Collector Versions

• Upgraded log4j to version 2.17.1 to mitigate the log4j vulnerabilities.

• Upgraded log4j to version 2.17 to mitigate the log4j vulnerabilities.

• Upgraded log4j to version 2.16 to mitigate the Log4shell vulnerabilities.

• Upgraded log4j to version 2.16 to mitigate the Log4shell vulnerabilities.

• Includes all features and fixes from the EA Collector 30.xxx versions
• Updated Java to Amazon Corretto 11.0.13.8.

• Certified the Collector to run on RHEL OpenShift.
• Added TCP support for Syslog log collection.
• Added performance enhancements to the OpenMetrics Collector.

• Fixed an issue with the commons-codec library that was causing issues with updated collectors.
• Fixed issue with MongoDB driver dependencies. It is now properly upgraded to version 4.1.0

• Added Beta Support for the new Thycotic Secret Server as part of the Credential Vault Integration.
• Added the functionality to change the Collector Size setting during installation.

• Added support for High Security mode (HSM). Users can choose to install in HSM or Orchestration Compatibility Mode (OCM). The default is OCM.
• Added functionality to override openmetrics.url property with openmetrics.host or system.hostname properties when the URL isn’t provided.

• Added support for new OpenMetrics collection.
• Added support for Windows Events Logs and Kubernetes Events collection and forwarding to LM Logs.
• Added JMX metrics for monitoring the CyberArk AAM Credential Vault integration.

• Fixes the known issue present in versions 29.101 through 29.105 that was resulting in resources with heartbeats to be incorrectly marked as dead/down.
• Updated to no longer require changes to /etc/sudoers for non-root installation.
• JMX metrics added for LM Logs.

• Adds support for parsing RFC 3164 and RFC 5424 formatted log events.
• Introduces several new properties for tuning Web Checks.

• Support for forwarding syslog to LM Logs. See Collecting and Forwarding Syslog Logs.
• Upgraded Amazon Java Corretto to 11.0.9.11.1 (October 2020 quarterly update).
• Support for the Suppress duplicate EventIDs even when messages differ option has been added.

• Upgraded the JRE to Amazon Corretto 11.0.8.10.1

• Adjusted the output text width of Collector debug information, making Java exception text easier to read.
• Removed several Java libraries from the Collector.

• Upgraded the JDK to Amazon Corretto 11.0.8.10.1.
• NetScan Groovy scripts are now run in the SSE.
• NBAR slots support for Direction, IPv6, Application.

• Introduces XL and XXL size collectors for 16 and 32 GiB of RAM.
• Introduces the Collector Script Cache to allow caching of things like session tokens between collection intervals, without dumping things on the filesystem.
• Added scripts to allow the migration of a Collector running as root or Administrator to a non-root or non-Administrator user.
• TinyRADIUS Java Library is now included. LogicModules that utilize these to test RADIUS login will be available in a future release.

• Added SHA2 support for SNMPv3
• Added SSHJ library as an option for Expect. This includes more ciphers, algorithms, and key exchanges, including the 4096 bit Diffie-Hellman group
• Updated MariaDB driver to mariadb-java-client-2.5.4.jar
• Improved logging for remote sessions

• Fixed issue in the Linux installer that was preventing the Collector from starting when installed as non-root on some machines

• PropertySource support for token replacement in PowerShell scripts
• Support for NTLMv2 authentication via the wmi.authType property
• More insightful error messages and diagnosis when using the Poll Now functionality
• Remote Session support via Collectors configured to use proxies
• Improved metrics for SSE and Collector performance monitoring
• Collector logging cleanup
• Topology mapping support

• Accurate parsing of Cisco syslog messages lacking a host for Syslog EventSources
• SSL validation issue fix that was preventing successful Groovy script execution

• Upgraded the MS SQL jar to mssql-jdbc-7.4.1.jre11.jar
• Improved memory usage on the syslog Collector
• Added a log event for when the SSE fails to start
• Internal improvements to the Collector reporting mechanism

• Fixed message parsing issue that was preventing the ##MESSAGE## token from rendering appropriate contents when a Windows event was generated

• Updated the JDK to Amazon Corretto 11.0.5.10.1 (October 2019 Critical Patch Update).

Fixes:

• Fixed NetFlow aggregation edge case with invalid port “0” would cause display issues in the Traffic tab.
• Fixed issue introduced in 28.003 that would break Batchscript collection if the instance identifier contained a “.”
• Fixed issue that would cause Ping check to errantly return status 24 in edge cases.

• Fixed issue introduced in 28.003 that would break Batchscript collection if the instance identifier contained a “.”

• Improved performance for Batchscript DataSources with very large numbers of instances.

Fixes:

• Fixed issue that would cause Ping check to errantly return status 24 in edge cases.
  • Backported from EA 28.500

• Updated the Corretto JRE to 11.0.4

• Fixed a bug that would cause JDBC Active Discovery to ignore the “Port # List” field.

• Fixed issue with watchdog that would prevent the collector configuration from being edited in the UI
• NOTE: If you’re upgrading from 28.600, the watchdog issue above will prevent a normal upgrade. There are two options to workaround the watchdog bug to update to 28.601:
  • Uninstall the collector from its host, download collector 28.601 from the portal (you don’t need to delete or recreate the collector object in LogicMonitor) and install it on the host.
  • Open the collector debug window and run the !restart command to restart the collector. This will temporarily fix the environment (until the next automated collector credential rotation) and allow you to upgrade via the portal.
    • Restarting the collector via the drop-down UI menu won’t work for the workaround, it must be the debug command

• Fixed issue with Collector signing that could:
  • Cause false positives from anti-virus software
  • Block collection and reporting tasks

• Fixed issue with Collector signing that could:
  • Cause false positives from anti-virus software
  • Block collection and reporting tasks

• Collector installer now uses Bash and interfaces with systemd. If you download 28.500 on v120 it will still use Perl.
• !logsurf debug command will now show details for Test Script.
• PIDs are now logged for troubleshooting external scripts.

Fixes:

• Fixed bug that broke SNMP collection when two resources have the same IP address and different host names.
• Avoid potential false No Data reported for Ping data collection when restarting Collector.
• Fixed issue that would cause some NetFlow v9 data to be discarded in some circumstances.
• Fixed issue that would cause Ping check to errantly return status 24 in edge cases.
• Fixed a memory leak in the syslog collector.
• Fixed bug that would cause JDBC collection to fail if special characters were in the URL.

• Added support for Test EventSource (SNMP trap, syslog, logfile) functionality
• Collector now runs on Amazon’s Corretto JDK 11
  • Notes:
    • With this change, we’ve dropped support for 32-bit operating systems
    • At least initially, this will incur a roughly 10% increase in CPU and memory usage. We’re working to reduce this in future versions.
• !logsurf debug command now provides additional log context from sbproxy.log (for WMI, Perfmon, and Ping tasks)
• Improved PropertySource scheduling to avoid CPU spikes
• The installer on Windows now confirms a successful install to avoid silent failure
• Improved NetFlow performance by removing extraneous logging
• Upgraded AWS SDK from 1.11.431 to 1.11.548

Fixes:

• Fixed !tplist “STATUS” field that would show OK despite there being an error

• Better monitoring of overall memory and CPU usage via a new Collector DataSource.
• Reduce collector memory usage for Active Discovery history.
• Linux collector will create a non-privileged logicmonitor user to run the collector when non-root is selected.
• Support for running system’s snmpwalk and snmpget commands (useSystem=true)
• Reduced SSE memory usage for Internal Web Checks
• Improved WMI error handling logic to avoid gaps and return the real error code in more cases
• Test Active Discovery for SNMP now returns diagnosis commands for both getNext and getBulk
• Improve JMX data collection logic to avoid potential data gaps when invalid connections were errantly cached
• Improved the uninstaller to completely remove the Collector in some scenarios where it was only partially uninstalled

Fixes:

• Fixed potential memory leak with the ESX collector
• Fixed an issue where the Windows Collector device name was shown incorrectly as “Unknown”
• Fixed issue where syslog collector used excessive memory
• Fixed the error that created a useless folder in the install directory

• Reduced memory usage for PropertySources
• CPU usage optimizations
• Improved instance names on SSE Datasources
• Improved NetFlow diagnosis messaging
• Improved Windows EventLog query time range processing to avoid fails queries
• Changed pdh.auto.switch.to.native.enable to default to true. Also fixed an issue where Perfmon collection would fail when pdh.datacache.enableand pdh.auto.switch.to.native.enable were both set to true
• JMX collection now supports the special character “:” in MBeans

• Fixed batchscript collection caching behavior that would cause some instances with duplicate wildvalues to report No Data
• Fixed password exposure issue with Poll Now Diagnosis for WMI
• Fixed issue where NetFlow would record corrupt data instead of discarding it
• Fixed an issue where JobMonitors would alert unexpectedly due to slight clock skew. If the reported time of the job (from the wrapper script) is more than a minute different from Santaba time, we’ll use Santaba time
• Fixed a condition that could potentially hang the Watchdog and prevent Collector upgrades

• Fixed batchscript collection caching behavior that would cause some instances with duplicate wildvalues to report No Data.
• Fixed password exposure issue with Poll Now Diagnosis for WMI.

• Fixed issue where JDBC AD and Collection would fail if the domain name contains “-“.
• Fixed memory leak issue with Groovy tasks.

Improvements:

• The collector can now run without administrative or root privileges on both Windows and Linux.
  • Administrator/root privileges are still needed for the initial installation.
• Syslog performance has been improved.
• Modifications to the JRE keystore are now kept during collector upgrade.

Fixes:

• Fixed InstallShield Wizard progress bar which didn’t fill, causing unnecessary uncertainty about the process.
• NetScan will not use ARP to scan hosts outside of the same subnet. This lead to incorrect device types being reported.
• Fixed a possible memory leak when using SNMPv3.
• Fixed issue where Ping task would non report data if it timed out.
• Fixed issue where JDBC AD and Collection would fail if the domain name contains “-“.
• Fixed memory leak issue with Groovy tasks.

In comparison to GD 27.001, highlights of this version include:

• Property Sources now support token replacement inside Powershell Scripts 
• Added support for NTLMv2 authentication using wmi.authType
• More insightful Poll Now error messages and diagnosis
• Remote Sessions are now supported through a collector configured to use a proxy
• Improved metrics for SSE and Collector performance monitoring
• Syslog EventSources now correctly parse Cisco syslog messages lacking a host
• Cleaned up collector logging
• Fixed an issue where SSL validation prevented Groovy scripts from running successfully

For more detailed information on what’s included, see individual EA release notes (links above).

• Improve Windows Event Log performance in some scenarios
• Improve AD task duplication logic. Previously, this could result in delayed AD results, which would make AD appear to be broken.
• Improved AD memory usage
• Reduced CPU usage for SNMP v3 collection
• Added hostactive column to !tlist output. When “true”, successful tasks will contribute to the “heartbeat” (see HostStatus DataSource) that signals that the device is alive (or dead in its absence). When “false”, it means the tasks success has no impact on the heartbeat or the collector’s up/down status.
• Avoid false host down alerts when sbproxy is unexpectedly down.

• Improve Windows Event Log performance in some scenarios
• Improve AD task duplication logic. Previously, this could result in delayed AD results, which would make AD appear to be broken.
• Improved AD memory usage
• Reduced CPU usage for SNMP v3 collection
• Added hostactive column to !tlist output. When “true”, successful tasks will contribute to the “heartbeat” (see HostStatus DataSource) that signals that the device is alive (or dead in its absence). When “false”, it means the tasks success has no impact on the heartbeat or the collector’s up/down status.
• Avoid false host down alerts when sbproxy is unexpectedly down.

• Improved SNMP Poll Now diagnosis messages.
• Improved Poll Now error messages when running external/uploaded scripts.
• During upgrade, collector will report any processes it can’t kill that it must kill to upgrade.
• Installer will warn if collector user lacks required permissions.
• Various improvements to collector logging.
• Better -help output for !tlist debug command.
• Handle SNMP agents that return “noSuchName” in the “error-status” field.
• Default configuration changes to watchdog.conf:
  • wrapper.logfile.compress.maxfiles changed from 10 to 5
  • wrapper.logfile.maxfiles changed from 3 to 2
• Default configuration changes to wrapper.conf:
  • wrapper.logfile.compress.maxfiles changed from 10 to 20
  • wrapper.logfile.maxfiles changed from 3 to 2
• The following configuration directives have been renamed:
  • discover.global.timeoutInSec -> discover.default.timeoutInSec (default 3600)
  • discover.perfmon.timeout -> discover.perfmon.timeoutInSec (default 120)
  • discover.wmi.timeout -> discover.wmi.timeoutInSec (default 120)
• Added AD script timeout configuration directive discover.script.timeoutInSec with a default value of 300 seconds.
• Fixed issue where sbwinproxy would use more memory than necessary when communication to the agent was interrupted.
• Fixed an issue where a PowerShell script would report “The screen cannot be set to the number of lines and columns specified.” when run from Poll Now or the debug window. This happened because the collector tried to set the screen column count to the default value despite it already being set to the default value.
• Fixed a bug where WMI queries would fail due to an improperly handled error code that requires re-authentication.
• Fixed issue where ping collection would fail with some firewalls due to sequence ID reuse.

• Fixed a bug that would cause some collectors to use excessive memory and CPU for garbage collection when monitoring single devices with more than 10,000 instances that are frequently changing.

• Since 25.200, nonexistent OIDs in AD filters would cause an instance to be filtered out of AD unless the filter was using the NotExist operation. This would lead to unexpected behavior when using other operations like NotEqual, NotContains, and RegexNotMatch. Nonexistent OID responses will now be treated as empty strings (“”) when evaluating with those operations.
• Token replacement for PropertySources now works in Groovy and PowerShell. We recommend using hostProps.get(), instanceProps.get(), or taskProps.get() in Groovy scripts for better performance than token replacement.
• Collector will no longer fail to start if DNS resolution from the cache file fails.
• Fixed issue where sbwinproxy would use more memory than necessary when communication to the agent was interrupted.

• HTTP collector AD will not append default ports (80, 443) to the “Host” header. Most browsers, and the !http debug command did not append the port to the “Host” header, leading to discrepancies in cases where the remote server could not handle the appended port in the “Host” header.
• Syslog collection now supports timestamps with microseconds.
• The collector will delete the locally stored NetFlow database if the file exceeds netflow.datadir.maxSizeInMB directive in agent.conf when NetFlow initializes. This will prevent NetFlow from using excessive collector disk space.
• When Poll Now fails for Ping, SNMP, or WMI collection, the collector will try to diagnose the problem and include suggestions (as well as the command used to diagnose) in the result.
  • Ping diagnosis calls your collector OS ping binary.
  • SNMP diagnosis uses binaries included with the collector.
  • WMI diagnosis uses PowerShell’s Get-WMIObject Cmdlet.
• Fixed handling of gzip encoding with the webpage collector.
• Patched CVE-2016-5725 on JSch 0.1.53.

• Improved memory efficiency for WMI, Perfmon, and Ping collection.
• Unused .cab files generated with the !packetcapture debug command are now automatically deleted.
• Memory usage improvements.
• Various improvements to logging output.
• Improved SSE memory usage when consuming the hosts feed, particularly for collectors handling large numbers of instances.
• Fixed issue where Perfmon collection could interfere with the watchdog heartbeat, resulting in errant host status alerts.

• SSE will be automatically disabled on collectors that can’t support it due to insufficient RAM and other edge cases.
• Improved memory efficiency for WMI, Perfmon, and Ping collection.
• Improved SSE memory usage when consuming the hosts feed, particularly for collectors handling large numbers of instances.
• Various stability improvements.
• Reverted JSch library to 0.1.53 from 0.1.54 to fix a compatibility issue with some Cisco devices.
• Fixed issue where sbproxy would be errantly terminated.

• Syslog EventSources now recognize and correctly parse Cisco’s flavor of syslog.
• Efficiency improvements to the built-in NetApp collector.
• Trimmed down some excessively long collector event messages.
• Efficiency improvements for PowerShell scripts.
• More insightful error messages from Poll Now.
• NetScan script timeout is now configurable in agent.conf (defaults to 60 seconds).
• Fixed issue where sbproxy would not restart timely when a collector was restarted from the UI.
• Fixed issue where sbproxy would be errantly terminated.
• Fixed a NetFlow bug that would cause data to be discarded if the device id was too large.
• Fixed an issue that prevented PowerShell scripts from running after upgrading to 27.500.

• Added an option to use unique ids per host on icmp polls.
• Improved metrics for SSE and Collector performance monitoring.
• Fixed an issue where restarting with a corrupted agentdns.cache file would prevent collector from starting.

• The SSE engine now supports custom lib folders, including relevant paths, for 3rd party jars.
• Added an option to execute parallel perfmon metric collection for situations where some parent metrics might be invalid.
• Added additional status monitoring of the Collector Reporter to identify situations where the Collector may be reporting data, but no gathering fully.
• Fixed a bug where the Collector was being repeatedly restarted by improving the logic that Watchdog uses to restart the collector agent.
• Fixed a bug in SNMP collection when gathering metrics individually which resulted in “ConcurrentModificationException” errors.
• Fixed a bug where certain Groovy Scripts would not work and display this error “Cannot schedule task for execution” after disabling the Standalone Scripting Engine.
• Fixed a bug where “reporter.persistent.queue.consume.rate” config setting was not being used.
• Fixed a bug where very large host entries would cause an OutOfMemory exception. The script will be scheduled for later execution or SSE will be disabled until next restart when the process does not register within a configured initiation time.
• Fixed a resource leak in Standalone Scripting Engine and added increased protection for OutOfMemory exceptions and SSE spawning too many processes.
• Increased security to prevent DLL hijacking in sbwinproxy.

• Remote Sessions are now supported through a collector configured to use a proxy.
• Improved PollNow Error messages for Ping and Perfmon datasources to help with troubleshooting.

• Added ability to specify as specific MySQL JDBC driver jar over the currently provided version.
• Webpage collection of JSON data is now cached locally to improve performance of reading large data sets.
• Fixed an issue where TCP Connections were not being reused correctly and creating significantly more open connections than previous versions.

• Fixed an issue where SSL Certs validation was preventing certain Groovy Scripts from successfully running.
• Fixed an issue with the Watchdog process frequently restarting SBProxy process.
• Fixed an issue where upgrading from 26.XXX to 27.XXX resulted in more variability in Data Collection Task counts. The timeout value for collector.max.init.delay.in.seconds is now defaulted to 600.
• Fixed an issue when perfmon initialization against a slow endpoint may cause a restart of the sbproxy service.

• Improved the memory handing of Powershell scripts.
• Poll Now on JDBC datasources now provides more detailed error messages.

• Fixed an issue with JDBC data collection and making TLS connections.
• SBWinProxy was restarting randomly and impacting the ability to monitor Ping DataSources.
• Improved the default Memory Allocation around the scripting environment.
• When proxy.enable=true in agent.conf, the collector will check the proxy certificate for validity. The collector will not connect to Santaba if the certificate fails the validity check.

• PropertySources written in PowerShell now support token replacement.
• Added support for NTLMv2 authentication using wmi.authType.

In comparison to GD 26.001, highlights of this version include:

• Property Sources now support Powershell Scripts
• Removed Support for Windows 2003
• Windows Collector installer and files are now signed
• Support for Event Source Test Now functionality (similar to Poll Now on datasources)

• Fixed an installation issue on Windows 2008 R2 where the installer was asking for Proxy information due to connection issues.
• Fixed a data collection issue related to specific special characters included in SQL statements.

• Fixed an issue with SNMP v3 collection that would result in very high CPU usage.
• Fixed “WMI Provider load failure” issue.
• Fixed an issue where certain collector upgrade paths would not maintain/adjust Agent.conf file customizations properly.

• Support for Event Source Test Now functionality (similar to Poll Now on datasources) that is coming in v103.
• Configuration updates/changes to support the renaming of Services to Websites.
• Added support for integers with 5 bytes in SNMP.

• Support for Longer DataSource Collection Intervals.
• A new property “collector.script.timeout” can be set on an instance, device or group and we use that property value as any script timeouts for instances where the property is applied.
• We have improved the handling of reporting threads to ensure that collectors with high device counts process tasks more efficiently during heavier loads

• Groovy Scripting will now support PUT and DELETE methods as part of an updated HTTP java class.
• Support for the upcoming Log File Event Source Encoding options that allow for choosing or auto-detecting the encoding of collected log sources.
• Support for the upcoming Powershell support in Property Sources.

• Fixed a bug in the Internal Service Check to better support SSL checks on alternative port numbers. 

• Support for the upcoming v101 release feature enhancement Property Sources will support PowerShell scripts.
• With this version of the collector Windows 2003 is no longer supported and will be blocked by installation and upgrades.
• Service Checks now support the ability to identify SSL errors and halt on them as separate actions.  Therefore the check can identify the SSL error, but continue to confirm the rest of the service functionality.  Use 26.200 to use this feature with Internal Service Checks.

• GD 26.001 fixes an issue identified in GD 26.000 that could affect LogicMonitor performance. If you are running 26.000, please update to this new 26.001 version.

• Improved stability of scripted Data Collection and Active Discovery.
• With v100, Windows Collector installers will be signed for enhanced security.
• Previously, if the Collector requested ESX data during a refresh of the ESX server, it would report “No Data” until the Collector was restarted. This has been improved so that the Collector can recover without requiring a restart.
• Added support for TLS 1.1/1.2 for MySQL and SQL Server.

• This version includes everything in GD 25.001, as well as EA 25.100, EA 25.200, EA 25.300, and EA 25.400.
• Improved speed and performance of NetScans.
• Support for SSL Expiration tracking and alerting for Service Checks.
• Support for groovy scripts to define a Config Check in LM ConfigSources

• Improved WMI performance and capacity.
• Improved Active Discovery and Auto-Property processes to prevent duplicate tasks and reduce memory usage.
• Increased the timeout of SNMP Active Discovery tasks to 300 seconds. This can be modified via the ad.snmp.walk.timeout parameter in agent.conf
• Improved snmpwalk timeout logic.

• Significant performance improvements for Perfmon collection.
• Performance and capacity improvements for WMI collection.
• Windows Collector Installer has been improved to better explain permissions/installation instructions. It will now automatically detect if the computer is on the domain and show a separate Domain field only in this case.
• Support for SSL expiration monitoring in v97.

• GD 25.001 will be released October 25th, 2017 to replace GD 25.000, which was released early September. We have subsequently identified an issue in GD 25.000 that could cause problems with PowerShell script execution under certain conditions. With GD 25.000, we improved the ability of the Collector to trap PowerShell exceptions, and it is possible this would terminate PowerShell script execution for otherwise harmless errors. We have corrected and thoroughly tested this in GD 25.001.

• Improved the speed and performance of NetScan. Added Npcap packet capture for MAC address detection and lookup of network interface manufacturer.
• You can now use groovy scripts to define a Config Check in LM ConfigSources.
• To avoid ping packages from being dropped by firewalls, we have reduced the Collector’s default ping packet size. To change this, you can modify the ‘ping.payload.size’ parameter in the Collector’s service.conf file
• Removed the !get debug command.

• This version includes everything in MGD 24.002, as well as EA 24.085, EA 24.126, EA 24.200, and EA 24.300.
• Easy Capacity Tuning – Navigate to the Collector configuration window and select a new Collector size (Small, Medium, or Large) to automatically update the necessary parameters and instantly increase or decrease the Collector’s capacity.
• Support for IPv6 for all data collection methods and Internal Service checks (not including traceroute, yet).
• Faster Collector download – When adding a Collector, select ‘bootstrap’ to download and install Collectors much faster via the LogicMonitor CDN.

• Faster Collector download! When adding a Collector version 24.300 or higher with v94, you will notice the option to download a bootstrap as opposed to the full Collector package. The bootstrap is a smaller installation package that enables you to download and install Collectors much faster via the LogicMonitor CDN.
• Added a service.config tab to the Collector Configuration window. This is useful for configuring a proxy and other settings for Internal Service checks.
• SNMP performance improvements to reduce the Collector’s CPU utilization.
• Reduced the amount of memory used by ConfigSources.

• This version supports one click capacity optimization. You can now navigate to the Collector configuration window and select a new Collector size (Small, Medium, or Large) from a dropdown menu.
• Added a sanity check to any configuration changes made via the UI
• Several improvements to support IPv6 for all data collection methods.
• Added the ability to configure a proxy for Internal Service checks. This configuration is set in the Collector’s service.conf file

• This Collector includes all features available in 24.001 as well as the following changes:
• Improved the logic behind the Collector upgrade process to ensure that custom script and jar files are not inadvertently deleted during upgrade.
• Fixed an issue causing double backslashes to be interpreted incorrectly in Powershell scripts.
• Improved DNS resolve to prevent service checks from failing due to containing “://”