Skip to main content
Skip table of contents

7.11.0 GA Release Notes - 5 January 2023

Upgrade Considerations

Upgrade considerations for all 7.11.x releases are available on the LogRhythm Release Notes main page.

LogRhythm 7.9.0 introduced support for Microsoft SQL Server 2019 and Windows Server 2019 on standard deployments. If your deployment is running SQL Server 2016 Standard or Windows Server 2016, there is no need to upgrade to 2019.

For more information on the optional upgrades, see:

New Features

Functional GroupFeatureDescription
Platform AdministrationAdmin API

Explanation: The Admin API library now includes new log source virtualization and MPE rule management endpoints.

Benefit: The Admin API reduces administrative overhead and expedites workflow by automating routine tasks.

Relevant Documentation Updates: Administration API Endpoints

Platform AdministrationEnhanced Auditing

Explanation: LogRhythm 7.11 introduces built-in auditing tables to the EMDB. The tables capture and log administrative activity, providing a historical record for auditing administrative changes.

Benefit: Customers can now audit administrative changes made to LogRhythm configurations. They can also set up alerts to closely monitor critical configurations.

Relevant Documentation Updates: Enhanced Auditing

Message Processing EngineMPE Rule Sharing

Explanation: SIEM Admins can now use MPE Rule Builder to import MPE rules created by other users without having to make manual modifications. 

Benefit: SIEM Admins can now share and import existing MPE rules from Community and other sources.

Relevant Documentation Updates: Import and Export MPE Rules

LogRhythm Cloud

SecondLook as a Service

(SLaaS for Windows)

Explanation: LR Cloud SREs can now configure SecondLook as a Windows service for LR Cloud customers. 

Benefit: LR Cloud customers can configure, save, and execute SecondLook searches from the Web Console.

Relevant Documentation Updates: SecondLook

Data Processor, LogRhythm ConsoleLoad Balanced Agent Groups

Explanation: Customers can now assign Agents to a specific load balanced group. The Agents are no longer required to connect to the same set of Data Processors, and load balanced child log sources function correctly. Adding new load balanced log sources or Agents to a group triggers an automatic Agent configuration update. 

Benefit: Organizing load balanced agents is easier. 

Relevant Documentation Updates: Load Balanced Agent Groups

Security and ReliabilityAuthentication Service 

Explanation: LogRhythm implemented new JWT token security protocols in Authentication Service.

Benefit: Enhanced security in Authentication Service.

Relevant Documentation Updates: N/A


  • Added an option that allows the System Monitor Agent handles count to reset when the Mediator is restarted. For more information, see the Flat File Settings Tab table in Add a Single Log Source.

Deprecated Features

LogRhythm 7.8 was the last published version of the SOAP API. LogRhythm is deprecating the SOAP API in favor of more effective and sustainable integration through RESTful APIs. While the SOAP API is still usable in 7.9, we encourage customers and partners using the SOAP API to migrate their integrations to REST APIs. For more information on REST integration, see our REST API documentation.

Resolved Issues

Bug #Ticket #ComponentDescription



440713APIsData retrieved by the Alarm API no longer presents out of order in certain situations.



N/AAutomatic Remediation EngineSmart Responses will no longer time out due to the stored procedures used by the ARM.



447860, 452400, 452554Client ConsoleThe Log Volume Report no longer produces an error stating that values are too large in certain situations.



405024, 444224Client ConsoleCollecting logs via the Windows Host Wizard no longer assigns the wrong log sources in certain situations.



392225, 391496, 391011, 390671, 390442, 382674Infrastructure: Database Scripts & Upgrade ScriptsThe SQL database auto-growth settings no longer cause performance impacts and database fragmentation in certain situations.



451493LR CloudNewly-created LR Cloud users are now visible to restricted admins by default.



396944, 413307, 424141, 415807, 426425, 449506, 449623, 450874MediatorThe Mediator now correctly only seals the archive file once. 



412596, 429205MediatorThe agent handles count now correctly resets when the Mediator is restarted.



436942, 446452MediatorSaving MPE rules in the development status no longer causes updates within the MPE engine and soft resets.



450985MediatorAn error message is no longer generated in the archive.log file in certain situations.



399555Web ConsoleNew AD users are now granted the correct permissions when being synced into LogRhythm via the AD Group Based Authorization.



434551Disaster RecoveryDisaster Recovery (DR) Failovers no longer fail to receive DNS updates if the DR site uses a secondary domain controller with batched replication.

Resolved Issues - Security

Security-related issues resolved with this release are available for customers to view on the Community.

Known Issues

The following issues have each been found and reported by multiple users.

Bug #

Found In Version



Release Notes



7.5.1Client ConsoleWhen DNStoIP is enabled on the Data Processor and the DNS name doesn't have a host record, the host field shows only the IP address without the host name.  This impacts only the Client Console and is displayed correctly in the Web Console. 

Expected Results: The hostname should be displayed the same for both Web and Client Consoles. 

Workaround: View the record in the Web Console. 



7.7.0Client ConsoleThe entity delete functionality is very fragile, often failing with a generic error.

Expected Results: The entity delete functionality should work without any issues.

Workaround: There is currently no workaround for this issue.



7.9Client ConsoleClient console search queries including the Host IP Address criteria are timing out in large databases.

Expected Results: Log source searches should be completed without performance issues.

Workaround: There is currently no workaround for this issue.



7.4.9Common ComponentsIn certain circumstances, the Data Processor runs slowly and the non-paged pool uses significant system memory. This can cause a large unprocessed logs queue or other backlog in the system. 

Expected Results: The non-paged pool should not increase and cause system performance issues. 

Workaround: Restart the LogRhythm API Gateway service.



7.6.0Common ComponentsIn some cases after a Data Indexer install, the Service Registry may not be able to communicate with the Platform Manager, causing alarms and errors in the Service Registry log.   

Expected Results: Communication to the Platform Manager should be maintained after an install. 

Workaround: Restart Service Registry on each node in the cluster after the installation is complete. 



7.6.0Data IndexerThe Transporter can fail to fully start after restart at UTC midnight, causing indexing and performance issues. (This issue only impacts Linux clusters.)

Expected Results: The Transporter should continue to run after a restart signal is sent.

Workaround: Restart the Transporter service.



7.6.0Data IndexerData is being indexed in lower case, ignoring the case of the original logs.

Expected Results: Data should be stored in the format in which it was sent.

Workaround: There is currently no workaround for this issue.



N/AData IndexerAlarm drilldowns fail as a result of changes to daylight savings in Chile. The failure is temporary and only lasts a few hours.

Expected Results: Searching should work. 

Workaround: Either wait for the issue to naturally pass or manually adjust system clocks. 



N/AInfrastructureWeekday maintenance is taking much longer than expected.

Expected Results: The weekday maintenance task should perform in a reasonable amount of time.

Workaround: There is currently no workaround for this issue.



7.9.0Installation ComponentsDR SQL transaction logs are filling the L: drive when unable to sync to secondary nodes.

Expected Results: Transaction logs should be truncated by frequent scheduled backups throughout the day.

Workaround: There is currently no workaround for this issue.



7.9.0Metrics CollectionTelemetry metrics parsing errors from Datadog are present in the metrics collection file.

Expected Results: Datadog's telemetry metrics parsing errors should not be present in the metrics collection file.

Workaround: There is currently no workaround for this issue.



7.6.0Web ConsoleIn the Web Console, if the last selected Analyzer page dashboard has a filter, drill down results are hidden.

Expected Results: drill down results should not be hidden. 

Workaround: Select Default Analyze Dashboard 



7.7.0Web ConsoleWhen running a search or drill down in the Web Console, the operation does not return results or terminate as intended. 

Expected Results: The search and drill down operations should return results upon completion or terminate. 

Workaround: Reload the page. 



7.7.0Web ConsoleIn some cases the Web Console services will not get the updated EMDB IP and will continually fail to connect to SQL until it is manually restarted.

Expected Results: Services should restart or recheck the EMDB IP in service registry if it cannot connect to SQL server.

Workaround: Restart Service Registry and SQL services.



7.7.0Web ConsoleWhen using a Lucene filter in a Web Console widget, users are unable to filter widget time ranges for originUser.

Expected Results: The Lucene filter should be able to filter time ranges.

Workaround: Remove the time filter from the widget to show all data.



7.9.0Web ConsoleThe “Component Status” widget is not showing the component name correctly, instead it is showing as an icon.

Expected Results:  Component names should be shown.

Workaround: Hover over the icon to see the Component Name.

JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.