Release history - Monitoring Linux

26.10.1 - 2026-10-26

Supports collectorforlinux version 26.10.x and below

New Alert Catalog: 45 alert templates for Splunk admins, the platform team, security and application teams; the shipped alerts are deprecated
New Inventory dashboard: each host’s distribution, kernel, architecture, CPU, memory, hypervisor and Collectord version
New Services dashboard: failed, restarting and OOM-killed systemd units, and the logins sshd accepted or refused
Network is rebuilt: interfaces with their link state and speed, connections by TCP state, and listening ports with their processes
New Disk I/O dashboard; Filesystem Usage (formerly Storage) lists every mount and charts the fullest
Host adds CPU in cores, load, pressure stalls, paging, TCP and UDP health, and a Kernel tab
Hosts, Host, Process and Services group their panels on tabs
New Configuration page: choose the events-index dashboards or their metrics-index twins, and open the macros to change
The metrics-index dashboards read a metrics index of any name (macro_linux_metrics_base)
New: hosts map to the Common Information Model, Updates included, for Splunk Enterprise Security
Collectord usage lists silent Collectord instances and missing or stale license checks
The Splunk Usage Report reads Splunk’s license meter, with Breakdown, Delivery and Log patterns tabs
The Collectord metrics dashboard adds an Errors tab and a “What Collectord lost” table
Charts pick their bucket size from the time range; the Span, Auto-Refresh and theme controls are gone
Bug fix: the Collectord metrics dashboard charted about nine times the real throughput
Bug fix: the Hosts table coloured the CPU count and memory size instead of their usage
Bug fix: the network dashboards counted Docker bridges as external interfaces

Collectord updates:

Bug fix: the service did not start on amd64 hosts since 5.21.410
Bug fix: the service did not start on RHEL 8, Ubuntu 20.04 or Debian 10 and 11; it now needs glibc 2.28
New .deb and .rpm packages for amd64 and arm64, from signed apt and yum repositories at packages.outcold.solutions; an upgrade keeps your 002-user.conf
The tarball ships 002-user.conf.example instead of 002-user.conf, so an upgrade keeps your settings
The systemd unit keeps Collectord out of swap (MemorySwapMax=0)
New [input.disk_stats] input: one record per block device
[input.mount_stats] mounts = auto: every real filesystem of the host is measured
The host record adds load, memory, pressure stalls, TCP and UDP health, conntrack, open files, the clock and what the host is
Process records carry their CPU in cores, open files, open-file limit and systemd unit
New [input.systemd_units] input: the systemd units in the failed state, every minute
New [input.script::<name>] scripted inputs; the shipped package_updates script reports pending package updates every hour
Journal entries carry their systemd unit, command and uid (systemd_unit, syslog_comm, syslog_uid)
The files rsyslog writes from the journal (/var/log/syslog, messages, auth.log and the like) are no longer read: the journal carries the same lines ([input.files::syslog] ships off); other /var/log/*.log files still are
New, off by default: repeated log lines go out as one counted event, and storms of alike lines fold into one summary a minute
New, off by default: a report of each stream’s heaviest log patterns
Every stats input can send to a Splunk metrics index (indexType = metrics or both)
[general] defaultIndexType sets the index type of every input that does not set its own, shipped as events: switching to a metrics index takes that key and [output.splunk] defaultMetricsIndex
Every loss Collectord counts is a warning in its log, tagged with what was lost
Updated Go runtime to 1.27.3
Bug fix: [input.prometheus::<name>] sections were ignored; they are scraped now
Bug fix: host logs could skip journal entries, and RFC 3339 /var/log/syslog lines were not extracted
Bug fix: collectord diag signalled systemd instead of Collectord
Bug fix: with several HEC urls, restarting the endpoints one by one could gather most Collectord instances on one of them; urlSelection now defaults to random

5.21.411 - 2024-11-18

Supports collectorforlinux version 5.21.x and below

Update application for Splunk Cloud compatibility

5.21.410 - 2023-10-16

Supports collectorforlinux version 5.21.x and below

New dashboard for Collectord metrics
Added version=1.1 to all dashboards for Splunk Cloud compatibility and AppInspector

Collectord updates:

Support global replace configurations to sanitize data before forwarding to Splunk
When both volatile and persistent journald destinations exist, Collectord identifies which has the most recent data
Send more precise timestamps to Splunk
Send logs to multiple Splunk HEC endpoints simultaneously
collectord diag skips performance profiles unless --include-performance-profiles is set
Performance improvements for the acknowledgement database
Acknowledgement database keeps state longer by refreshing entries when files still exist on disk
Verify that only one Collectord instance can access the data folder where Collectord stores its state
Send events with event_id, a unique identifier for messages generated from logs
Splunk output supports maximumMessageLength to truncate messages exceeding this size
Splunk output supports requireExplicitIndex to drop events that don’t carry an explicit index
Weighted Splunk output algorithm when multiple threads are used
Improved grace period for expired licenses - bootstrap new nodes for 14 days after expiration
Report source and source type for events with an incorrect index
Allow multiple values for blacklist and whitelist on host logs
Support for licensing server
Support query parameters in Prometheus URLs for metrics
Support journald databases written by systemd library 247+
Support for CPU-based licenses
Support for cgroupv2
Support for arm64/aarch64 architecture
Upgrade Go runtime to 1.21.3
Upgrade sqlite3 library to 3.43.1
Improved DNS resolution for Splunk output FQDNs
Export internal Collectord metrics in Prometheus format
Forward internal Collectord metrics to Splunk
Include all open file descriptors in collectord diag
Filter host logs with blacklist and whitelist
Blacklist and whitelist Prometheus metrics - significantly reduces indexing cost
Support templates in index, source, and sourcetype
Allow excluding indexed fields when forwarding to Splunk
Bug fix: Collectord clogs the output with WARN messages about closed Splunk outputs
Bug fix: parse commas in log timestamps
Bug fix: Collectord can clog the output if cgroupv2 is used and blkio is not enabled
Bug fix: Collectord crashed when the default output.splunk was missing - now reports the error instead
Bug fix: real license key is no longer included in diag bundles
Bug fix: Collectord reports high CPU usage for newly started hosts
Bug fix: include the values of whitelists and blacklists in diag
Bug fix: verify command does not respect glob patterns for Prometheus inputs (certs, tokens)
Bug fix: trim spaces in token value for Prometheus inputs
Bug fix: Prometheus metrics parser - empty fields could be filled with previous fields
Bug fix: better handling of connections to metrics endpoints exported in Prometheus format
Bug fix: HTTP connection improvements when Splunk is unresponsive
Bug fix: verify command can show an incorrect error when verifying journald input
Bug fix: when an event pattern is used to join multi-line events, errors raised by the pipeline input were swallowed
Bug fix: reduce warnings about failing to get the new event in the pipeline

5.12.272 - 2019-11-08

Collectord updates:

Bug fix: when rotated files reuse FileID/DevID, Collectord stops forwarding rotated files

5.12.271 - 2019-11-07

Collectord updates:

Bug fix: when an event pattern is used to join multi-line events, errors raised by the pipeline input were swallowed
Bug fix: reduce warnings about failing to get the new event in the pipeline
Stability improvements

5.12.270 - 2019-10-22

Initial release