7.21.0 System Monitor Release Notes - 1 July 2025

Release Details

LogRhythm System Monitor Agents for Windows require the Microsoft .NET Framework 4.7.2+ or .NET Core 8. 

• Before upgrading your System Monitor Agent .NET Framework 4 agent (installed pre-7.21), confirm that .NET Framework 4.7.2 or higher is installed.

• For information on determining which .NET version is installed, see Determine which .NET Framework versions are installed - .NET Framework.

• If an older version of .NET Framework 4 is installed, install .NET Framework 4.7.2 or higher and reboot your system during a planned maintenance window. Upgrading a .NET Framework 4 agent when the version of .NET Framework is older than 4.7.2 will trigger a reboot.

• Upgrading existing .NET Framework 4 System Monitor Agents to .NET Core 8 (7.21 or later) should not require a reboot, but should be done during a planned maintenance window.

New Features

System Monitor Agent Service .NET 8 Core

Starting with 7.21, the Windows System Monitor Agent will be released with the current .NET 4.7 Framework and new .NET 8 Core builds. The .NET 8 Core build will be bundled as an optional add-on within the Installation Wizard, or it can be downloaded and installed independently. The .NET 8 Core build provides up to 20% improvement in agent data throughput, improved memory management and reduced CPU consumption making the service more efficient.

Additionally, the following third-party DLLs were upgraded: Newtonsoft.json; nsoftware; SmartThreadPool; and Xceed.

Collection of API log sources on .NET 8 Core is not supported. System Monitor Agents using .NET 4 will continue to collect API log sources.

Improvements

System Monitor Agent Silent Installer Improvement

Windows System Monitor Agents (SMAs) now have a new silent install switch, EntityID, allowing for the silent installer to inform the platform which root entity the pending SMA should be associated with.

Refer to Silently Install a System Monitor on Windows for Silent Installer Configurations.

System Monitor Agent JSON Output Improvement

When using the JSON Listener, the JSON Policy name and System Monitor Agent version are now included in the Syslog output from the Agent. These fields are not parsed or used by the LogRhythm SIEM, but can be referenced when debugging or testing JSON Processing Policies.

JSON Processing Policy Improvements

LogRhythm SIEM version 7.21 contains various improvements to System Monitor processing policies that make it easier to integrate your System Monitors and Open Collectors through the use of JSON parsing and policy builder.

For a full rundown of these JSON processing policy improvements, please refer to the LogRhythm SIEM 7.21 Release Notes.

Resolved Issues

The following issues have been resolved with this release:

Resolved Issues - Security

Resolved security-related defects can be viewed on the Community.