7.24.0 System Monitor Release Notes - 1 April 2026
Release Details
Software Component | System Monitor (SysMon) |
|---|---|
Version Number | 7.24.0 (Windows) 7.24.0 (*NIX) |
Compatibility | This System Monitor Agent release is compatible with LogRhythm SIEM core versions that have not reached their end of life date. For more information, see End of Life Policies for Software and Hardware.
|
LogRhythm System Monitor Agents for Windows require the Microsoft .NET Framework 4.7.2+ or .NET Core 8.
Before upgrading your System Monitor Agent .NET Framework 4 agent (installed pre-7.21), confirm that .NET Framework 4.7.2 or higher is installed.
For information on determining which .NET version is installed, see Determine which .NET Framework versions are installed - .NET Framework.
If an older version of .NET Framework 4 is installed, install .NET Framework 4.7.2 or higher and reboot your system during a planned maintenance window. Upgrading a .NET Framework 4 agent when the version of .NET Framework is older than 4.7.2 will trigger a reboot.
Upgrading existing .NET Framework 4 System Monitor Agents to .NET Core 8 (7.21 or later) should not require a reboot, but should be done during a planned maintenance window.
New Features
Secure JSON Listener
The LogRhythm JSON Listener can now accept logs securely from third-party shippers like Cribl and Databahn using SSL encryption. This feature is enabled through new System Monitor Advanced Properties, where you can specify the path to your SSL certificate and private key on both Windows and Linux System Monitors. To streamline troubleshooting, detailed connection and SSL-related errors are now recorded in the scsm.log file, ensuring a smooth and secure integration for your cloud log sources.
Improvements
JSON Processing Policy Improvements
LogRhythm SIEM version 7.24 contains various improvements to System Monitor processing policies that make it easier to integrate your System Monitors and Open Collectors through the use of JSON parsing and policy builder.
For a full rundown of these JSON processing policy improvements, please refer to the LogRhythm SIEM 7.24 Release Notes.
Resolved Issues & Enhancements
.NET Agent Upgrade Packages Issue
System Monitor Windows Agent versions 7.22.0 and later come with a new .NET 8 agent update package to address an issue with agent upgrades. This package includes all of the following necessary files for the update:
windowsdesktop-runtime-8.0.18-win-x64/86.exe
LRSystemMonitor_64_7.xx.0.2033.exe
LRAgentUpdate.exe
Property.xml
This fix simplifies upgrades for users on versions 7.22 or later moving to a newer/future version (like the 7.24 .NET 8 agent). If you are on an older version of System Monitor Agent (7.21 or earlier), this fix is not available, and you will need to follow the special instructions below.
To update to the latest Windows System Monitor Agent version (7.24.0.2xxx .NET 8), follow these two steps:
Run the upgrade packages for System Monitor Agent version 7.24.0.1xxx (.NET 4) from any previous versions.
After that, run the upgrade package for System Monitor Agent version 7.24.0.2xxx (.NET 8).
Special Instructions for Customers on Windows System Monitor Agent Version 7.21 or Earlier
Customers on Windows System Monitor Agent version 7.21.0.2019 (.NET 8) cannot directly upgrade to agents 7.22.0.1xxx (.NET 4) or 7.22.0.xxx (.NET 8) or later using a manual or package upgrade. Follow these steps:
Manual upgrade steps:
Uninstall the old System Monitor Agent version 7.21.0.2019 (.NET 8) completely.
Install the new System Monitor Agent version 7.24.0.2xxx (.NET 8) or 7.24.0.1xxx (.NET 4).
Upgrade package steps:
Run the upgrade package for the 7.21.0.1052 or older .NET 4 agent.
Run the package for the 7.24.0.1xxx (.NET 4) agent.
Run the package update for the 7.24.0.2xxx (.NET 8) agent.
Resolved Issues
The following issues have been resolved with this release:
Bug ID | Description |
|---|---|
ENG-63729 | An issue in which parsed syslog host identifiers could be matched with an incorrect log source due to incorrect pattern recognition has been resolved. |
ENG-63847 | The Realtime File Integrity Monitoring (FIM) system now works as expected with System Monitor Agents versions 7.16 and above. |
ENG-78166 | An issue with intermittent System Monitor Agent crashing after upgrades to versions 7.21+ has been resolved. |
ENG-78964 | Upgrading from the version 7.21 .NET 8 System Monitor Agent to the version 7.22 .NET 4 System Monitor Agent no longer causes the agent to cease working in certain situations. |
ENG-83597 | Newly created AWS CloudWatch log sources now correctly abide by the NumOfBackDaysData setting in the log source’s configuration file. |
ENG-85088 | An issue in which System Monitor Agents could load incorrect certificates for secure syslog servers if more than one certificate had the same subject name has been resolved. |
ENG-88628 | Upgrading from System Monitor Agent version 7.22 (.NET 8) to version 7.23 (.NET 8) no longer results in unexpected crashes and error messages in certain situations. |
Resolved Issues - Security
Resolved security-related defects can be viewed on the Community.
Deprecation Notice
Linux System Monitor Agent Migration to .NET 8
Linux System Monitor Agents have been moved to .NET 8 in LogRhythm SIEM version 7.23.0. LogRhythm SIEM version 7.24.0 is the last version for which maintenance activities will take place against the older builds (versions ending in 1xxx like 7.19.0.1000). Customers should migrate to updated .NET 8 System Monitor Agents for the best, most up-to-date features and defect fixes. The older agents will continue to function; however, maintenance for those agents will cease starting with this release. Any customers reporting defects with older System Monitor Agents will be asked to migrate to the .NET 8 agent builds (ending in 2xxx like 7.24.0.2000).