Agent v2.28.0

A new compactor metric for files dropped without upload, a bounded retry policy for Edge Delta backend writes, Google Cloud Logging delivery fixes, eBPF tracer shutdown fixes, and a dependency upgrade to address a CVE.

  2 minute read  

November 6, 2026

New Features

  • Compactor Metrics: Added ed.compactor.upload.dropped_file.rate, a gauge counting the files dropped without upload in the last minute because no presigned URL was obtained, such as when the organization is over quota.

Improvements

  • Edge Delta Backend Writes: Writes that request a presigned URL now share one retry policy: a 500ms initial backoff, a total budget of 30 seconds, and at most 3 attempts. The budget is twice the 15 second presigned URL request timeout, so an attempt that times out can still be retried. The attempt cap keeps a fast failure from retrying for the full 30 seconds. This covers the event, metric, pattern, and pattern metric writers.
  • Compactor Uploads: An upload that succeeds after earlier failures is now logged with the number of failed attempts and the file age, and a file dropped for age logs the same count.

Bug Fixes

  • Kubernetes Trace Source: Several shutdown paths in the eBPF tracer are fixed. Each monitor’s own context is cancelled on stop so eBPF readers unblock before the wait group completes, and the per-interface DNS reader drains its events on exit rather than leaking. Sends on the report and name-request channels are context aware so none runs after stop, and the comm output channel is closed exactly once.
  • Google Cloud Logging Destination: A field that metadata_mapping does not resolve now falls back to the node’s own log_name, resource_type_expression, resource_labels_expression, labels, and severity_text before the Google Cloud Logging defaults.
  • Google Cloud Logging Destination: When one item in a batch fails to build, the entries that did build are still sent, and the error names the size of the item that exceeded the entry limit. Writes are now sent with partial success enabled, so entries Google Cloud Logging rejects are counted in ed.pipeline.node.upload.rejected_records while the rest of the batch is written.
  • Compactor Uploads: Upload logs now record the file path and destination name rather than the whole structures, which keeps the destination’s API key out of the log line.

Security

  • Dependency Upgrades: Upgraded go-jose/go-jose to v4.1.6 to address CVE-2026-116587.