MGD Collector 30.001

The general deployment GD Collector 30.001 has been designated as the next minimum general deployment version, MGD Collector 30.001.

The automatic update to MGD Collector 30.001 will deploy on January 10, 2022. This release, which was scheduled for deployment on October 27th, was postponed while we fixed a performance issue. User action is not required ahead of this date, but we recommend that you update to MGD Collector 30.001 as soon as possible. For more information about the deployment schedule, see MGD Release Update.

Highlights

MGD Collector 30.001

Upgrading to MGD Collector 30.001, or optionally EA 30.xxx, will give you access to many new features and fixes highlighted below.

• MGD Collector 30.001 will be the first MGD Collector version to use JDK 11.

Other highlights include all of the new features introduced in the EA Collector 29.xxx versions, as well as many fixes and optimizations:

• Support for LM Logs.
• SSE enhancements.
• Updated Java JARs.
• NBAR slots support for direction, IPv6, and Application.
• Collector sizes XL and XXL.
• Collector Script Cache.
• Scripts to enable migration from root/Administrator to non-root and non-Administrator user for running the Collector.

For a complete list of new features and fixes across all Collector versions, see Collector Versions.

EA Collector 30.xxx

For early access to additional features, you may consider upgrading to one of the EA Collector 30.xxx versions. Because early access versions are updates that contain new beta functionality, they are not recommended for your entire infrastructure. Features in EA Collector 30.xxx include:

• Support for OpenMetrics Collection.
• Open Beta support for Credential Vault integrations, using CyberArk and Thycotic.
• Support for forwarding Windows Event Logs and Kubernetes Events to LM Logs.
• Capability for changing the Collector Size setting during installation, after download.

GD Collector – 30.001

LogicMonitor GD Collector 30.001 was released on August 23, 2021 and includes the following changes.

Fixes

• Fixed an issue with the commons-codec library that was causing issues with updated collectors.
• Fixed issue with MongoDB driver dependencies. It is now properly upgraded to version 4.1.0

Known Issues

• Upgrading from EA Collector 28.604 to EA Collector 30.000 will fail. We recommend upgrading to GD Collector 30.001 before you upgrade to an EA 30.xxx version.

Developer

• We provide Java classes to help you develop your own LogicModules. These Java classes include SNMP, Expect, and so on. See the Javadoc for EA Collector 30.101.

EA Collector – 30.102

LogicMonitor EA Collector 30.102 was released on July 20, 2021 and includes the following updates and fixes.

Enhancements

• ADDED Beta Support for the new Thycotic Secret Server Integration. It works similar to the CyberArk integration and shares most of the same functionality. See the Credential Vault for LM Collector.
• IMPROVED the Credential Vault Integration to require less frequent polling of CyberArk and Thycotic servers.
• ADDED NetFlow support for more BGP ASN related fields and VeloCloud fields.
• ADDED support for defining a backup resource to associate logs to when mapping fails. One backup resource can be defined per collector, and all logs that fail to map to its resource for any reason, will be mapped to this backup resource.
• IMPROVED LM Logs to properly parses host and IP info from Fortinet device logs.
• IMPROVED Collector events to include why syslog ingestion failed due to mismatched collector configuration and resource property.
• CHANGED the default setting of the Collector property enable.eof.exception.handling to true.
• CHANGED the Collector Size setting to allow changes after download. It will default to whatever is selected in the UI during download. If you don’t have enough memory for that size, or decide you want a different size, you can change the selection at install time.
  • On Linux, you can use the ‘-s’ flag or answer during the prompt.
  • On Windows, you’ll see the option in the installer steps.
• UPDATED the following JAR files:
  • json-smart 2.2.1 to 2.4.2
  • accessors-smart 1.1 to 2.4.2
  • asm 5.0.3 to 8.0.1
  • slf4j-api  1.7.16 to 1.7.30
  • json-path 2.2.0 to 2.5.0
  • jetty-util 9.4.37.v20210219 to 9.4.39.v20210325
  • netty-all 4.1.58.Final to 4.1.61.Final
  • commons-io 2.6 to 2.8.0

Fixes

• FIXED an issue where Windows Event Logs copied from Applications and Services Logs were not properly being ingested by EventSources.
• FIXED !vbscript debug command to print out the proper script path.
• FIXED an issue where some logs were not being ingested if the resource was not monitored by the same Collector configured for syslog collection.
• FIXED Windows EventSource Test functionality to properly show filtered events.
• FIXED an issue where Windows Collector upgrades would fail if the Collector service was not properly stopped.
• FIXED an issue with floating point data not being properly ingested from batchscript output.
• FIXED /etc/ld.so.conf.d/logicmonitor-collector-jre.conf so it is no longer owned by root if the Collector is not installed as root.

Developer

• We provide Java classes to help you develop your own LogicModules. These Java classes include SNMP, Expect, and so on. See the Javadoc for EA Collector 30.101.

EA Collector – 30.101

LogicMonitor EA Collector 30.101 was released on June 9, 2021 and includes the following updates.

Updates

• ADDED support for High Security mode (HSM). Users can choose to install in HSM or Orchestration Compatibility Mode (OCM). The default is OCM. 
  • HSM changes the permissions on the Collector installation folder so that only the owner and root/Administrator can access it.
  • OCM allows non-admin users to access the Collector installation folder. This is useful for users who may be using an orchestration utility to manage agent.conf or anything else in the Collector folder.
• ADDED encryption to selected agent.conf properties.
• ADDED functionality to override openmetrics.url property with openmetrics.host or system.hostname properties when the URL isn’t provided.
• CHANGED the timestamp field to be enabled and set to true by default.
• FIXED an issue where instance groups were not being created for OpenMetrics instances.
• FIXED an issue where company.uuid was not encrypted when the Windows Collector was installed in silent mode.

Known Issues

• A privileged LogicMonitor user cannot use the !getconfig debug command to retrieve credential and company.uuid value.
• Users cannot initialize the HSM mode for a Windows Collector that is installed as a non-Administrator user.
• Upgrading from EA Collector 28.604 to EA Collector 30.000 will fail. We recommend upgrading to GD Collector 30.001 before you upgrade to an EA 30.xxx version.

Developer

• We provide Java classes to help you develop your own LogicModules. These Java classes include SNMP, Expect, and so on. See the Javadoc for EA Collector 30.101.

GD Collector – 30.000

GD 30.000 incorporates all enhancements and fixes found in GD 29.003, as well as EA 29.xxx (29.101, 29.102, 29.104, 29.105, 29.106, 29.107, 29.108, and 29.109).

Updates

Here are a few highlights across the various EA 29.xxx releases that GD 30.000 contains.

• NBAR support for NetFlow.
• LM Logs support.
• Non-root installation no longer depends on sudo.
• The Collector Script Cache.
• Updated Amazon Corretto Java to 11.0.10.9.1.
• Fixed an issue where the Collector would intermittently stop forwarding syslog logs to LM Logs.

For a complete list of changes, visit the individual release notes pages for the various releases.

Known Issues

• When a Collector is installed and restarted before calculation of SHA (collector.service.controller.SHA in agent.conf), the watchdog services won’t run. Users must wait approximately 2 minutes after installation for SHA to be calculated for the first time before they restart the Collector. After this, future restarts should not cause an issue.

EA Collector – 30.100

Changes

• Added an agent.conf directive (vault.credentials.refresh.delay) to control the Credential Vault integration cache expiration refresh delay.
• Added JMX metrics for monitoring the CyberArk AAM Credential Vault integration.
• Added two agent.conf properties (sse.collectorgroup.jvm.locale and collector.jvm.locale) to allow tweaking of JVM locale, which is sometimes needed to correct date parsing in some locales. The default for both properties is “en_us”.
• Added obfuscation to the password length in log messages.
• Add metrics to LM Logs Collector DataSource to monitor the performance of the new Windows Event Log integration.
• Added resource mapping logic in LM Logs to use the socket address when hostname is not present for Cisco syslog events.
• Added a new configuration discover.instance.wmi.timeout.seconds for the timeout that is explicitly used in case of adding additional monitoring. The default value of the property is 30s. The property is not added by default in the agent.conf. Customers who face the timeout issue can add this property with the desired timeout value.
• Added agent.conf directive webpage.circular.redirect=false to allow circular redirect following by the WEBPAGE Collector.
• Added support for sFlow v1 and v5 for IPv6.
• Added support for new OpenMetrics collection.
• Added support for filtering by ##DESCRIPTION## in Script ActiveDiscovery.
• Improved Logfile task scheduling after Collector restart.
• Updated to Amazon Java Corretto 11.0.10.9.1.
• Updated the Collector to use G1 garbage collector, instead of the deprecated CMS garbage collector.

Fixes

• Fixed an issue where the Collector would intermittently stop forwarding syslog logs to LM Logs.
• Fixed vulnerabilities in xmlrpc-client-3.1.jar and xmlrpc-common-3.1.jar.
• Fixed an issue where JDBC collection would fail if the username contained a whitespace.
• Fixed an issue with Cisco ASA initiator and responder packet fields in traffic flows. Some ASAs were not showing traffic information in NetFlow.
• Fixed the Collector debug command !snmpdiagnose to now support SNMPv3 with AuthNoPriv mode.
• Fixed proxy.port assignment to properly take the value given in the installer.
• Fixed batchscript collection to properly distinguish instances that share names up to the first period. Previously, “test.test.1” and “test.test.2” were seen as one instance.

EA Collector – 29.109

Updates

• Fixed an issue in EA 29.107 where upgrading failed if the Collector is running as root.

Upgrading from EA 29.107

Note: This issue only applies to upgrades if the Collector is running as root.

To upgrade from EA 29.107 if you’re running it as root, you’ll need to first go to the LogicMonitor portal and try to upgrade the Collector. This upgrade will fail.

Once it fails, execute the following script in the Collector installation directory:

/usr/local/logicmonitor/agent/bin/upgradeFrom29107.sh 29107 29109

The Collector will update after the script runs.

EA Collector – 29.108

Updates

• Added integration support for external credential management using CyberArk Vault. See Credential Vault Integration for the LM Collector.

EA Collector – 29.107

Updates

• Fixed various issues to improve performance for LM Logs and Syslog collection.
• Fixed an issue for NetFlow NBAR that caused the Collector memory to max out.

Known Issues

• EA Collector 29.107 fails to upgrade if the collector is running as root. This has been fixed in EA Collector 29.109. See Release Notes.

Downgrading to older versions

If you are downgrading the Linux Collector from EA 29.107 to EA 29.106 or EA 29.105, the commands are different:

To downgrade to EA 29.106, run the following commands:

sudo chmod +x /usr/local/logicmonitor/agent/bin/nonroot_enhancements.sh
sudo /usr/local/logicmonitor/agent/bin/nonroot_enhancements.sh upgrade

To downgrade to EA 29.105, run the following commands:

sudo chmod +x /usr/local/logicmonitor/agent/bin/nonroot_enhancements.sh
sudo /usr/local/logicmonitor/agent/bin/nonroot_enhancements.sh downgrade

EA Collector – 29.106

Important: This Collector version fixes the known issue present in versions 29.101 through 29.105 that was resulting in resources with heartbeats to be incorrectly marked as dead/down.

Enhancements/Updates

• Added JMX metrics for LM Logs
• To better support LM Logs, two new settings have been added to the Collector agent.conf file:
  • lmlogs.syslog.hostname.format – To accommodate syslog hostname headers, set a value of “DO_NOTHING” for this new setting to instruct the Collector to bypass DNS resolution, thus avoiding a resolution on an already-resolved hostname.
  • lmlogs.syslog.useTimestampWhenCollectorReceivedLogs – In order to avoid incorrect time parsing, this new setting should be set to TRUE (FALSE is default) if the syslog events you are sending to LogicMonitor do not include timezone information.
• Non-root installation no longer requires changes to /etc/sudoers. See the Removing Entries from /etc/sudoers File section of these release notes for instructions on removing the entries placed in this file by older Collector installers.
• NetFlow NBAR2 support now honors application slots from optional templates.
• The MongoDB JAR has been upgraded to version 4.0.22.
• Improved handling of blank responses for internal Web Checks.

Fixes

• Fixed the known issue present in versions 29.101 through 29.105 that was resulting in resources with heartbeats to be incorrectly marked as dead/down.
• Fixed issue causing JDBC Active Discovery to ignore non-default ports (the port for a given instance will be stored in WILDVALUE2).
• Fixed SiteMonitor issue causing redirects containing percentage sign (%) characters to fail to be resolved.
• Fixed issue preventing NetFlow data from being displayed.

Removing Entries from /etc/sudoers File

If you installed a Linux-based Collector version 29.105 or earlier running as non-root, edits were made to your /etc/sudoers file to allow the Collector to restart.

As of Collector version 29.106, there is now a separate binary with SUID for this purpose. This means that, upon update to 29.106, edits to your /etc/sudoers file are no longer needed and you can safely remove them—either manually or via script.

Manual Removal of /etc/sudoers Entries

1. Open /etc/sudoers.
2. Remove the following lines:

   Defaults:root !requiretty
   Cmnd_Alias SYSTEMD_LOGICMONITOR_WATCHDOG = /bin/systemctl start logicmonitor-watchdog.service, /bin/systemctl stop logicmonitor-watchdog.service, /bin/systemctl restart logicmonitor-watchdog.service, /bin/systemctl status logicmonitor-watchdog.service
   Cmnd_Alias SYSTEMD_LOGICMONITOR_AGENT = /bin/systemctl start logicmonitor-agent.service, /bin/systemctl stop logicmonitor-agent.service, /bin/systemctl restart logicmonitor-agent.service, /bin/systemctl status logicmonitor-agent.service
   Defaults:logicmonitor !requiretty
   logicmonitor ALL=NOPASSWD: SYSTEMD_LOGICMONITOR_WATCHDOG 
   logicmonitor ALL=NOPASSWD: SYSTEMD_LOGICMONITOR_AGENT 
   logicmonitor ALL=NOPASSWD: /bin/systemctl daemon-reload

3. Run the following commands as root.

   chown root $DEST_DIR/agent/bin/CollectorServiceController
   chmod +x $DEST_DIR/agent/bin/CollectorServiceController
   chmod u+s $DEST_DIR/agent/bin/CollectorServiceController

Where “DEST_DIR” is the location of the installed Collector. The default location is /usr/local/logicmonitor/

Script Removal of /etc/sudoers Entries

1. Open a shell on the Collector.
2. Give the script execution rights:
   1. sudo chmod +x
      /usr/local/logicmonitor/agent/bin/nonroot_enhancements.sh
   2. sudo /user/local/logicmonitor/agent/bin/nonroot_enhancements.sh
      upgrade
   3. You are prompted for the Collector install directory. (If default directory is in use, hit Return.)
   4. The script will remove the entries and restart the Collector.