Falcon LogScale 1.252.1 LTS (2026-09-10)

Version?Type?Release Date?Availability?End of SupportSecurity UpdatesUpgrades From?Downgrades To?Config. Changes?
1.252.1LTS2026-09-10

Cloud

On-Prem

2027-09-30Yes1.177.01.177.0No

Hide file download links

Show file download links

Hide file hashes

Show file hashes

These notes include entries from the following previous releases: 1.251.0, 1.250.0, 1.249.0, 1.248.0, 1.247.0

Bug fixes and updates.

Breaking Changes

The following items create a breaking change in the behavior, response or operation of this release.

  • Functions

    • LogScale LTS version 1.258 will include a breaking change to subquery semantics for the worldMap() and sankey() functions. Result fields will no longer be automatically detected, and results must be assigned to a specific field - magnitude for worldMap() and weight for sankey() respectively.

      This change avoids unpredictable behavior in sub-queries, and allows further development on related systems. The following is an example of a query that is impacted by this change:

      logscale
      worldMap(lat=lat,lon=lon,magnitude={ w_squared := w*w | sum(w_squared) | magnitude := math:sqrt(_sum) })

      Currently, the query will be interpreted as:

      logscale
      worldMap(lat=lat,lon=lon,magnitude={ w_squared := w*w | magnitude := sum(w_squared) })

      From version 1.258, the math:sqrt part of the query will no longer be discarded.

Advance Warning

The following items are due to change in a future release.

  • Installation and Deployment

    • We are decommissioning the the Nexus server used to host Java-based LogScale installation binaries, with a tentative decommission date of August 14, 2026. To download Java-based LogScale installers, please send a request to logscalesuccess@crowdstrike.com to obtain a username & API token, which are required to download from our new distribution platform.

  • Documentation

    • Our documentation homepage, functionality, and content will undergo a series of improvements before the end of August 2026. As the volume of content on the site has grown significantly, we recognize that finding the right information can be challenging. These changes are designed to improve navigation, make content easier to find, and provide clearer distinctions between content areas.

      Functionality and Navigation

      • New Default Homepage — Improved navigation and organization to help you find information more quickly. The existing legacy homepage will remain available.

      • Curated Content Pages — Topic-specific pages that provide key resources tailored to different areas of the documentation. Each page includes:

        • Search scoped to that specific content area

        • Highlights of new and recently updated pages

      • Guided Workflow Pages — Step-by-step, page-by-page guides to help you learn about specific areas of LogScale.

      • Bookmark Groups — Organize bookmarks into custom groups to create your own categorized link collections.

      • Page Watching and Notifications — Monitor pages and content for changes, so you're always aware of updates to the content you use most.

      • Custom Homepage — Set a Curated Content page as your homepage, so visiting library.humio.com takes you directly to your preferred content area.

      Content Improvements

      • New CrowdStrike Query Language (CQL) Manual — A standalone manual covering:

        • Query structure and execution context

        • Internal data representation

        • Datatypes used in queries and functions

        • Function types, input and output values, and related functions

        • Common query patterns organized by use case and challenge

        • Guides for translating SQL to CQL

      • New Getting Data Out Manual — Covers the different ways to extract information from LogScale, including APIs, the search interface, dashboards, and automation.

      • New Getting Data In Manual — Covers the methods, tools, and integrations available for ingesting data into LogScale.

      • New Administration Manuals — Separate, dedicated manuals for Self-Hosted and Cloud customers.

      We will provide updates as each improvement becomes available — we welcome your feedback as the changes roll out.

  • API

    • Starting in version 1.258, the queryjobs endpoint will always use pagination, even when no pagination arguments have been given. When no arguments are provided, the endpoint will return the maximum page size and an offset of 0. Unless the dynamic configuration parameter QueryResultRowCountLimit has been raised from its default value, this will initially be the entire result.

      All clients should begin transitioning to use the paginated polling method ahead of version 1.258.

Removed

Items that have been removed as of this release.

Storage

  • The feature flag NewFileTransferQueuing has been removed. The feature it controlled is now always enabled.

    The following metrics have been removed due to code changes rendering them obsolete:

    • bucket-storage-request-upload

    • handle-bucket-upload-tasks-latency

    • handle-bucket-download-tasks-latency

    • start-new-bucket-tasks-latency

    • bucket-transfer-manager-iteration-time

    • bucket-storage-download-requests-cap-size-hits

    The following metrics have been removed and replaced by other metrics:

    • bucket-storage-pending-work has been removed, and replaced by bucket-storage-currently-submitted-segment-uploads, which is labeled by whether the target bucket is the primary or secondary bucket.

    • bucket-storage-download-queue-free-slots has been removed and replaced by bucket-storage-download-free-slots.

    • bucket-storage-segment-downloads-in-progress has been removed and replaced by bucket-storage-in-progress-downloads.

GraphQL API

  • For the GraphQL datatype User, both the deprecated GraphQL field permissionsPage and the datatype UserPermissionsPage have been removed due to disuse. To obtain similar results, users should apply the permissions field instead.

    For more information, see User .

Configuration

  • The ability to configure the number of rows in a table via the environment variable NUMBER_OF_ROWS_IN_OWNER_HOSTS_TABLE has been removed, and replaced in favor of correlation with how segments are distributed across nodes. The default value for the number of rows is 10,000.

Metrics and Monitoring

  • The humio-metrics repository metric ingest-request-time-ms has been removed due to disuse.

Deprecation

Items that have been deprecated and may be removed in a future release.

  • The GraphQL field meta has been deprecated and now requires authentication. It will be completely removed in LogScale 1.304. To achieve similar results, use the loginInfo and clusterConfig fields instead.

    To temporarily opt out of the authentication requirement, the feature flag UnauthenticatedMeta can be enabled.

  • The userId parameter for the updateDashboardToken GraphQL mutation has been deprecated and will be removed in version 1.273.

  • rdns() has been deprecated and will be removed in version 1.249. Use reverseDns() as an alternative function.

Behavior Changes

Scripts or environment which make use of these tools should be checked and updated for the new configuration:

  • Automation and Triggers

    • Filter alert query validation has been made stricter, and is now mainly syntax-based. Dropping or reassigning @id and @ingesttimestamp is now rejected, even if values are restored later in the query.

  • Storage

    • With the introduction of table-based owner hosts in LogScale 1.240, and with bucket storage enabled, the assignment of segments for a query changed from looking at where the segments are currently stored to distributing randomly between the owners of the segments.

      For segments not present on any host, the old strategy would essentially pick one host deterministically and stick to that in the future, causing a behavior similar to having a replication factor of 1 for these segments.

      The new strategy would instead essentially enforce the replication factor on the segments. However, for over-committed clusters this has caused spikes in traffic and churning of the disk cache.

      The new behavior is now disabled by default, but can be re-introduced by enabling the UseWeightedOwnerHostsForBucketedSegments feature flag.

  • GraphQL API

    • After an organization is soft deleted using the removeOrganization mutation, you can now only call the following mutations on that organization:

      Previously, you could call any mutation on a soft-deleted organization.

  • Configuration

    • The rollout of the feature covered by the feature flag UseInMemorySegmentOwnerHosts has been reverted due to performance issues occurring in certain configurations.

      The following feature flags have been removed and the mechanisms they cover have been disabled:

      • UseInMemorySegmentOwnerHosts

      • EnableInMemorySegmentOwnerHostsFeatureJob

      • UseWeightedOwnerHostsForBucketedSegments

      When rollout restarts for this feature, a new feature flag will be used.

  • Ingestion

    • Externally supplied tag values for the field #humioAutoshard will now be dropped at ingest preparation. The tag is removed from any events where this is the case, and an error will be recorded on the affected event.

  • Functions

    • The hashRewrite() query function now only replaces the 10 first occurrences of the matching value in @rawstring. A warning is emitted if 10 replacements are reached and the matched string is still present in the @rawstring field.

      The hashRewrite() query function now does not perform any replacement in @rawstring if the string to be replaced contains fewer than two characters. A warning is emitted if the value contains too few characters.

Upgrades

Changes that may occur or be required during an upgrade.

  • Security

    • Upgraded FasterXML/Jackson to 2.21.4 to address CVEs.

    • Upgraded Netty to 4.2.15.Final to fix vulnerabilities. See Netty project for more information about Netty.

  • Other

    • Updated io.projectreactor to 2025.0.6.

New features and improvements

  • GraphQL API

    • Added a name field to the PackageInstallation GraphQL output type.

    • The GraphQL mutation searchDataDistribution has been added on a preview basis. This new mutation returns segment data distribution statistics for a repository or view within a time range.

      The query provides:

      • Time-bucketed segment counts

      • A per-datasource breakdown

      • Tag distribution with scan cost percentages

      • Separate entries for join() and defineTable() subqueries

      This is useful for understanding data layout and estimating query scan costs before running expensive searches.

  • Configuration

  • Queries

    • LogScale's query editor now provides auto-completion suggestions for known saved queries within the current view when entering $. Cross-view saved queries are currently not suggested.

      For more information, see Query Editor.

  • Fleet Management

    • The collector instance details dialog now displays whether a Log Collector instance supports manual or remote updates.

  • Packages

Fixed in this release

  • Security

    • The constraint that required email domains to be unique has been removed for Identify Provider (IDP) configurations on clusters that use URL subdomains. SAML no longer requires unique domains in Distributed Cluster (DC) configurations.

  • User Interface

    • Fixed an issue where a user's assets would not display in sandbox view if the user ID was removed from the URL.

    • An issue has been fixed that was causing Unicode-based control characters to be missing from the Event List.

  • Storage

    • Fixed an issue in bucket storage download code that could cause unnecessary segment downloads that were already present locally when those segments did not have auxiliary files associated with them.

    • Fixed an issue with Google Cloud Storage (GCS) bucketing and proxy settings, where GCS bucketing was using an HTTP proxy based only on the environment variable HTTP_PROXY_HOST when it should have also included the environment variable GCP_STORAGE_USE_HTTP_PROXY. This issue has now been resolved.

  • GraphQL API

    • The GraphQL endpoint analyzeQuery() has been updated to include a revised error recovery strategy that allows it to stop earlier when encountering an error. In cases of multiple errors, fewer error reports may be observed as a result. Behavior for successfully executed cases remains unaffected.

  • API

    • Fixed an issue where the update process for lookup files via the Lookup API /files endpoint would clear any labels added to the file. Labels, key columns, and watermark information are now correctly preserved when patching a file.

  • Ingestion

    • Fixed an issue where ingest feeds with a backlog would experience a slower catch up process than expected due to a failure to increase polling concurrency.

    • Fixed an issue where a parser error was causing field-operator expressions to be parsed incorrectly within filter contexts. These expressions were incorrectly handled in cases where they appeared parenthetically or when located on the left side of or/and expressions, such as code=~ /5../ or error=true.

  • Dashboards and Widgets

  • Queries

    • Fixed an issue that could lead to a node crash during query handover because of allocation of a too large string value.

    • Fixed an issue where recently created multi-cluster search queries waiting for dependencies would sometimes stall during handover at node restart. These queries are now handed over to a new node.

    • Fixed an issue where modifications to the @id field could cause queries to crash during sorting when the @timestamp field was not available. This was triggered by using the head() function after collecting multiple @id values into a single field using the collect() function. Events with modified @id values are now sorted after events with unmodified values.

    • Queries using defineTable() could be left hanging for a while after the query was completed or cancelled. This issue has now been fixed.

    • Fixed an issue where a rare race condition occurring during query hand-over could cause failure during rolling restarts for static queries with defineTable() dependencies.

    • An issue has been fixed where queries with large join() function subquery results could cause nodes to crash during query submission from the query coordinator to the worker node.

    • Fixed an issue where queries with large join() subquery results could cause the node to crash during query submission from the query coordinator to worker nodes.

  • Metrics and Monitoring

    • Fixed an issue where the log field percentageOfMappingTimeSpentThrottledDueToQueryPermits would sometimes return a value of NaN (Not a Number) due to a potential division by zero.

    • An issue with the query debug log fields userUtilizationPercentage and orgUtilizationPercentage has been fixed. These fields were showing incorrect values when multiple queries were running concurrently for a given user or organization.

Known Issues

  • Storage

    • For clusters using secondary storage where the primary storage on some nodes in the cluster may be getting filled (that is, the storage usage on the primary disk is halfway between PRIMARY_STORAGE_PERCENTAGE and PRIMARY_STORAGE_MAX_FILL_PERCENTAGE), those nodes may fail to transfer segments from other nodes. The failure will be indicated by the error java.nio.file.AtomicMoveNotSupportedException with message "Invalid cross-device link".

      This does not corrupt data or cause data loss, but will prevent the cluster from being fully healthy, and could also prevent data from reaching adequate replication.

Improvement

  • Security

    • Token-based request performance has been improved by caching computed permission assignments on a per-request basis instead of recomputing them with every permission check. Additional performance improvements have also been made for verification checks that confirm whether any kind of permissions exist on read-only token requests.

    • The creation of certain permission assignment sets has been optimized to avoid continual re-enlargement.

  • Installation and Deployment

    • Updated Wolfi base image for LogScale docker.

  • Storage

    • The field fileId has been added to bucket upload and download logs related to lookup files. This makes it easier to correlate log lines with relevant entities in the global database. The fields viewId and orgId have also been added to bucket download logs when handling lookup files.

    • The DELETE /api/v1/bucket-storage-target API has been updated to account for uploaded lookup files and baled uploaded lookup files.

      The following behaviors now apply:

      • If any uploaded lookup files exist, the deletion will be blocked.

      • If the deletion is forced by the user, the files will have their respective bucket references removed in the same manner as segments are currently handled. The files will still exist in Global Snapshot and on local disk.

  • API

    • The endpoint /api/v1/uploaded-files/unset-uploaded-file-bucketId has a new optional Boolean parameter, includeDeleted. This allows users to unset bucket IDs for files that are marked as deleted. The parameter is set to false by default, and is backwards compatible.

    • The status codes when unsetting a bucket on a nonexistent file entity have been updated for the endpoint /api/v1/uploaded-files/unset-uploaded-file-bucketId. The endpoint now returns the following codes:

      • 204 No Content - The bucket ID has been successfully unset.

      • 404 Not Found - The file does not exist on the host.

      • 404 Not Found - The file is deleted and the value of the parameter includeDeleted is false.

    • The GET /api/v1/bucket-storage-target API has been updated to return the count of bale lookup files using the field baleLookupFilesUsingBucket for each bucket entity.

  • Configuration

    • The size limit on LogScale stdout logs in the default log configuration has been increased from 16KB to 512KB.

  • Ingestion

    • The status of MaxMind databases has been added to the ingest status endpoint as an advisory precondition.

    • JSON files used as lookup files that do not adhere to structural requirements are now rejected during the upload process. JSON files are now required to be in one of two formats:

      • An object whose values are all objects (e.g. { "key1": { "col1": "val1" }, "key2": { "col2": "val2" } })

      • A non-empty array of objects (e.g. [ { "col1": "val1" }, { "col2": "val2" } ])

      Previously, JSON files with unsupported structures would result in an empty lookup file, with the contents silently discarded.

    • In order to improve efficiency, the process of writing lookup files and table structures to CSV has been adjusted to serialize data in increments of 64 MB. This allows the system to retain only a portion of serialized data in memory at any one time.

  • Queries

    • Ensured that MaxConcurrentQueriesOnWorker is fully respected by the query scheduler.

      Previously the limit could be breached (to an arbitrary value) if queries were submitted sufficiently close together.

    • Improvements have been made to Language Server Protocol (LSP) completion suggestions, reducing the number of incorrect suggestions provided in certain contexts. Specifically, improvements have been made when providing suggestions inside array function arguments.

    • A limit has been introduced for the number of saved query expansions allowed during query submission. Queries that attempt to expand more saved queries than the configured limit will be rejected.

    • To make cluster upgrades less disruptive, the query state cache can now be reused when a cluster gets upgraded.

  • Fleet Management

    • A toggle has been added to the Fleet Insights page to group similar errors by replacing IP addresses with addr and UUIDs with uuid. This reduces clutter from many unique but similar error messages. The toggle is enabled by default.

    • The Fleet Management configuration editor now validates the collector configuration YAML before publishing. If a configuration contains invalid YAML, publishing and testing are blocked and an error is shown.

      Note

      The configuration editor only validates YAML syntax.

    • Multiple improvements have been made to the Fleet Management groups dialog:

      • Column selection has been introduced for the collectors table.

      • OS and Collector ID columns have been added to the collectors table.

      • The non-queryable platform field has been removed from the help text.

  • Metrics and Monitoring

    • Query cost metrics have been extended to include the new category resultPostProcess, which is now included in the total query cost.

      As a result, the total reported cost will be negligibly higher compared to previous versions.

    • Non-sensitive logging for thread groups has now been extended to include additional Linux Input/Output (I/O) metrics.

      The following page faults from /proc/pid/stat are now included:

      • Minor Fault - minflt

      • Major Fault - majflt

      All I/O counters from /proc/pid/io are now included:

      • Read Characters - rchar

      • Wide Characters - wchar

      • Read System Calls - syscr

      • Write System Calls - syscw

      • Number of Bytes Read from Physical Storage - read_bytes

      • Number of Bytes Sent to Storage Layer - write_bytes

      • Number of Canceled Bytes Originally Marked for Disk Storage - cancelled_write_bytes

      They are logged per thread group as existing metrics.

    • Enhanced the accuracy of the queryUtilizationPercentage, userUtilizationPercentage and orgUtilizationPercentage metrics that are logged by workers for queries.

      Removed the utilisationPercentage metric that was logged when a query ended.

  • Auditing and Monitoring

    • Customer IDs (CIDs) have been added to log and metric output, making it easier to correlate log lines and metrics with a specific customer. The CID is included wherever the organization is already identified (typically alongside the existing orgId field), and is only present when the organization has a CID set - organizations without one are unaffected.

      The cid field has been added to:

      • Audit logs - All audit actors that carry organization information, such as organization users, ephemeral users, log collectors, and various API token actors.

      • Activity and system logs - System log line and per-repo/per-tag usage summary log lines.

      • Usage measurements - A cid field has been added on measurement events.

      • Log Collector metrics - On metrics ingested from log collectors via Fleet Management, a cid tag and a new orgId tag have been added.

      For audit logs specifically, optional fields with no value are now omitted entirely instead of being serialized as "field":null. This affects the cid field and existing optional fields such as prefilter, userId, and for the humio-metrics type SystemActor specifically, organizationId. Anything consuming these audit fields should treat a missing field as a null value.

    • Query origin metadata has been added to audit logs. Each query now includes the following fields:

      • origin - the page that initiated the query (e.g. search-page or dashboard).

      • area - the specific UI area, if applicable (e.g. fields-panel or widget-id-1234).

      • dashboard-id - the dashboard ID, for dashboard pages.

      These fields are sent via extraLogFields and are available in the humio-audit repository as customKey.origin, customKey.origin.area, and customKey.origin.dashboard-id respectively.

      Additionally, the Dashboards page and EntitiesSearch API now support filtering dashboards by ID, allowing users to locate a dashboard directly from the customKey.origin.dashboard-id audit field. Unlike other dashboard filters, this matches exact IDs rather than performing a substring search.

  • Other

    • The threads used for query mapping on worker nodes have been renamed. Previously, the naming convention was query-(vhost), where (vhost) was the virtual host of the node. The new naming convention is now (prefix)query-mapper, where (prefix) is the value of HUMIO_THREADNAME_PREFIX.

Recent Package Updates

The following LogScale packages have been updated within the last month.

  • Package Changes

    • dell/isilon has been updated to v1.3.1.

      • Updated parser version to 1.2.1

      • Enhanced regex pattern for uid and sid field extraction to handle non-numeric values using [^;]* pattern instead of \d+

      • Added new test case for handling SID values with alphanumeric format (SID:S-1-22-1-0)

      • Improved parsing reliability for API audit logs with complex user identifiers

      For more information, see Package dell/isilon Release Notes.

    • zscaler/internet-access has been updated to v2.1.3.

      • Enhanced firewall event categorization with improved match syntax for better performance

      • Updated event.action matching logic to include "bypassed" actions as allowed events

      • Improved conditional logic structure using match syntax instead of case statements

      • Updated ECS version to 9.3.0 and CPS version to 1.2.0

      • Updated parser version to 4.0.3

      For more information, see Package zscaler/internet-access Release Notes.

    • dell/isilon has been updated to v1.3.0.

      • Updated CPS version to 1.2.0

      • Updated parser version to 1.2.0

      • Added support for Dell Isilon API audit logs parsing

      • Enhanced regex pattern matching to handle both SMB protocol logs and API request logs

      • Added HTTP request method and response status code field mappings

      • Added JSON parsing for API request arguments

      • Enhanced user ID mapping with coalesce function for multiple source fields

      • Enhanced client IP mapping with coalesce function for multiple source fields

      • Added event outcome determination based on HTTP response status codes

      For more information, see Package dell/isilon Release Notes.

    • cisco/meraki has been updated to v2.0.1.

      • Updated ECS version to 9.3.0 and CPS version to 1.2.0

      • Added support for anyconnect_vpn_auth_success event type with IP and port extraction

      • Improved kvParse operation for type= format logs with explicit separator parameter

      • Reordered event type parsing logic for better pattern matching efficiency

      For more information, see Package cisco/meraki Release Notes.

    • everpure/flasharray has been updated to v1.0.5.

      • Added new regex pattern for enhanced audit log parsing with support for command structure extraction

      • Enhanced observer.hostname field mapping to use coalesce function for better field population

      • Added event.id field mapping from Vendor.MessageID for improved event tracking

      • Updated parser version to 2.0.4

      • Updated CPS version to 1.2.0

      • Updated ECS version to 9.3.0

      For more information, see Package everpure/flasharray Release Notes.

    • aruba/clearpass has been updated to v1.4.1.

      • Added support for log4j format parsing with new regex pattern

      • Updated parser version to 3.0.1

      • Updated ECS version to 9.3.0 and CPS version to 1.2.0

      For more information, see Package aruba/clearpass Release Notes.

    • rubrik/security-cloud has been updated to v1.1.3.

      • Enhanced timestamp parsing to support additional precision formats

      • Updated parser version to 1.1.3

      • Updated ECS version to 9.3.0

      • Updated CPS version to 1.2.0

      For more information, see Package rubrik/security-cloud Release Notes.

    • darktrace/detect has been updated to v2.1.0.

      • Updated CPS version to 1.2.0

      • Updated parser version to 3.1.0

      • Updated ECS version to 9.3.0

      • Enhanced AI Analyst event processing to include "informational" category for alert generation

      • Improved model breach event processing to use Vendor.model.category instead of Vendor.category for alert determination

      • Enhanced severity mapping for model breach events with improved priority-based scoring (1-5 scale)

      • Fixed event.risk_score assignment to occur before conditional processing

      • Improved code formatting and conditional logic structure

      • Enhanced regex patterns for email attachment hash processing

      For more information, see Package darktrace/detect Release Notes.

    • everpure/flashblade has been updated to v1.2.1.

      • Updated vendor name from Pure Storage to Everpure across all package components

      • Updated manifest author information to reflect Everpure branding

      For more information, see Package everpure/flashblade Release Notes.

    • cisco/meraki has been updated to v2.0.2.

      • Refactored parser logic to use match expressions for improved readability and performance

      • Added support for anyconnect_vpn_session_manager event type with session ID and user extraction

      • Enhanced case statement structure for better maintainability

      • Improved pattern matching efficiency in event type determination

      For more information, see Package cisco/meraki Release Notes.

    • cisco/ise has been updated to v2.0.6.

      • Enhanced network field mapping with improved source, destination, client, server, and host field assignments

      • Restructured IP address and domain handling for better network topology representation

      • Added host.ip[] and host.mac[] arrays for endpoint authentication tracking

      • Improved MAC address formatting with standardized uppercase and hyphen format

      • Updated ECS version to 9.3.0

      • Updated parser version to 3.0.6

      • Updated CPS version to 1.2.0

      • Enhanced user.email field with lowercase normalization

      • Fixed event.type assignment for profiler event code 80003 from "error" to "info"

      • Minor code formatting improvements and indentation fixes

      For more information, see Package cisco/ise Release Notes.

    • everpure/flasharray has been updated to v1.0.6.

      • Updated vendor name from Pure Storage to Everpure across all package components

      • Updated manifest author information to reflect Everpure branding

      For more information, see Package everpure/flasharray Release Notes.

    • cisco/ise has been updated to v2.0.7.

      • Improve consistency for log.level parsing

      • Add support for connection failure events

      • Updated parser version to 3.0.7

      For more information, see Package cisco/ise Release Notes.

    • cloudflare/zerotrust has been updated to v2.2.1.

      • Fixed WAF alert generation logic to trigger when severity >= 50 (previously <= 50)

      • Updated parser version to 4.2.1

      • Updated ECS version to 9.3.0

      • Updated CPS version to 1.2.0

      For more information, see Package cloudflare/zerotrust Release Notes.

    • cisco/ios has been updated to v1.10.1.

      • Enhanced regex patterns to handle optional carriage return characters at end of log messages for improved parsing reliability

      For more information, see Package cisco/ios Release Notes.