EA Collector 39.500

LogicMonitor has improved the reliability of Collector upgrade and downgrade process when package downloads are slow or stalled. The system now cancels stalled download requests more effectively, helping the upgrade process recover faster. When there is a new upgrade or downgrade request, the Collector starts downloading the newly requested package without being blocked by an earlier stalled download. This reduces repeated retry behavior, avoids problems caused by expired temporary download links, and helps upgrades and downgrades proceed more predictably and smoothly.

Currently, in the agent.conf settings, the lmlogs.syslog.useTimestampWhenCollectorReceivedLogs is set to true but on the LogSource page, for the Syslog log type, by default the Use received time instead of log timestamp switch is disabled. To bring Syslog LogSource in sync with the agent.conf flow, by default the Use received time instead of log timestamp switch is now enabled. As a result, Syslog received timestamp is used as log timestamp. You can disable the switch to use timestamp from the received log.

Secondly, LogicMonitor Collector has now stopped support for a redundant property logcollector.defines=wineventlog,scriptevent in the agent.conf settings. Instead, you can now set the existing properties logcollector.wineventlog.enable=true to enable Windows event log collection and logcollector.scriptevent.enable=true to enable Script event log collection.

In addition to the existing Secret Server method, LogicMonitor Collector now supports the Delinea Platform to log in to the Delinea portal. You can opt for any of the two methods.

For logging using the Delinea Platform, your user type must be a service user account, you must set an additional device property vault.meta.th.url.mode=platform, specify the Delinea Platform app URL https://<<companyname>>.delinea.app as the vault.meta.url and authenticate using your service username and service password.

On Windows Collector machines, in rare cases, when the Collector encountered issues such as dead tasks or low disk space conditions, the Collector restarts as part of normal recovery behavior. During this process, the agent terminates SBProxy.

Previously, in some scenarios, SBProxy exit was not always graceful which resulted in SBProxy crash events being reported in the Windows event logs. LogicMonitor Collector has now improved this behavior. SBProxy now exits cleanly when the agent terminates it during the recovery scenarios and when the recovery is complete, the Watchdog restarts it.

Fixed an issue in WinRM-based Windows event collection where events with multi-line message content caused subsequent events to be dropped. The parser now correctly processes XML fragments. This change ensures that all events are collected without loss.

Fixed an issue in Windows Event LogSource for Dynamic Group Regex method in Log Fields where the expected value of the log field was truncated after space.