uberAgent

Fixed issues

The following issues have been fixed in uberAgent 8.0:

Agent

All platforms

  • [I1502]: Elasticsearch receiver RESTToken stored in the OS credential store was not handled correctly.
  • [I1530]: an older valid LAS token in the installation directory now overrides an newer invalid token in the license cache.
  • [I1546]: Unified LAS logging and optimized license check performance for improved traceability.
  • [I1547]: Improved logging to include license state in every validation check.
  • [I1551]: fixed an issue where setting an unknown receiver type resulted in the agent creating a Splunk receiver.receiver.

Windows

  • [I1392]: all internal scripts now use the InternalScriptsTimeoutMs configuration flag.
  • [I1475]: resolved issue where Citrix OData API rate limiting occurred due to improper bearer token handling.
  • [I1488]: registration of the Win32k ETW provider registration may fail if other products have exhausted the OS’s limit. When that happens, don’t shut uberAgent down but ignore the Win32k data source instead.
  • [I1510]: the ConfigSource field of the sourcetype Config:ConfigInfo is no longer sent when uberAgent is configured via Group Policy.
  • [I1516]: fixed a rare agent crash where a child process started by uberAgent is terminated due to a timeout.
  • [I1517]: removed misleading log warning during boot process determination.
  • [I1532]: fixed an agent crash if there are no named performance counters.
  • [I1536]: on multi-session hosts, the URL could be incorrect and might not match the window title of the browser.
  • [I1538]: fixed uAEncrypt not printing encryption/decryption results to the console.
  • [I1554]: fixed an issue where detailed information fields (like ProcID, SessionID, etc.) of the ProcessStartup metric were not sent.
  • [I1555]: Azure Event Hubs events are now sent only when a valid bearer token is available.
  • [I1593]: fixed an issue where forwarded Windows Event Log events could expose incorrect field names or generic Data# mappings.
  • [I1595]: fixed an issue where specifying more than 20 EventIDs in an EventLog stanza caused an error and prevented EventLog forwarding from working correctly.
  • [I1606]: fixed an issue where curl options ignored configured TLS options (TLSRevocationChecksDisabled, TLSRevocationChecksBestEffort, TLSVerifyPeerDisabled, TLSVerifyHostDisabled).

macOS

  • [I1503]: if an empty license was deployed, the daemon would get stuck in an endless loop.
  • [I1556]: improved reliability of CPU related metrics.
  • [I1564]: macOS: improved CPU-usage calculation on session level.
  • [I1572]: The fields PagefileTotalSizeGB and PagefileUsagePercent of the sourcetype uberAgent:System:SystemPerformanceSummary2 are now available on macOS.

Splunk

  • [I1504]: fixed incorrect token usage on the Single Application Performance dashboard.
  • [I1505]: fixed the OsPlatform evaluation for machines sending data with uberAgent installations older than version 7.5.
  • [I1557]: improved visibility on the Process Performance and Application Performance dashboards when the data volume optimized configuration is used.
  • [I1567]: fixed a bug in the Licensing Status dashboard that prevented the expiration date from displaying for non-LAS licenses.
  • [I1571]: fixed a bug in the uberAgent UXM Splunk lookup populate_usertags that caused user tags to be stored multiple times in the lookup.
Fixed issues