7.22.0 System Monitor Release Notes - 1 October 2025
Release Details
Software Component | System Monitor (SysMon) |
|---|---|
Version Number | 7.22.0 (Windows) 7.22.0 (*NIX) |
Compatibility | This System Monitor Agent release is compatible with LogRhythm SIEM core versions that have not reached their end of life date. For more information, see End of Life Policies for Software and Hardware. Microsoft .NET Framework 4.7.2 or higher |
LogRhythm System Monitor Agents for Windows require the Microsoft .NET Framework 4.7.2+ or .NET Core 8.
Before upgrading your System Monitor Agent .NET Framework 4 agent (installed pre-7.21), confirm that .NET Framework 4.7.2 or higher is installed.
For information on determining which .NET version is installed, see Determine which .NET Framework versions are installed - .NET Framework.
If an older version of .NET Framework 4 is installed, install .NET Framework 4.7.2 or higher and reboot your system during a planned maintenance window. Upgrading a .NET Framework 4 agent when the version of .NET Framework is older than 4.7.2 will trigger a reboot.
Upgrading existing .NET Framework 4 System Monitor Agents to .NET Core 8 (7.21 or later) should not require a reboot, but should be done during a planned maintenance window.
New Features
O365 Beat
A new O365 Beat has been added to the Open Collector, replacing the API collection previously done through the System Monitor Agent. This new beat will address some issues that were experienced when using API collection for the O365 Management Activity log source.
For more information, refer to O365 Beat.
Improvements
JSON Processing Policy Improvements
LogRhythm SIEM version 7.22 contains various improvements to System Monitor processing policies that make it easier to integrate your System Monitors and Open Collectors through the use of JSON parsing and policy builder.
For a full rundown of these JSON processing policy improvements, please refer to the LogRhythm SIEM 7.22 Release Notes.
Resolved Issues & Enhancements
.NET Agent Upgrade Packages Issue
System Monitor Agent version 7.22 comes with a new .NET 8 agent update package to address an issue with agent upgrades. This package includes all of the following necessary files for the update:
windowsdesktop-runtime-8.0.18-win-x64/86.exe
LRSystemMonitor_64_7.22.0.2033.exe
LRAgentUpdate.exe
Property.xml
This fix simplifies upgrades for users on version 7.22 agents moving to a newer/future version (like the eventual 7.23 .NET 8 agent). If you are on an older version of System Monitor Agent (7.21 or earlier), this fix is not available, and you will need to follow the special instructions below.
To update to the latest System Monitor Agent version (7.22.0.2033 .NET 8), follow these two steps:
Run the upgrade packages for System Monitor Agent version 7.22.0.1035 (.NET 4) from any previous versions.
After that, run the upgrade package for System Monitor Agent version 7.22.0.2033 (.NET 8).
Special Instructions for Customers on System Monitor Agent Version 7.21 or Earlier
Customers on System Monitor Agent version 7.21.0.2019 (.NET 8) cannot directly upgrade to agents 7.22.0.1035 (.NET 4) or 7.22.0.2033 (.NET 8) using a manual or package upgrade. Follow these steps:
Manual upgrade steps:
Uninstall the old System Monitor Agent version 7.21.0.2019 (.NET 8) completely.
Install the new System Monitor Agent version 7.22.0.2013 (.NET 8) or 7.22.0.1035 (.NET 4).
Upgrade package steps:
Run the upgrade package for the 7.21.0.1052 or older .NET 4 agent.
Run the package for the 7.22.0.1035 (.NET 4) agent.
Run the package update for the 7.22.0.2033 (.NET 8) agent.
Resolved Issues
The following issues have been resolved with this release:
Bug ID | Description |
|---|---|
ENG-52567 | An issue with an O365 Message Tracking agent failing to collect logs in certain situations has been resolved by enhancing retry logic to prevent stoppage. |
ENG-61555, | The O365 Management Activity Beat has been released with LogRhythm SIEM version 7.22 in order to address issues with O365 Management Activity log collection. For more information, refer to the O365 Beat section above. |
ENG-63744 | An issue with SNMP Connections settings being wiped after being saved in certain situations when using the Collector license type has been resolved. |
ENG-73383 | An issue with Qualys API agents failing to successfully download from the Knowledge Base (KB) has been resolved by adding a KBFetchBackDays parameter, which allows for only retrieving KB entries from a specified date range. |
ENG-74932 | The “Agent Port” field on the System Monitor Agent Properties window no longer accepts negative values. Agents that were already configured with negative values in the Agent Port field must be updated to a valid positive value after upgrading to LogRhythm SIEM version 7.22, and then restart the Mediator service. |
ENG-75826 | An issue with activating the SNMP receiver that was generating errors in the scsm.log file and causing SNMP ingestion to fail has been resolved. |
ENG-77499 | An issue that was causing certain System Monitor Configuration Policies applied to Linux agents to incorrectly assign those agents to a Data Processor Pool has been resolved. |
ENG-78135 | An issue that was preventing Agents from being upgraded to the new .NET 8 utility introduced in LogRhythm SIEM version 7.21 has been resolved. For more information, refer to the .NET Agent Upgrade Packages Issue section of this page. |
Resolved Issues - Security
Resolved security-related defects can be viewed on the Community.