The NXLog team is constantly improving the quality of NXLog Enterprise Edition and will soon introduce a new major release - NXLog Enterprise Edition 6.0. This release will bring a large number of changes and it is important to correctly adapt your current configuration when upgrading your system.

Warning
 We strongly recommend testing NXLog Enterprise Edition 6.0 operation on a smaller set of devices before commiting to a full-scale upgrade of your complete system. In case of any unexpected system behavior please contact us. Our experts are always happy to help!

The following list includes the most important changes coming in NXLog Enterprise Edition 6.0. System operators and administrators should check their configurations and change them accordingly.

  • From NXLog Enterprise Edition 6.0 onwards the LogqueueSize parameter is measured in bytes (the default value being 2MB) instead of the number of message batches. If you are using this parameter, ensure you adjust the value when upgrading.

    The parameter should be set carefully as it directly affects the amount of RAM taken by pm and om modules. For more information, see the detailed description of the log queue mechanism.

  • Module pm_filter is now obsolete and removed from the package. Filtering is now possible in any module using a conditional drop() procedure in Exec blocks or directives. For more information, see the filter documentation.

  • Modules pm_transformer, pm_ts, and om_eventdb are now obsolete and have been removed from the package.

  • Module xm_admin is being extensively modified and reworked. If you are using the xm_admin API directly please keep in mind that there will be a number of changes in the serverInfo response. For more information, see the xm_admin documentation.

  • The handling of the $raw_event field has changed for both im and om modules, and now follows these rules:

    • All input modules set the $raw_event field.

    • All structured input modules set the $raw_event field according to a specific universal schema.

    • An empty $raw_event field will make all output modules ineffective.

  • $Hostname is now a core field. This means that client operating systems should be able to resolve 127.0.0.1 into a specific name. If the operating system cannot properly resolve it, the name should be added to the hosts file.

  • The im_msvistalog module now processes EventData and Userdata fields, creating the appropriate structures in the answer structure.

Hopefully changes to your configuration are easy and quick to apply, and soon after downloading NXLog Enterprise Edition you’ll be able to upgrade NXLog Enterprise Edition 5 to NXLog Enterprise Edition 6 smoothly to benefit from all of the new features. Remember, in case of any unexpected system behavior please contact us.

NXLog Platform is an on-premises solution for centralized log management with
versatile processing forming the backbone of security monitoring.

With our industry-leading expertise in log collection and agent management, we comprehensively
address your security log-related tasks, including collection, parsing, processing, enrichment, storage, management, and analytics.

Start free Contact us
Share
Related Posts