7.13.0 GA Release Notes - 29 June 2023
Introducing LogRhythm SIEM 7.13! In this version, we significantly improved processing performance with the System Monitor JSON Engine and Data Processor Pooling. Brief explanations of the updates are grouped into the following sections:
Key highlights include:
Sections on maintenance and upgrades:
We’ve updated our LogRhythm SIEM Documentation. You can now select documentation associated with a specific version (starting with 7.12.0). Click on the version picker in the upper-right corner on the SIEM and Installations and Upgrades landing pages.
![](../../__attachments/47553656/SIEM%20Version.png?inst-v=9b26bf8d-a916-45d3-9ae4-4d53f270912c)
Analyst Experience
SecondLook in Web Console
Customers want to retain their data, and they need an easy way to find their older data. With LogRhythm 7.13, customers who use our self-hosted SIEM option now have access to SecondLook. After installing and configuring SecondLook, customers can query data and search through archives directly from the Web Console. Without having to pivot between the Web Console and Client Console, customers save valuable time. Using SecondLook also means searches are passed off to a dedicated service for a more reliable user experience.
![](../../__attachments/47553656/CompletedSLRestoreSearch3.gif?inst-v=9b26bf8d-a916-45d3-9ae4-4d53f270912c)
Initiating a SecondLook search.
For installation and configuration details, see Install SecondLook API.
Automation
With new features, come new REST API endpoints! LogRhythm 7.13 further extends the automation capabilities of the Admin API so that you can programmatically:
Configure, update, and retrieve System Monitor DP Pooling settings.
Configure, update, and retrieve System Monitor Load Balanced Group settings.
Configure, update, and retrieve log source Watch File Rename on Rollover settings.
For more details on all the available endpoints, see our REST API Documentation.
New to the API and wondering how to get started? Learn more on the Community!
Data Collection
Data Processor Pooling
Data Processor pooling makes it easy for administrators to distribute log volume across a pool of Data Processors and create well-balanced Data Indexer clusters. With DP pooling, administrators can quickly define DP pools and assign Agents to them. Agents then auto-distribute their logs across the DP pool. Administrators can also turn off DP pooling by switching an Agent to pinned mode.
System Monitor Agents are the workhorses that collect and ship data to Data Processors. But there was not a good way to load balance these System Monitor Agents across multiple Data Processors — until now.
With version 7.13, LogRhythm introduces Data Processor Pooling, a new feature that lets administrators define a pool of one or more Data Processors to allow a single Agent to collectively send its data to a group of Data Processors. When an Agent is assigned a DP pool, the Agent will spread the logs across the Data Processors. This removes the need to manually review Agent volumes and adjust which Data Processors the Agents are sending to, saving you time.
![](../../__attachments/47553656/DPPooling_DefinePool.gif?inst-v=9b26bf8d-a916-45d3-9ae4-4d53f270912c)
Defining a Data Processor pool.
![](../../__attachments/47553656/DPPooling_AssignDP.gif?inst-v=9b26bf8d-a916-45d3-9ae4-4d53f270912c)
Assigning a Data Processor to a pool.
![](../../__attachments/47553656/DP%20Pooling_AssignSysMon.gif?inst-v=9b26bf8d-a916-45d3-9ae4-4d53f270912c)
Assigning a System Monitor to a pool.
System Monitor JSON Engine
The 7.13 System Monitor is now embedded with a native JSON parsing engine. This significantly improves processing performance and removes the need to work with JQ query language. With the new architecture, Beats can be rerouted from the Open Collector parsing engine to the new parsing engine on the System Monitor. This simplifies sizing, deployment, and troubleshooting of the platform. For more information, see Configure Beats for JSON Parsing.
![](../../__attachments/47553656/EnableJSON.gif?inst-v=9b26bf8d-a916-45d3-9ae4-4d53f270912c)
Enabling JSON parsing on a System Monitor Agent.
View System Monitor Agents in the Web Console
In the Web Console, global and restricted administrators now have an Agents option in the Administration menu.
On the Agents page, administrators can quickly check the status and health of System Monitors right in the Web Console. They can easily see a System Monitor's status and the timestamp of the last heartbeat received.
The Agents Grid shows a dynamic display of agents based on the access granted to the user.
Restricted administrators can only view the effective System Monitors defined in their user profile.
The Agents Grid helps administrators immediately identify problematic Agents with Last Heartbeat highlighting. In environments that contain thousands of Agents, admins can filter down to view just the Agents that matter. Filters include:
Name
Host
Entity
Type
Number of Log Source
Version
Status
Data Processor
Last Heartbeat
![](../../__attachments/47553656/ViewAgentsWC.gif?inst-v=9b26bf8d-a916-45d3-9ae4-4d53f270912c)
Applying a filter on the Agents Grid.
Platform
Over time, operating systems become outdated, making past versions unsupported. With the release of 7.13, LogRhythm is supporting and installing Microsoft Server 2022, Microsoft SQL Server 2019, and Rocky Linux. For customers that prefer the open-source version of Linux, Data Indexers and Open Collector support Rocky Linux 9 and RHEL 9. For customers with RHEL licenses, LogRhythm SIEM supports RHEL 9. For information, see the Component Operating System Support section in Review the Requirements for a New LogRhythm Deployment.
We’ve also added additional support for System Monitor, which includes Windows 2022, Windows 11, Rocky Linux 9, and RHEL 9. For information, see LogRhythm System Monitor Compatibility and Functionality.
Resolved Issues
Bug # | Component | Description |
---|---|---|
ENG-11205 (DE16679) | Active Directory | Active Directory syncs no longer fail when a user account has two usernames. |
ENG-35407 | AI Engine | AI Engine rules no longer experience significant delays when firing in certain situations. |
ENG-22876 (DE16824) | APIs | Changing the alarm status in the Case API no longer results in an error in certain situations. |
ENG-11199 (DE16890) | APIs | Alarm Status update requests no longer fail in LRCloud deployments in certain situations. |
ENG-23824 | Client Console | The Deployment Manager option is no longer shown to Restricted Analysts. |
ENG-11160 (DE15875) | Client Console | LogMart maintenance now correctly reflects changes made to LogMart_TTL. |
ENG-24715 | Client Console | SSL/TLS can now be enabled on the Platform Manager Properties tab to prevent SSL/TLS notification failure. |
ENG-24954 | Client Console | The MaxMessageCount for a log source can now accept values up to 50,000. |
ENG-11141 (DE14874) | Reporting | The Log Volume by Log Source report's Bytes/Packets and Sent/Rcvd filters now execute successfully. |
ENG-31775 | SecondLook | The SecondLook API log no longer displays incorrect "Object reference" errors. |
ENG-36167 | SecondLook | Saving a SecondLook configuration with a retired log source no longer fails. |
ENG-34885 | SecondLook | SecondLook drill-downs and searches no longer give inaccurate results in certain situations due to local machine time zone discrepancies. |
ENG-34260 | SecondLook | The SecondLook API no longer produces an incorrect "out of memory" error in certain situations when executing a search. |
ENG-36544 | System Monitor | The AutoCorrectionMSEvtPosLogic flag is now OFF by default in the scsm.exe.config file to prevent unnecessary errors. |
ENG-34772 | System Monitor | Starting a System Monitor agent in "unidirectional mode" no longer produces a socket error in certain situations. |
ENG-22863 (DE14276) | Web Console | The Lucene filter now correctly filters time ranges. |
ENG-11143 (DE15241) | Web Console | The Web Console no longer crashes in certain situations when attempting to search by log source. |
ENG-11161 (DE15810) | Web Console | The time range filter now works correctly and populates widgets when applied to the trend chart. |
ENG-11140 (DE14882) | Web Console | The User (Origin), User (Impacted), and User (Identity) fields on widgets now correctly show results when the widget or dashboard timeframe is changed. |
ENG-11162 (DE16404) | Web Console | Location-based widget filters are now applied correctly. |
ENG-11192 (DE16711) | Web Console | The Dashboard navigation bar no longer appears abnormally large in the Google Chrome browser. |
ENG-23301 | Web Console | Web Console CSV exports of log investigations are no longer partially blank in certain situations. |
ENG-25994 (DE11929) | Web Console | Web Console Dashboard drill-downs now correctly abide by set filters. |
ENG-26562 | Web Console | CAC card authentication now correctly works for Web Console logins. |
ENG-30099 | Web Console | Custom time ranges no longer fail to work correctly on Dashboard widgets in certain situations. |
ENG-30493 | Web Console | The Web Console night mode cursor color has been changed so that it is visible at all times. |
ENG-32795 | Web Console | The Web Console night mode Lucene filter box has been changed to match the rest of the night mode UI. |
Resolved Issues - Security
Security-related issues resolved with this release are available for customers to view on the Community.
Known Issues
The following issues have each been found and reported by multiple users.
Bug # | Found In Version | Components | Description | Release Notes |
---|---|---|---|---|
ENG-11165 (DE16414) | 7.9 | Client Console | Client console search queries including the Host IP Address criteria are timing out in large databases. | Expected Results: Log source searches should be completed without performance issues. Workaround: There is currently no workaround for this issue. |
ENG-22882 (DE10768) | 7.4.9 | Common Components | In certain circumstances, the Data Processor runs slowly and the non-paged pool uses significant system memory. This can cause a large unprocessed logs queue or other backlog in the system. | Expected Results: The non-paged pool should not increase and cause system performance issues. Workaround: Restart the LogRhythm API Gateway service. |
ENG-11108 (DE12153) | 7.6.0 | Common Components | In some cases after a Data Indexer install, the Service Registry may not be able to communicate with the Platform Manager, causing alarms and errors in the Service Registry log. | Expected Results: Communication to the Platform Manager should be maintained after an install. Workaround: Restart Service Registry on each node in the cluster after the installation is complete. |
ENG-22881 (DE12218) | 7.6.0 | Data Indexer | The Transporter can fail to fully start after restart at UTC midnight, causing indexing and performance issues. (This issue only impacts Linux clusters.) | Expected Results: The Transporter should continue to run after a restart signal is sent. Workaround: Restart the Transporter service. |
ENG-11175 (DE16040) | 7.6.0 | Data Indexer | Data is being indexed in lower case, ignoring the case of the original logs. | Expected Results: Data should be stored in the format in which it was sent. Workaround: There is currently no workaround for this issue. |
ENG-22862 (DE13480) | N/A | Data Indexer | Alarm drilldowns fail as a result of changes to daylight savings in Chile. The failure is temporary and only lasts a few hours. | Expected Results: Searching should work. Workaround: Either wait for the issue to naturally pass or manually adjust system clocks. |
ENG-11150 (DE15289) | N/A | Infrastructure | Weekday maintenance is taking much longer than expected. | Expected Results: The weekday maintenance task should perform in a reasonable amount of time. Workaround: There is currently no workaround for this issue. |
ENG-11173 (DE15601) | 7.9.0 | Installation Components | DR SQL transaction logs are filling the L: drive when unable to sync to secondary nodes. | Expected Results: Transaction logs should be truncated by frequent scheduled backups throughout the day. Workaround: There is currently no workaround for this issue. |
ENG-11142 (DE15089) | 7.9.0 | Metrics Collection | Telemetry metrics parsing errors from Datadog are present in the metrics collection file. | Expected Results: Datadog's telemetry metrics parsing errors should not be present in the metrics collection file. Workaround: There is currently no workaround for this issue. |