LME v2.2.0 was released on December 8, 2025, bringing significant improvements that expand deployment options and enhance usability across diverse environments.
Organizations can now install LME on Red Hat Enterprise Linux (RHEL) 9 servers, in addition to Ubuntu 22.04, Ubuntu 24.04, and Debian 12.10. This provides greater flexibility across operating systems.
The release also introduces support for air-gapped or offline installations, enabling deployment in environments without internet access. This is ideal for organizations with strict security or compliance requirements, as well as exercise environments. The downloadable offline archive includes all required images, packages, and dependencies, allowing for repeatable installations and validation testing in fully disconnected systems.
LME v2.2.0 includes updates for SELinux policies, ensuring compatibility with strict security settings.
The release also provides improved installation guides and troubleshooting instructions, reorganized for easier navigation and understanding. Step-by-step documentation for RHEL installations and Podman Quadlet service configuration further streamlines deployment.
This release updates Elasticsearch index templates to better support single-node deployments. New indices now default to zero replicas, eliminating unassigned replica shards and reducing cluster overhead.
We also consolidated and removed outdated templates to prevent conflicts with Elastic’s defaults, ensuring more consistent behavior across new log and metric data streams.
Additional enhancements make it easier to expand disk space and restore security settings after installation, simplifying the overall process for users.
Overall, these updates make LME more accessible, secure, and user-friendly for a broader range of organizational needs and environments.
New! CISA’s LME Training Course
Interested in skills you’ll need to monitor networks, identify users, analyze Sysmon data, and enhance network security? Register for LME’s SS132 webinar course. The training is no-cost and takes place on January 15, 2026, from 10:00–11:30 a.m. EST.
Quarterly LME Webinar
LME’s next quarterly webinar is January 22, 2026, at 1:00 p.m. EST, covering LME features, benefits, updates, and a platform demo. IT admins, cybersecurity defenders, and decision-makers are encouraged to attend.
(Replace with actual registration URLs once you have them.)
We are seeking organizations and individuals to feature in our newsletter. Share how your organization utilizes LME, your approaches, and any feedback you may have. By sharing your experience, you can help others benefit from your insights and practices.
Email us at LoggingMadeEasy@cisa.dhs.gov or connect with us on GitHub Discussions for questions, feedback, or support.
]]>