New Additions

• Syslog Server
  - Added support for Syslog TLS (RFC 5425). It is possible to use the following modes: anonymous, x509name and x509fingerprint authentication. Note that this requires a valid server certificate as well. More details can be found in the manual.
• Forward Syslog Action
  - Added support for Syslog TLS (RFC 5425) using your own certificate and
  keyfile, or the anonymous mode. When using the anonymous method, no client
  certifcate is needed.
• Send Mail Action
  - Added support for STARTTLS command. This extension is required for SMTP Servers which can optionally enable encryption during communication.
• Updated OpenSSL Components to v1.0.0 for more SSL/TLS stability

Bugfixes

• Send Mail Action
  Fixed time issue in when “Use UTC Time” option was disabled
• Property Engine
  Added property replacer option “replacepercent”. This option replaces all % occurrences with %%, which is needed in case that a string is reprocessed using the property engine.

New Additions

• EventLog Monitor V2
  - Added %ParamX% emulation Option in EventLog Monitor V2
• EventLog Monitor V1
  - Changed Checksum verification method, so it works along with third party Eventlog applications like NETAPP Filer.
  - Implemented Fallback method to reading and process EventLog *.evt Backupfiles created on Windows XP/2003 or earlier. This workaround is needed to process these files on Windows VISTA/7/2008.
• Send Mail Action
  - Added Switch to support old localized date header. This is needed for mail readers, that do not support UTC in date header.
• PlaySound Action
  - Due the security service hardening in Windows, the PlaySound Action will not work on Windows VISTA/7/2008 anymore, unless you run the service in console mode.

Bugfixes

• EventLog Monitor V2
  - Added missing check if rule processing failed.
• EventLog Monitor V1
  - Hardened Checksum Method against various race conditions.
• Forward Syslog Action
  - Fixed Action error handling of the Connect attempt failed.

New Additions

• Core Engine
  - fixed an issue which caused trouble reading MonitorWare Agent Events in the EventLog Viewer.

New Additions

• Full Windows 7 and Windows 2008 R2 Support
• Syslog Listener Service
  - Added support to receive Syslog messages via multicast IP Addresses like 224.0.0.1 for example.
• Send Relp Action
  - Added Keepalive TCP Option
  - the Sendtimeout can now be configured, the minimum value is 30 seconds.
• ODBC Action
  -  Added new setting to support NULL value inserts, if a property is empty.

Bugfixes

• Syslog Listener Service
  - The message seperator is now being removed from the message, if TCP is  used.
  - The SyslogTag is now proberly removed from the Syslog message.
  - Fixed an issue decoding RFC 5424 Header when structured data part was available.
• Forward Syslog Action
  - Fixed a bug in the diskqueue feature, which caused the Action not to retry to connect in some cases.
  - Fixed missing syslog header when “TCP (Persistent Connection)” was used.
  - All Syslog properties are now proberly initialized if a custom syslog header is used.
• SetProperty Action
  - Fixed internal exception when an empty string was used as propery value.

New Additions

• Property Engine
  - Added new property replacer option called ‘nomatchblank’. If this option is used, the Property Replacer will return an empty string if the FromPos or ToPos is not found.

New Additions

• Windows 7 Compatibility
  - Has been tested and fully working on Windows 7 RC Build 7100 or higher.
• Added Free Tools
  - Added free tools like Adiscon logger, logzip and logviewer into the setup. These tools will be available from the tools folder.
• Syslog Listener Service
  - Added support for Syslog RFC5424 Header detection and decoding. This also involves new useable Syslog properties.
• Forward Syslog Action
  - Added support to choose between RFC3164, RFC5424 and a custom defined Syslog header in the Forward Syslog Action.
• EventLog Monitor V1
  - The Client will now automatically detect and load available EventLog types during the first startup.
• Database Monitor
  - Added option to customize the csv separator in the DB Monitor Service.
• File Monitor
  - Added new property %generatedbasefilename% which contains the generated filename without the full path.
• Property Engine
  - Implemented new property replacer options “date-rfc3339″ and “date-rfc3164″ which can be used to get different date formats.
  - Added new Syslog properties: %syslogprifac%, %syslogver%, %syslogappname%, %syslogprocid%, %syslogmsgid%, %syslogstructdata%
• Installation
  - A Windows Firewall exception for the service process is now automatically added during the installation routine.
• Configuration Client
  - Added support to overwrite all Advanced Options at once in the EventLog Monitor V2.

Bug Fixes

• Configuration Client
  - Fixed an issue reading Channels in EventLog Monitor V2 after Internet Explorer 8 was installed.
• DNS Cache
  - The cache has been hardened against race conditions.
• Syslog Listener Service
  - Added a check to avoid processing empty TCP Syslog messages.
  - Fixed a bug in the encoding detection that could lead to invalid decoding of some SHIFT_JIS encoded messages.
• EventLog Monitor V2
  - Removed logging of registry write / read error’s in EventLog Monitor V2. This avoids unnecessary output in the debug log.
• Forward Email Action
  - Fixed an issue with the date header. Some mail readers could understand the date format wrong. We are now using UTC in the mail header, to avoid this problem.
  - Added “Content-Type” header. This is essential for the mail readers in order to be able to decode messages encoded with UTF8, EUC_JP, JIS or SHIFT_JIS.

New Additions

• File Monitor
  - Added a new advanced option to replace NULL bytes inside a file with spaces. This makes it possible to monitor files which include NULL bytes. Spaces again can be compressed automatically.
  - Added support for unlimited subdirectories and files when the advanced option “Allow Directories or read multiple files” is enabled. This means folders will be scanned for files recursive.
• Forward Syslog Action
  - Implemented a “Backup Syslogserver” option. The backup server is automatically used if the connection to the primary server fails. The Action will automatically retry to reach the main server when the next syslog session is opened.
  - Enhanced UTF8 Encoding support in Forward Syslog Action. The Syslog Server needs to be able to detect UTF8 headers.
• Core Engine
  - Enhanced support for encoding and decoding Syslog messages using UTF8, EUC-JP and JIS(ISO-2022JP).
  - Added support for SHIFT_JIS encoding. In order to use any of these encodings, the code pages need to be installed on the system. See the windows locales configuration for more.
• Syslog Listener Service
  Added support for detecting UTF8 and other encoding headers. In order to use UTF8 or other encodings, the Syslog sender needs to prepend the header before the syslog message. The automatic detection of these encodings can be disabled.
• New Filters
  Added missing InformationUnit Type filters for Event Log Monitor V2, SMTP Listener, SNMP Monitor and RELP Listener
• Forward Email Action
  Added support for the “Content-Type” header, so mail clients will be able to display mails with the correct encoding.

Bug Fixes

• Configuration Client
  - When creating a new EventLog Monitor V2, the subkeys for the Event channels were not created automatically. This has been fixed now.
  - When using the configuration client in console mode to import configuration files, error messages were reported in messages boxes. This has been changed to standard console output now.
• DNS Cache
  Due a wrong internal check, the DNS-Cache was always used, even if disabled.
• Forward Syslog Action
  When UTF8 Encoding was used, 2 or more bytes could be missing at the end of a message.
• EventLog Monitor V2
  Fixed the %cageroy% and $catname% properties. They work now exactly like in the old EventLog Monitor.
• EventLog Monitor
  Fixed checksum comparison bug during startup. This bug only applied if the advanced option “Always search for the last processed Event using the Checksum” was enabled.

Bug Fixes

• EventLog Monitor V2
  - Fixed handling of priority and facility.
• Windows 2000 Support
  Suppotr for Windows 2000 has been fixed in this release.

Bug Fixes

• EventLog Monitor V2
  - Fixed a memory leak in the new EventLog Monitor which was introduced due the enhancements of this Service in MonitorWare Agent 6.0.
• Configuration Client
  Added support to import xml files by using the command prompt and the /f switch, which means no request will be made to import the configuration.

New Additions

• Eventlog Monitor
  - Added two new properties by customer request, %user% which contains the username of an event and %user_sid% which contains the security identifier of the user.
  - Added another property called %recordnum% which contains the internal number of the current eventlog entry.
  - Added new Option “Always search for the last processed Event using the Checksum”. It uses the checksum feature (needs to be enabled first) to track and find the last processed Event. This is useful for netapp devices, for more details see this article
• Eventlog Monitor V2
  - Added full support for Windows 2008
  - All existing Eventlog Monitor properties are now supported, as well as new properties like keywords and event channel. For more details see the manual.
• Write Eventlog Action
  Added support to write your own custom Eventlogtypes. The custom event log will automatically be created when the action is used the first time.
• Core Engine
  Added new encoding options for UTF8 and UTF16. These encodings can be chosen in many actions like the Forward Syslog Action, the WriteFile Action or the SendEmail Action. The WriteFile Action also has the additional option to write UTF16 files now.
• New Service: RELP Listener
  Added new Service called Relp Listener. Relp (The Reliable Event Logging Protocol) is a new protocol designed by Rainer Gerhards. The new Service does not support many options yet, but fully works with other Relp-enabled applications like Rsyslog.
• New Action: Send RELP
  Added new Action called Send Relp which also utilize the new Relp protocol. The action also works with other Relp-enabled applications like Rsyslog.
• InterActive SyslogViewer
  Added support for additional encoding when exporting Syslog messages into a file. UTF-8, UTF-8 (with preamble), UTF-16 (Little Endian), UTF-16 (Big Endian) and ANSI are available as encoding.
• New Filtertype: IPFilter
  The new filtertype makes it possible to filter for IP Ranges. The IP Filter can basically work on any property, but we recommend to only use it on the %source% property, as we usually can be sure that this is contains a valid IP Address or hostname. The IP Filter can filter against hostnames and IP Addresses, hostnames are automatically resolved using the internal DNSCache (for obvious performance reasons).
• Configuration Client
  - Added support to export and import Services by using the XML Format.
  - The Client can also import xml configuration files by using the command prompt now.

Bug Fixes

• Configuration Client
  - Fixed minor issues with the XML Import/Export function of the Client.
• Filter Engine
  A bug was fixed that caused problems loading the CustomerID and SystemID filters. They are now correctly loaded and processed.
• File Monitor
  When the Option to “Allow Directories or read multiple files” option was enabled, a search handle was leaked during each iteration of the File Monitor Service. This caused an instability of the Agent depending on the growing number of used handles.
• Debug Logging
  A bug in the debug facility caused file handles to leak when debug logging was enabled with the circular logging option. This has been fixed now.