completions would be suggested when writing inside comment blocks. For example, if the cursor was positioned inside //foo or /*foo*/, auto-completions would incorrectly be suggested. No suggestions are now provided in these cases.

  • Fleet Management

    • Fixed an issue where the UI would prevent deleting Log Collector configurations even when no collector instances were using the configuration.

  • Metrics and Monitoring

    • The calculation for the humio-metrics repo metric min-unacked-ingest-timestamp has been corrected to account for occasional underreporting due to overly optimistic (low) values.

  • Functions

    • Fixed an issue with the query functions format() and formatTime(), where negative time zone offsets could be printed incorrectly.

    • Fixed an issue where queries using the parseTimestamp() function on a timestamp that included a deprecated Java short zone ID (ZoneId.SHORT_IDS) would result in an erroneous time zone being supplied (Africa/Abidjan). Use of the deprecated codes will now result in an error message.

      For more information, see the Java ZoneId SHORT_IDS documentation.

Known Issues

  • Storage

    • For clusters using secondary storage where the primary storage on some nodes in the cluster may be getting filled (that is, the storage usage on the primary disk is halfway between PRIMARY_STORAGE_PERCENTAGE and PRIMARY_STORAGE_MAX_FILL_PERCENTAGE), those nodes may fail to transfer segments from other nodes. The failure will be indicated by the error java.nio.file.AtomicMoveNotSupportedException with message "Invalid cross-device link".

      This does not corrupt data or cause data loss, but will prevent the cluster from being fully healthy, and could also prevent data from reaching adequate replication.

Improvement

  • User Interface

    • The tab label for the package's settings page has been updated from Installed to Manage, and the page title has been updated from Installed packages to Manage packages.

  • Automation and Triggers

    • Improved the delineation of the time zone for scheduled reports - reports now define the time zone as UTC in the Report generated at field.

      For more information, see Schedule PDF Reports.

    • The field retryable has been added to the internal log events repository humio-triggers-execution-info. When a scheduled search execution fails, the log event now indicates whether the failure is retryable or non-retryable. Errors that are considered transent and therefore re-tryable include timeouts, I/O errors, or HTTP 5xx responses, while non-retryable, permanent errors include invalid configurations, missing actions, or blocked queries.

      This field can be found on scheduled searches containing the field ExecutionFailed

    • When a live query alert is canceled due to excessive ingest delay, LogScale now waits 1 minute before restarting it. Previously, these queries were restarted immediately, which could worsen cluster load.

      The wait time is configurable per alert type using the following configuration variables:

    • LogScale no longer shows notifications for disabled triggers. Any existing notifications for disabled triggers will be deleted shortly after upgrading to this version. Additionally, when a trigger is deleted, any associated notification is now deleted immediately rather than waiting for a background job.

    • S3 Action uploads now log the version ID returned by S3 for both the event and metadata files. When the target S3 bucket has versioning enabled, the fields eventFileVersionId and metadataFileVersionId are included in the repository humio-triggers-execution-info.

  • Ingestion

    • A new lookup file infrastructure has been enabled, which now allows Lookup Files to run more efficiently with faster load time.

  • Queries

    • The dynamic configuration parameter, ReverseDnsConcurrentRequestsPerQuery has been added to control the maximum number of parallel DNS lookups per reverseDns() query. The default value is 1 (sequential, matching previous behavior). The effective maximum is bounded by ReverseDnsConcurrentRequests, with the default value set to 10.

      Increasing ReverseDnsConcurrentRequestsPerQuery improves single-query throughput at the cost of reducing throughput available to other concurrent reverseDns() queries, as all queries share the ReverseDnsConcurrentRequests pool. Self-hosted customers resolving many IPs in a single query can increase this value to improve single-query throughput.

    • A log line has been added to the query scheduler to record the CPU time spent processing the most expensive block of data in the most recent 10 second time interval.

      An example of the results of this operation might look like this:

      2026-03-25T14:45:49.445+0000 [query-normal-scheduler] INFO c.h.q.m.SegmentQueue 145 - Slowest block intervalMs=10000 queryID=IQ-QKqKIDGrXDnrs2N1PozMlYil slowestBlockCpuMs=6

      The format for the results is as follows:

      • The timestamp for when the log was generated

      • The name of the thread that the log is coming from

      • The log level

      • The class the log line is coming from

      • The vhost that generated the log

      Note

      Log formats are subject to change and may be adjusted at any time.

    • The experimental feature flag KeepSegmentHashFiles has been removed - query performance has been improved by caching hash filter files for frequently used bucketed segments, even in cases where queries only need hash filter files for search. This feature is now enabled by default.

    • The LogScale Regular Expression Engine V2 has been optimized to handle "zero-or-more" repetitions that occur at the start of regular expressions and after the opening of groups. Regexes that align with the following formats are now up to 10x faster for inputs of length 70, but may be even faster compared to before, as the input grows in size:

      • /(.*)foo/

      • /(.*foo)/

      • /(((.*)f)o)o/

      In benchmarking, most regexes fitting these formats were found to be up to 10 times faster, particularly as the input grows in length.

      Due to technical constraints, some regexes that have this format may experience a reduction in performance speed due to prioritization protocols, particularly those that repeat a small set of characters. In general, these regexes are still as fast or faster than before.

    • An optimization in the LogScale Regular Expression Engine V2 has been extended. This extension accounts for greedy repetitions of single character predicates at the beginning of a regex, where either a minimum, maximum, or both is specified.

      As a result, regexes of the following forms are now up to 10x faster than before:

      • /.+foo/

      • /\w{3,}bar/

    • Improved LogScale-generated metrics by propagating information regarding data reuse from subqueries located in the query state cache to the main query.

      This improvement will not be noticeable to the user except when viewing the metric query-static-cost-cache-hit in comparison to the metric query-static-cost-total. In this case, the two metrics will more accurately reflect the real use for queries that use defineTable().

      For more information, see defineTable(), The humio-metrics Repository, query-static-cost-cache-hit Metric, query-static-cost-total Metric.

    • Queries running in profiling mode using the explain:asTable() function have been optimized, reducing the system overhead of measuring profiling statistics. The accuracy of the reported step-by-step timeMs metric reported by explain:asTable() has also been improved.

      For more information, see explain:asTable().

    • When all nodes in the cluster are running version 1.233.0 or later, correlate queries automatically switch to a more memory-efficient internal representation for link sets. This also lowers the default memory limit per link set from 20MB to 1MB.

      If a custom value has been configured via the CorrelateLinkValuesMaxByteSize dynamic configuration option, it will be respected regardless of cluster version.

  • Fleet Management

    • The margin in the Fleet Management overview page has been reduced to allow for a larger table. Filter buttons have been resized to match the height of the search field.

  • Metrics and Monitoring

    • LogScale has stopped logging internal request logs for both the is-node-up and query worker submission endpoints on successful requests.

      To avoid loss of visibility, the following metrics have been added to keep track of query worker submissions:

      • internal-queryjobs-submission-timing

      • internal-queryjobs-submission-size

  • Auditing and Monitoring

    • Added the field acceptedPotentialDataLoss to the remove-host audit log entry. This addition indicates whether the administrator chose to override safeguards against data loss when submitting the host removal via the API.

      For more information, see Audit Logging.

    • The view ID and view name have been added to uploaded file audit log entries. This information is included only for files uploaded to a view. For shared replicable files, the audit log entries will not include the view ID or view name.

Recent Package Updates

The following LogScale packages have been updated within the last month.

  • Package Changes

    • fortinet/fortigate has been updated to v2.3.4.

      • Enhanced CEF parsing to handle optional angle brackets in syslog priority field

      • Improved Vendor.type assignment logic for numeric cat values to use subtype instead

      • Added catch-all case to prevent field dropping in event categorization

      • Enhanced wireless event categorization with dedicated network connection handling

      • Added comprehensive wireless action outcome mapping for success/failure determination

      • Improved observer.serial_number field mapping to include Vendor.sn field

      • Added message field mapping from Vendor.msg for all events

      • Moved message field assignment outside of alert-specific logic for broader coverage

      • Updated parser version to 5.2.0 and ECS version to 9.3.0

      For more information, see Package fortinet/fortigate Release Notes.

    • everpure/flashblade has been updated to v1.2.0.

      • Added support for GUI and CLI session logs (purity.guisession and purity.clisession)

      • Enhanced heartbeat message parsing for system monitoring

      • Improved source address handling with IP/domain classification

      • Updated ECS version to 9.3.0

      • Enhanced regex patterns for better alert message parsing

      • Added session authentication event categorization

      For more information, see Package everpure/flashblade Release Notes.

    • dell/isilon has been updated to v1.3.1.

      • Updated parser version to 1.2.1

      • Enhanced regex pattern for uid and sid field extraction to handle non-numeric values using [^;]* pattern instead of \d+

      • Added new test case for handling SID values with alphanumeric format (SID:S-1-22-1-0)

      • Improved parsing reliability for API audit logs with complex user identifiers

      For more information, see Package dell/isilon Release Notes.

    • zscaler/internet-access has been updated to v2.1.3.

      • Enhanced firewall event categorization with improved match syntax for better performance

      • Updated event.action matching logic to include "bypassed" actions as allowed events

      • Improved conditional logic structure using match syntax instead of case statements

      • Updated ECS version to 9.3.0 and CPS version to 1.2.0

      • Updated parser version to 4.0.3

      For more information, see Package zscaler/internet-access Release Notes.

    • cisco/firepower has been updated to v2.0.0.

      • Updated parser version to 5.0.0

      • Updated CPS version to 1.2.0

      • Updated ECS version to 9.3.0

      • Enhanced parsing for event codes 109201, 109207, 109210 with improved server address extraction and consistency with ASA format

      • Enhanced parsing for event code 113019 with additional vendor fields for group, session type, and network bytes calculation

      • Enhanced parsing for event codes 11300*, 11301* with improved server address, client NAT IP, and user extraction

      • Enhanced parsing for event codes 302013, 302015 with improved connection ID handling and username extraction from message end

      • Enhanced parsing for event code 302014 with corrected source/destination mapping based on connection initiator/target semantics

      • Enhanced parsing for event code 302016 with improved connection ID extraction and user closure reason parsing

      • Enhanced parsing for event code 302021 with event action extraction and network transport assignment

      • Enhanced parsing for event code 502103 with improved user privilege parsing and IAM categorization

      • Enhanced parsing for event codes 609001, 609002 with additional event action and destination address extraction

      • Enhanced parsing for event code 722051 with corrected field mapping for client NAT IP

      • Added support for event code 733100 with rate limiting and intrusion detection categorization

      • Added support for event code 746015 with DNS protocol parsing and question/answer extraction

      • Enhanced parsing for event code 746016 with improved DNS lookup failure parsing

      • Enhanced parsing for event codes 750001, 750002, 750006, 750007 with network configuration categorization

      • Added support for event code 750003 with network authentication failure categorization

      • Enhanced parsing for event code 751002 with improved authentication failure categorization and error message extraction

      • Added event.code field assignment from vendor mnemonic

      • Added event.reason field consistency logic to ensure availability across ASA and FTD events

      For more information, see Package cisco/firepower Release Notes.

    • aruba/clearpass has been updated to v1.4.1.

      • Added support for log4j format parsing with new regex pattern

      • Updated parser version to 3.0.1

      • Updated ECS version to 9.3.0 and CPS version to 1.2.0

      For more information, see Package aruba/clearpass Release Notes.

    • rubrik/security-cloud has been updated to v1.1.3.

      • Enhanced timestamp parsing to support additional precision formats

      • Updated parser version to 1.1.3

      • Updated ECS version to 9.3.0

      • Updated CPS version to 1.2.0

      For more information, see Package rubrik/security-cloud Release Notes.

    • cisco/ios has been updated to v1.10.0.

      • Added new regex pattern to handle logs with sequence numbers and timestamps in format: <priority>message_count: sequence: timestamp: %facility-severity-eventcode: message

      • Added support for multiline message fragments that start with multiple spaces and lack proper IOS facility headers

      • Enhanced timezone handling to respect data connector timezone selection over parser-defined timezone mappings

      • Fixed IST timezone timestamp parsing to support optional milliseconds format

      • Improved LOGOUT event parsing to handle optional source address in parentheses

      • Updated parser version to 2.10.0

      For more information, see Package cisco/ios Release Notes.

    • juniper/srx has been updated to v1.5.4.

      • Fixed timestamp parsing format for single-digit day values in BSD syslog format to handle optional space padding

      • Updated parser version to 3.0.3

      For more information, see Package juniper/srx Release Notes.

    • cisco/umbrella has been updated to v1.4.3.

      • Updated parser version to 3.0.3

      • Enhanced DLP logs parsing with improved URL handling using parseUri function

      • Added url.original field mapping for DLP traffic logs

      • Improved destination.domain field extraction for better URL parsing accuracy

      For more information, see Package cisco/umbrella Release Notes.

    • juniper/srx has been updated to v1.5.3.

      • Fixed timestamp parsing format for single-digit day values in BSD syslog format

      • Updated parser version to 3.0.2

      • Updated CPS version to 1.2.0

      For more information, see Package juniper/srx Release Notes.

    • everpure/flashblade has been updated to v1.2.1.

      • Updated vendor name from Pure Storage to Everpure across all package components

      • Updated manifest author information to reflect Everpure branding

      For more information, see Package everpure/flashblade Release Notes.

    • cisco/meraki has been updated to v2.0.2.

      • Refactored parser logic to use match expressions for improved readability and performance

      • Added support for anyconnect_vpn_session_manager event type with session ID and user extraction

      • Enhanced case statement structure for better maintainability

      • Improved pattern matching efficiency in event type determination

      For more information, see Package cisco/meraki Release Notes.

    • everpure/flasharray has been updated to v1.0.6.

      • Updated vendor name from Pure Storage to Everpure across all package components

      • Updated manifest author information to reflect Everpure branding

      For more information, see Package everpure/flasharray Release Notes.

    • cisco/ise has been updated to v2.0.7.

      • Improve consistency for log.level parsing

      • Add support for connection failure events

      • Updated parser version to 3.0.7

      For more information, see Package cisco/ise Release Notes.

    • cloudflare/zerotrust has been updated to v2.2.1.

      • Fixed WAF alert generation logic to trigger when severity >= 50 (previously <= 50)

      • Updated parser version to 4.2.1

      • Updated ECS version to 9.3.0

      • Updated CPS version to 1.2.0

      For more information, see Package cloudflare/zerotrust Release Notes.

    • fortinet/fortigate has been updated to v2.4.0.

      • Added FortiSwitch device detection based on devname prefix (FSW)

      • Added FortiSwitch-specific event subtypes: link, poe, spanning_tree, switch, switch_controller

      • Added FortiSwitch-specific field mappings for MAC address learned on switch port

      • Standardized event.module to "fortigate", observer.type to "firewall", and observer.product to "fortigate"

      • Updated parser version to 5.3.0

      For more information, see Package fortinet/fortigate Release Notes.

    • cisco/ios has been updated to v1.10.1.

      • Enhanced regex patterns to handle optional carriage return characters at end of log messages for improved parsing reliability

      For more information, see Package cisco/ios Release Notes.

    • f5networks/bigip has been updated to v3.1.1.

      • Updated ECS version to 9.3.0 and Parser version to 4.0.1

      • Enhanced HTTP request parsing for ASM events with improved regex extraction for request content

      • Fixed HTTP request body content extraction to properly parse content portion from request data

      • Added HTTP request MIME type field mapping from Content-Type header

      • Corrected HTTP request referrer field mapping to use proper vendor field

      • Improved authentication failure parsing with more specific regex pattern for user extraction

      • Fixed indentation and formatting issues in audit event processing section

      For more information, see Package f5networks/bigip Release Notes.