Humio Server 1.38.1 LTS (2022-04-27)

Version?Type?Release Date?Availability?End of SupportSecurity UpdatesUpgrades From?Downgrades To?Config. Changes?
1.38.1LTS2022-04-27

Cloud

On-Prem

2023-03-31No1.26.01.26.0No

Hide file download links

Show file download links

Hide file hashes

Show file hashes

These notes include entries from the following previous releases: 1.38.0, 1.38.0, 1.38.0

Updated dependencies with security fixes and weakness.

New features and improvements

  • Falcon Data Replicator

    • Improved performance of FDRJob.

      Imported from 1.38.0

  • User Interface

    • Minor UX improvements (ie. accessibility) on the queries panel.

      Imported from 1.38.0

    • On the time, bar and pie charts you can hold the ALT/OPTION key to display long legend titles.

      Imported from 1.38.0

    • When changing focus inside a dialog with the keyboard, the focus will no longer move outside the dialog while it is open.

      Imported from 1.38.0

    • Added a quick-fix for unknown escape sequences in the search field.

      Imported from 1.38.0

    • When using the table visualisation in dark mode, empty table cells are now clearly discernible.

      Imported from 1.38.0

    • First row entry in the statistics table on the repo page is now a table header and added hidden content to the empty table header in the new view page.

      Imported from 1.38.0

    • Added a warning for unknown escape sequences in the search field.

      Imported from 1.38.0

    • Hover information in the search field is shown despite an overlapping warning.

      Imported from 1.38.0

    • The search page now has focus states on the Language Syntax, Event List Widget and Save As buttons.

      Imported from 1.38.0

    • Reworked the hover message layout and changed the hover information on text (in the search field).

      Imported from 1.38.0

    • Better accessibility for queries panel. You can now tab to focus individual queries, and open a details panel. From here you can also access all actions in the details panel by tabbing.

      Imported from 1.38.0

    • Added a quick-fix to convert non-ASCII quotes to ASCII quotes in the search field.

      Imported from 1.38.0

    • Hover over parameter names and arguments in the search field now includes the default value.

      Imported from 1.38.0

    • The Cluster Nodes table has been redesigned to allow for easier overview and copying the version-number.

      Imported from 1.38.0

    • Fixed an issue where queries with tail() would behave in an unexpected manner when an event is focused.

      Imported from 1.38.0

    • The bar and pie charts now support holding the SHIFT key to display unformatted numeric values.

      Imported from 1.38.0

    • Visually hidden clipboard field is now hidden for assistive technologies/keyboard users.

      Imported from 1.38.0

    • Fixed a bug where the Package Marketplace would redirect to unsupported package versions on older Humio instances.

      Imported from 1.38.0

    • Pop-ups and drop-downs will now close automatically when focus leaves them.

      Imported from 1.38.0

  • GraphQL API

    • Fixed a bug in the response from calling the installPackageFromZip() GraphQL mutation. Previously, the response type exposed a deprecated clientmutationid that could not be selected. Also now if form fields are missing they are properly reported in the response.

      Imported from 1.38.0

    • The PERMISSION_MODEL_MODE config option has been removed. All graphql related schema has also been removed.

      Imported from 1.38.0

    • Deprecates the ReadContents view action, in favor of ReadEvents. This also means ReadEvents has been undeprecated, as we have slightly changed how we consider read rights, and want the action names to match this.

      Imported from 1.38.0

  • Configuration

    • When Kafka topic configuration is managed by Humio (default true) set max.message.bytes on the topics to the value of Config TOPIC_MAX_MESSAGE_BYTES, default is 8388608 (8 MB). Minimum value is 2 MB.

      Imported from 1.38.0

    • Added new configuration NATIVE_FADVICE_SUPPORT (default true) to allow turning off the use of fadvice internally.

      Imported from 1.38.0

    • Added config RDNS_DEFAULT_SERVER for specifying what DNS server is the default for the rdns query function.

      Imported from 1.38.0

    • Added new settings for how uploads to bucket storage are validated. In the case that validation with etags are not available, content length can be used instead.

      Imported from 1.38.0

    • Reduce default value of INGESTQUEUE_COMPRESSION_LEVEL, the ingest queue compression level from 1 to 0. This reduces time spent compressing before inserting into the ingest queue by roughly 4x at the expense of a 10-20% increase in size required in Kafka for the ingest queue topic.

      Imported from 1.38.0

    • Added config IP_FILTER_RDNS for specifying what IP addresses can be queried using the rdns query function.

      Imported from 1.38.0

    • The Property inter.broker.protocol.version in kafka.properties now defaults to 2.4 if not specified. Users upgrading Kafka can either set inter.broker.protocol.version manually in kafka.properties, or pass DEFAULT_INTER_BROKER_PROTOCOL_VERSION as an environment variable to Docker when launching the container. Please follow Kafka's upgrade guidelines when upgrading a Kafka cluster to avoid data loss https://kafka.apache.org/documentation/.

      Imported from 1.38.0

    • Added config IP_FILTER_RDNS_SERVER for specifying what DNS servers can be allowed in the rdns() query function.

      Imported from 1.38.0

    • Added the config CORS_ALLOWED_ORIGINS a comma separated list for CORS allowed origins, default allows all origins.

      Imported from 1.38.0

    • Fixed a bug where TLS_KEYSTORE_TYPE and TLS_TRUSTSTORE_TYPE would only recognize lower-case values.

      Imported from 1.38.0

    • Added new configuration NATIVE_FALLOCATE_SUPPORT (default true) to allow turning off the use of fallocate and ftruncate internally.

      Imported from 1.38.0

  • Functions

    • Fixed an issue where tail() could produce results inconsistent with other query functions, when used in a live query.

      Imported from 1.38.0

  • Other

    • Fixed an issue with epoch and offsets not always being stripped from segments.

      Imported from 1.38.0

    • Ensure only a cluster leader that still holds cluster leadership can force digesters to release partition leadership. This could cause spurious reboots in clusters where leadership was under contention.

      Imported from 1.38.0

    • For HTTP Event Collector (HEC) the input field sourcetype is now also stored in @sourcetype.

      Imported from 1.38.0

    • Published new versions of the Humio Kafka Docker containers for Kafka 3.1.0.

      Imported from 1.38.0

    • Added a new system-level permission that allows changing usernames of users.

      Imported from 1.38.0

    • Fixed a bug where the Add Column button on the Fields panel would do nothing

      Imported from 1.38.0

    • During identity provider configuration, it's possible to fetch SAML configuration from an endpoint.

      Imported from 1.38.0

    • Fixed several issues where users could add invalid query filters via the Add filter context button after selecting text in the Event List.

      Imported from 1.38.0

    • Improved off-heap memory handling. Humio now typically uses only 1 GB on systems with 32 vCPUs, down from typically 16 GB. This leaves more memory for other processes and page cache for data.

      Imported from 1.38.0

    • Fixed a compatibility issue with LogStash 7.16+ and 8.0.0 when using the Elasticsearch output plugin.

      Imported from 1.38.0

    • Improved the performance of deletes from global.

      Imported from 1.38.0

    • Do not run the Global snapshot consistency check on stateless ingest nodes.

      Imported from 1.38.0

    • Fixed an issue where users could be shown in-development feature on the client when running a local installation of Humio.

      Imported from 1.38.0

    • Fixed a bug in the Sankey chart such that it now updates on updated query results.

      Imported from 1.38.0

    • Added tombstoning to uploaded files, which helps with avoiding data loss.

      Imported from 1.38.0

    • Allow cluster managers access to settings for personal sandboxes and to block and kill queries in them.

      Imported from 1.38.0

    • Fixed an issue where top(max) could throw an exception when given values large enough to be represented as positive infinity.

      Imported from 1.38.0

    • Fixed an issue where live queries would sometimes double-count parts of the historic data.

      Imported from 1.38.0

    • Warn at startup if CORES > AvailableProcessorCount as seen by the JVM.

      Imported from 1.38.0

    • Fixed an issue where queries of the form #someTagField != someValue ... would sometimes produce incorrect results.

      Imported from 1.38.0

    • Fixed a bug where providing a bad view/repository name when blocking queries would block the query in all views and repositories.

      Imported from 1.38.0

    • Fixed a compatibility issue with FileBeat 8.0.0.

      Imported from 1.38.0

    • Fixed an ingest bug where under some circumstances we would reverse the order of events in a batch.

      Imported from 1.38.0

    • During Digest startup, abort fetching segments from other nodes if the assigned partition set changes while fetching.

      Imported from 1.38.0

    • Fixed an issue where negated functions could lose their negation.

      Imported from 1.38.0

    • Fixed an issue where percentile() would crash on inputs larger than ~1.76e308.

      Imported from 1.38.0

    • Previously a package could be updated with another package with the same name and version, but with different content. This is no longer allowed, and any attempt do so will be rejected and fail.

      Imported from 1.38.0

    • The Kafka client has been upgraded to 3.1.0 from 2.8.1. 3.1.0 enables the idempotent producer by default, which implies acks=all. Clusters that set acknowledgements to a different number via EXTRA_KAFKA_CONFIGS_FILE should update their config to also specify enable.idempotence=false.

      Imported from 1.38.0

    • LSP warnings don't crash queries any more.

      Imported from 1.38.0

    • Ensure a digester can only acquire or release partition leadership if no other digester has leadership of that partition. This could cause spurious reboots if digester leadership became contended.

      Imported from 1.38.0

Fixed in this release

  • Summary

    • Updated java script dependencies to fix vulnerabilities.

    • Updated dependencies to Jackson to fix a vulnerability.

  • Other

    • Use latest version of Java 1.13 on Docker image.

    • Use latest version of Alpine on Docker image.