Skip to content

SenHub Agent 0.3.2

2026-06-17 · probe catalog explosion — ~40 new free-tier probes and the first entity/topology model

The largest release so far. The agent grows from a handful of collectors into a broad universal probe catalog: around forty new free-tier probes cover relational and NoSQL databases, search engines, message brokers, web and application servers, containers and virtualization, hardware sensors and OS internals. Alongside the catalog lands the first entity model: every probe now emits typed nodes and relationships into the Toise inventory — services, database instances and VMs anchored to their host, with the first topology edges derived from live host state (outbound dependencies from the socket table, interface addresses). The whole probe fleet also moves to a float64 value bus, and the licence format is now JWT-only.

Action may be required

0.3.0 and later accept only signed JWT licences; the legacy compact SH-XXXX key format was removed (its signing relied on a hardcoded HMAC secret that was cryptographically broken). Only paid deployments are affected: a paid agent still carrying a compact key fails licence validation on upgrade and drops to the free tier — every paid probe is disabled. Free-tier installs (no license: configured) are unaffected. Migrate a JWT licence into agent.license before upgrading a paid host; the agent now logs at ERROR and emits senhub.agent.license.invalid{reason} so you can alert on any host left on a compact key. (#486)

New

  • New databases Relational database probes (free tier): MySQL / MariaDB, PostgreSQL, Microsoft SQL Server and Oracle.
  • New databases NoSQL, key-value and columnar store probes (free tier): Redis / Valkey (#393), MongoDB, Memcached, Cassandra, CouchDB, InfluxDB and ClickHouse.
  • New search Search-engine probes (free tier): Elasticsearch, OpenSearch and Apache Solr.
  • New messaging Messaging and streaming probes (free tier): Apache Kafka, RabbitMQ, Apache ActiveMQ, NATS, Apache Pulsar and Apache ZooKeeper.
  • New web Web / application server and proxy probes (free tier): Nginx, Apache, Apache Tomcat (via Jolokia), WildFly / JBoss, HAProxy, PHP-FPM, Varnish, Envoy and Consul.
  • New virtualization Container and virtualization probes (free tier): Docker, Kubernetes, Proxmox VE and Hyper-V.
  • New hardware Hardware and sensor probes (free tier): S.M.A.R.T. disk health, IPMI / BMC sensors, NVIDIA GPU, Modbus TCP and Chrony (NTP).
  • New os Operating-system probes (free tier): Windows services via the SCM, systemd units and a process monitor.
  • New infra Additional infrastructure probes (free tier): Jenkins, Ceph and Ubiquiti UniFi Controller.
  • New entity Every probe now carries a mandatory EntitySource as a structural invariant, feeding typed nodes into the Toise topology inventory instead of emitting bare metrics. (#471)
  • New entity Monitored services and database instances are emitted as service.instance / db.instance entities with a stable identity and a monitors edge from the agent, anchored to their host via runs_on. (#470, #433)
  • New entity Hypervisors emit their guests: Hyper-V and Proxmox surface each VM as a compute.vm entity keyed on the host machine identity, with runs_on and monitors edges. (#470, #456, #433)
  • New topology Outbound dependency edges are derived from the kernel socket table: an ESTABLISHED connection owned by a local process becomes a durable depends_on edge to an observable network.endpoint, debounced across scrapes so the graph carries topology, not ephemeral flow. (#457)
  • New topology The host's own interface addresses are modelled: each non-loopback interface becomes a network.interface and each unicast IP a network.address, so a connection peer resolves back to the remote host's listener. (#458)
  • New entity The process monitor emits a process entity per monitored process (keyed on process.pid + creation time) with a runs_on edge, in inventory mode only.
  • New checks http_check gains a TLS certificate validity metric with issuer and subject attributes.
  • New CLI New refresh-unit subcommand to update an installed systemd unit in place.

Improved

  • Improved docker The Docker probe reaches full OTel receiver parity — per-core CPU, throttling, deep memory and blkio breakdowns.
  • Improved redis The Redis probe reaches full OTel receiver parity plus cluster, sentinel, tracking and community metrics.
  • Improved metrics The whole probe fleet moved to a float64 value bus: datapoint values are no longer clamped to float32 precision. (#271, #407)

Fixed

  • Fixed probes Probes that split a metric across tag values now register their discriminant tags, so pull sinks (Prometheus, web UI) no longer collapse distinct series into one. (#459)
  • Security databases Credential-bearing probes verify TLS by default and stop smuggling secrets: SQL Server uses a URL DSN with TLS on, PostgreSQL uses a URL DSN with opportunistic TLS, UniFi verifies TLS on login (#461), and MongoDB derives a credential-free instance string and never emits or logs the raw URI (#460).
  • Security hardware The IPMI probe passes its password via the IPMITOOL_PASSWORD environment variable instead of the command line. (#462)
  • Fixed hardware The S.M.A.R.T. and IPMI probes bound their external tool executions with a context timeout (and WaitDelay for a forking child), so a stuck smartctl / ipmitool can't stall the poll loop. (#463)
  • Fixed virtualization Kubernetes and Proxmox emit senhub.<probe>.up so an unreachable API surfaces as down instead of silently disappearing. (#469)
  • Fixed databases PostgreSQL and MySQL tolerate a target that is down at startup instead of failing to register. (#485)
  • Fixed databases PostgreSQL collapses its backend counts to a bare metric and drops never-emitted YAML rows (#467); Kafka computes and emits partition ISR (replicas in sync) (#468); SQL Server's buffer-cache hit ratio is reported as a 0–1 ratio (otel.unit 1). (#466)
  • Fixed metrics Several probe metrics dropped a redundant unit suffix from the metric name (Apache, ClickHouse, Memcached, UniFi), and cumulative HAProxy metrics are now typed as counters rather than an invalid sum. (#464, #465)
  • Fixed licensing A configured-but-rejected licence now fails loud — logged at ERROR with a senhub.agent.license.invalid{reason} self-metric — instead of silently degrading to the free tier. (#486)
  • Fixed Nagios The Nagios output reports CRITICAL when a probe's up metric is 0.
  • Fixed Prometheus The prometheus_scrape probe no longer double-prefixes its own self-scrape, closing a naming loop.
  • Fixed OTLP service.instance.id uses the full agent key; a replaced strategy is shut down before its recreation on config reload.
  • Fixed topology Host-dependency dependents are anchored to their host with a runs_on edge. (#496)

Changed

  • Breaking licensing The legacy compact SH-XXXX licence format is removed; only signed JWT licences are accepted. Paid deployments must migrate a JWT licence before upgrading (see the action-required note above). (#486)
  • Changed licensing MySQL, PostgreSQL, Docker, Redis and the wifi collector moved from the Pro tier to the free tier; the paid catalogue was deduplicated. (#476)

Internal

  • Internal tests Regression guards for the OTel type / unit / naming conventions and discriminant tags (#475), a NATS metric rename and wifi discriminant to close the naming baselines (#480, #481), and an OSS catalogue guard that keeps free-tier probes registered in the binary's import set.
  • Internal entity The EntitySource invariant is exercised per probe, and the agent exposes its own service.instance.id via agentstate for monitors edges. (#471)