We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

Change log for KEMP_LOADBALANCER

Date	Changes
2026-05-21	Enhancement: - event.idm.read_only_udm.target.resource.name: Newly mapped `service_info` raw log field to `event.idm.read_only_udm.target.resource.name` UDM field. - event.idm.read_only_udm.principal.resource.attribute.labels: Newly mapped `tool_name` raw log field to `event.idm.read_only_udm.principal.resource.attribute.labels` UDM field. - event.idm.read_only_udm.metadata.collected_timestamp: Newly mapped `event_timestamp_data` raw log field to `event.idm.read_only_udm.metadata.collected_timestamp` UDM field. - event.idm.read_only_udm.target.process.pid: Newly mapped `process_id` raw log field to `event.idm.read_only_udm.target.process.pid` UDM field. - event.idm.read_only_udm.additional.fields: Newly mapped `syslog_ver` , `version1` , `Total` , `Up` , `Down` and `Disabled` raw log field to `event.idm.read_only_udm.additional.fields` UDM field. - event.idm.read_only_udm.intermediary.ip: Newly mapped `inter_ip` raw log field to `event.idm.read_only_udm.intermediary.ip` UDM field. - Added support for SYSLOG format. - Refactored parser logic for event type classification: changed mapping conditions for USER_UNCATEGORIZED , NETWORK_CONNECTION and STATUS_UPDATE event types.
2025-08-25	Enhancement: - Added support Grok pattern for syslog logs. - event.idm.read_only_udm.principal.application: Newly mapped `process_name` raw log field to event.idm.read_only_udm.principal.application. - event.idm.read_only_udm.metadata.product_log_id: Newly mapped `sequenceId` raw log field to event.idm.read_only_udm.metadata.product_log_id. - event.idm.read_only_udm.target.url: Newly mapped `http_path` raw log field to event.idm.read_only_udm.target.url. - event.idm.read_only_udm.additional.fields: Newly mapped `hlen` and `nhdrs` raw log field to event.idm.read_only_udm.additional.fields. - event.idm.read_only_udm.security_result.summary: Newly mapped `log_level` raw log field to event.idm.read_only_udm.security_result.summary. - event.idm.read_only_udm.security_result.detection_fields: Newly mapped `http_version` raw log field to event.idm.read_only_udm.security_result.detection_fields.
2025-04-02	Enhancement: - Added Grok patterns to parse the unparsed logs. - event.idm.read_only_udm.additional.fields: Newly mapped `meta_sequenceId` raw log field with `event.idm.read_only_udm.additional.fields` UDM field - Added a gsub to replace `\\r\\n` with on `message` to parse the logs. - Added a condition check to map event_type to `USER_UNCATEGORIZED` if des_ip is not equal to null, else mapped `event_type` to `GENERIC_EVENT` - Added a condition check before mapping `sshd` to `target.application`. - Added a condition check before mapping `pid` to `target.process.pid`.
2025-01-13	Enhancement: - Added support for a new pattern of syslog logs. - Mapped `event_type` to `USER_UNCATEGORIZED` and `STATUS_UPDATE`.
2023-05-31	Enhancement: Parsed logs with events as `Connected`, `Slave accept`, `Block access to host`. - Mapped `srcip` to `principal.ip`. - Mapped `dstip` to `target.ip`. - Mapped `vs` to `target.ip`. - Mapped `srcport` to `principal.port`. - Mapped `dstport` to `target.port`. - Mapped `resource` to `target.url`. - Mapped `event` to `metadata.product_event_type`. - Parsed failing syslog logs.