Logmanager 3.12 is out. The short version: backups are noticeably faster and safer to restore, account security gets a proper 2FA option, log parsing gets wider out-of-the-box coverage, and we’ve started retiring a few legacy pieces ahead of Logmanager 4. Here’s what’s new and, more importantly, why it’s worth updating.

This version has since been superseded — a new stable version will start to be released in the week commencing August 31st, 3.12.2. – Release notes.

New features

  • Filebeat log processing improved. The source file path, previously left unparsed, is now indexed in the msg.filepath field. If you’re collecting logs from several files on the same host through Filebeat, you can now tell them apart directly in Logmanager — no custom parser needed to figure out which file an event actually came from.
  • Higher TCP connection limit for TLS syslog. The maximum number of concurrent TCP connections on the TLS syslog port (6514) has been increased. Useful if you’re running a larger fleet of devices sending logs over TLS syslog and were bumping into connection limits during peak load.
  • Filebeat/Winlogbeat config lock via registry. You can now disable automatic configuration updates for Filebeat/Winlogbeat agents through a Windows registry setting. This is aimed at environments where endpoint configuration is locked down and managed centrally (e.g. via GPO) — Logmanager will no longer silently push config changes to those machines.
  • Longer dashboard export retention. Exported dashboard data is now kept for 64 hours instead of the previous, shorter window. Handy if you generate exports for reports or audits and don’t always download them the same day.

Backup

  • Database backup now uses an improved tool with a new .s2 format, resulting in noticeably faster backups. In practice, this means shorter maintenance windows and less time spent waiting on backup jobs to finish.
  • Progress can be monitored in the Index backup and Index restore dashboards, so you don’t have to guess whether a backup is still running or has stalled.
  • Backups created on Logmanager 3.12.0 or newer cannot be restored on older versions — worth knowing before you plan a downgrade.
  • Backups from older versions remain compatible and can still be restored on 3.12.0 and later, so your existing backup history stays usable after the upgrade.
Screenshot: Beats agents list with filter applied before bulk delete

Two-factor authentication

  • User accounts can now be secured with TOTP-based two-factor authentication (compatible with any standard authenticator app), with an option to enforce 2FA for all users org-wide. This closes a real gap for teams that wanted stronger login security without standing up a separate SSO/IdP integration just for that.

Parsing and dashboards

  • Removed the Kerio Connect IP prefix list (no longer needed/maintained).
  • Microsoft IIS parser updated: parsed fields can now be configured via lookup tables, and parsing has been extended to cover IIS FTP server logs — so you get more flexibility to adapt the parser to your environment without waiting on us to ship a new version.
  • New parser for Whalebone devices — one less integration you have to build yourself.
  • New parser for ESET PROTECT — same idea: out-of-the-box coverage for a device you likely already have in your environment.
  • ArubaOS parser extended to cover audit trail logs, giving you visibility into admin/config changes on Aruba gear, not just traffic and security events.
  • FortiGate parsers and dashboards updated to correctly process usernames from IPsec VPN logs — if you rely on FortiGate dashboards to see who’s connecting over VPN, that data is now accurate again.
  • Sophos parser updated to correctly assign the src_ip field when processing VPN logs, so source IPs show up correctly instead of being blank or misattributed.
  • Added dashboards for PaloAlto NGFW, so PaloAlto customers get ready-made visibility without building dashboards from scratch.

Bug fixes

  • For Beats agents, the bulk delete action now respects the currently applied filter instead of acting on the full unfiltered list — previously, filtering the list before a bulk delete didn’t actually limit what got deleted, which is exactly the kind of surprise you don’t want when cleaning up agents.
Screenshot: Beats agents list with filter applied before bulk delete

Backwards-incompatible changes

  • Support for Rsyslog TLS < 1.2 has been removed. If any of your log sources still send over older TLS versions, they’ll stop working after this update — worth checking before you upgrade, not after.
  • The WES agent is now fully deprecated. Logmanager 3.12.x is the last version that supports WES agents, so if you’re still relying on WES, now’s the time to plan a migration.
  • Legacy Windows agent menu items have been removed from the UI.
  • None of the above will work in Logmanager 4.

Full details are available in the official release notes.