New Additions

• Eventlog Monitor
  – Added two new properties by customer request, %user% which contains the username of an event and %user_sid% which contains the security identifier of the user.
  – Added another property called %recordnum% which contains the internal number of the current eventlog entry.
  – Added new Option “Always search for the last processed Event using the Checksum”. It uses the checksum feature (needs to be enabled first) to track and find the last processed Event. This is useful for netapp devices, for more details see this article
• Eventlog Monitor V2
  – Added full support for Windows 2008
  – All existing Eventlog Monitor properties are now supported, as well as new properties like keywords and event channel. For more details see the manual.
• Write Eventlog Action
  Added support to write your own custom Eventlogtypes. The custom event log will automatically be created when the action is used the first time.
• Core Engine
  Added new encoding options for UTF8 and UTF16. These encodings can be chosen in many actions like the Forward Syslog Action, the WriteFile Action or the SendEmail Action. The WriteFile Action also has the additional option to write UTF16 files now.
• New Service: RELP Listener
  Added new Service called Relp Listener. Relp (The Reliable Event Logging Protocol) is a new protocol designed by Rainer Gerhards. The new Service does not support many options yet, but fully works with other Relp-enabled applications like Rsyslog.
• New Action: Send RELP
  Added new Action called Send Relp which also utilize the new Relp protocol. The action also works with other Relp-enabled applications like Rsyslog.
• InterActive SyslogViewer
  Added support for additional encoding when exporting Syslog messages into a file. UTF-8, UTF-8 (with preamble), UTF-16 (Little Endian), UTF-16 (Big Endian) and ANSI are available as encoding.
• New Filtertype: IPFilter
  The new filtertype makes it possible to filter for IP Ranges. The IP Filter can basically work on any property, but we recommend to only use it on the %source% property, as we usually can be sure that this is contains a valid IP Address or hostname. The IP Filter can filter against hostnames and IP Addresses, hostnames are automatically resolved using the internal DNSCache (for obvious performance reasons).
• Configuration Client
  – Added support to export and import Services by using the XML Format.
  – The Client can also import xml configuration files by using the command prompt now.

Bug Fixes

• Configuration Client
  – Fixed minor issues with the XML Import/Export function of the Client.
• Filter Engine
  A bug was fixed that caused problems loading the CustomerID and SystemID filters. They are now correctly loaded and processed.
• File Monitor
  When the Option to “Allow Directories or read multiple files” option was enabled, a search handle was leaked during each iteration of the File Monitor Service. This caused an instability of the Agent depending on the growing number of used handles.
• Debug Logging
  A bug in the debug facility caused file handles to leak when debug logging was enabled with the circular logging option. This has been fixed now.