0.5.3 — 2026-08-03¶

OTLP receiver handles logs and traces, file-based license, OS Updates probe, multi-tenant OTLP export, host-scoped topology identities, signed Windows binaries, cleaner Windows uninstall, Redis mTLS.

Breaking changes¶

`ad_hybrid` and `exchange_online` metric names normalized to the `senhub.*` namespace¶

The ad_hybrid (Azure AD Connect Health) and exchange_online probes emitted their metrics under an inconsistent namespace — only the up metric carried the senhub. prefix, every other metric dropped it. All metrics from these two probes now follow the OTel-first convention used by every other probe: a senhub.<probe>.* name declared through the probe's transformer.

Who is affected: dashboards or alerts that query these probes over native OTLP. Prometheus consumers are mostly unaffected (the exporter already prefixed senhub_ to the un-namespaced names) except for the two rows marked below.

ad_hybrid (OTLP metric name):

Before	After
`ad_hybrid.sync.health`	`senhub.ad_hybrid.sync.health`
`ad_hybrid.sync.agents.healthy`	`senhub.ad_hybrid.sync.agents.healthy`
`ad_hybrid.sync.agents.total`	`senhub.ad_hybrid.sync.agents.total`
`ad_hybrid.sync.export_errors`	`senhub.ad_hybrid.sync.export_errors`
`ad_hybrid.agent.last_seen`	`senhub.ad_hybrid.agent.last_seen`

(senhub.ad_hybrid.up is unchanged.)

exchange_online (OTLP metric name):

Before	After
`exchange_online.service.health`	`senhub.exchange_online.service.health`
`exchange_online.mail.sent` / `.received` / `.delivered` / `.failed`	`senhub.exchange_online.mail.*`
`exchange_online.mailbox.count`	`senhub.exchange_online.mailboxes`
`exchange_online.mailbox.active`	`senhub.exchange_online.mailboxes.active`
`exchange_online.mailbox.storage.used`	`senhub.exchange_online.mailbox.storage.used` (unit `By`)
`exchange_online.mailbox.quota.exceeded`	`senhub.exchange_online.mailbox.quota_exceeded`

(senhub.exchange_online.up is unchanged.)

Prometheus-specific changes (the only two visible in Prometheus output):

Before	After
`senhub_exchange_online_mailbox_count`	`senhub_exchange_online_mailboxes`
`senhub_exchange_online_mailbox_storage_used`	`senhub_exchange_online_mailbox_storage_used_bytes`

The mail-flow counters are now correctly typed as counters, and mailbox storage now declares the By unit.

`hyperv_ha`, `mssql_ha`, `oracle_enterprise` and `vsphere_ha` metric names normalized¶

The same normalization was applied to the four high-availability probes — they had the identical inconsistency (only up was namespaced) and no transformer. All their metrics now live under senhub.<probe>.*, with declared units and types.

hyperv_ha (OTLP): hyperv.replica.health / .state / .lag, hyperv.cluster.node.state, hyperv.cluster.group.state → senhub.hyperv_ha.replica.* / senhub.hyperv_ha.cluster.*.

mssql_ha (OTLP): sqlserver.ag.replica.role / .health / .connected, sqlserver.ag.database.lag, sqlserver.ag.log_send_queue / redo_queue / log_send_rate / redo_rate → senhub.mssql_ha.*.

oracle_enterprise (OTLP and Prometheus): oracle.awr.*, oracle.ash.*, oracle.rac.*, oracle.dataguard.* → senhub.oracle_enterprise.*. This also fixes a Prometheus namespace collision with the Free oracle probe (senhub_oracle_awr_db_time → senhub_oracle_enterprise_awr_db_time). oracle.rac.instance.count → senhub.oracle_enterprise.rac.instances; the two RAC metrics are now typed as counters.

vsphere_ha (OTLP): vsphere.vsan.* and vsphere.nsx.* → senhub.vsphere_ha.vsan.* / senhub.vsphere_ha.nsx.*. The vSAN object health/degraded pair is collapsed to senhub.vsphere_ha.vsan.objects with an object.state attribute.

(In every case the pre-existing senhub.<probe>.up metric is unchanged.)

Changed¶

Topology entity identities re-keyed once on upgrade¶

Two identity fixes land together in this release. Both cause a one-time re-key of existing topology entities: on the first run of 0.5.3 the new identities appear immediately, the old ones expire through normal liveness and their relationships follow. Expect a brief coexistence of old and new entries and a burst in the topology change feed for one cycle — no action is required, and history remains queryable under the old identities.

Loopback and link-local endpoints are now host-scoped. Dependency endpoints on 127.0.0.0/8, ::1, 169.254.0.0/16 and fe80::/10 gain a fourth identity key (host.id), so host A's 127.0.0.1 — or the per-VM cloud metadata endpoint 169.254.169.254 — no longer collapses onto the same node as every other host's. These endpoints were previously dropped entirely; real local dependencies are now visible without cross-host false joins. Routable endpoints keep their existing identity unchanged. (#713)
SNMP topology identities are canonicalized. Route destinations are stored as canonical CIDR (explicit prefix, host bits zeroed) and every IPv6 address in an identity follows RFC 5952 (lowercase, :: compression). (#239)

New¶

New OTLP The OTLP receiver probe now accepts logs and traces, not just metrics. A signals list (metrics, logs, traces) chooses what it ingests; logs and traces are relayed onward through a configured OTLP export strategy. This turns the agent into a single OTLP intake for every signal type. (#655)
New License The license now lives in its own license.jwt file next to agent.yaml. Hand a customer a single file to drop in place, then restart — no pasting a long token into YAML. license activate writes the file for you, and an existing inline license is moved into it automatically on the next start. (#639)
New Probes New free OS Updates probe (type: os_updates): pending updates, pending security updates and reboot-required status for the host, natively on Linux (apt, dnf/yum) and Windows (Windows Update Agent). Replaces hand-deployed apt-check exec scripts and finally covers Windows patch posture. (#603)
New OTLP The OTLP export strategy accepts a tenant: (alias org_id:) field that stamps the X-Scope-OrgID header on every signal, for multi-tenant backends such as Mimir, Loki or a tenant-aware collector. An explicitly configured header still wins. (#240)
New Probes Pro The PowerStore probe gains opt-in per-volume performance metrics (volume_perf): latency, IOPS and bandwidth per volume, bounded so a large array cannot flood the output. (#628)
New Entities signals.entities.redact_attributes removes named attributes from every emitted entity before export — for deployments that must not ship hostnames, serial numbers or other identifying attributes to the backend. (#682)

Improved¶

Improved OTLP Explicit-bucket histograms pushed to the OTLP receiver are now carried natively end to end — re-exported over OTLP as a real histogram (buckets, sum, count, min/max) and rendered as a classic histogram on the Prometheus endpoint. (#659)
Improved Windows MSI A plain uninstall now leaves a clean tree: the transient logs\ and update\ folders are removed, while configuration, the sealed secret store and the license are preserved. A full purge — including config and secrets — stays opt-in with PURGE_DATA=1. (#648)
Improved Observability The collect_errors_total self-metric is now broken down by probe and reason, so collection failures are attributable per probe and per cause. (#646)
Improved Windows Filesystem metrics now carry system_filesystem_type and system_device attributes, and the host name is a consistent lower-cased FQDN. (#627)
Improved Entities The host entity now carries capacity and nameplate attributes: logical/physical CPU counts, nominal CPU frequency, total memory and disk, virtualization technology and chassis type. (#714)
Improved Entities Cloud On AWS, Azure and GCP instances the host entity is stamped with host.type (instance size), availability zone and cloud account id, read from the instance metadata service. (#536)
Improved Entities The configured deployment.environment is now stamped on the host entity as well as the metrics resource, so environment-aware views and alert weighting work from a single config value. (#718)
Improved OTLP Traces relayed through the OTLP receiver are stamped with vendor-neutral telemetry.relay.* attributes (relay host id/name and instance id), so a span can always be traced back to the agent that forwarded it. Existing attributes are never overwritten. (#698)
Improved OTLP Metrics ingested with delta temporality are passed through faithfully instead of being re-accumulated, and the receiver's ingest self-metric is now published even while the receiver is idle — an agent that has received nothing is visibly at zero rather than absent. (#661, #688)
Improved CLI config init accepts --otlp-protocol grpc|http alongside --otlp-endpoint, so a provisioning script can generate a working OTLP export config for either transport in one pass. (#701)
Improved Observability The log-conduit probes (filetail, linux_logs, windows_eventlog) now publish records_emitted self-metrics, so a silent log pipeline is distinguishable from an idle one. (#701)

Fixed¶

Fixed Windows Network On multi-NIC Windows hosts, network adapters are now matched exactly instead of by a loose substring, and an adapter that matches no performance-counter instance still emits its counters rather than being dropped. (#643, #644)
Fixed systemd The systemd probe now emits its unit as a topology entity — the entity was previously built but never registered, so it never reached the backend. (#471)
Fixed systemd CLI refresh-unit now reconciles the service ExecStart, so a CLI-installed agent keeps its correct start command after a refresh. (#396)
Fixed Probes The snmp_trap probe's own health metrics (rejected community strings, decode panics) were silently dropped before reaching any output. They are now emitted like every other self-metric. (#701)
Fixed Entities Entity liveness slack is now sized on the effective re-emission cadence instead of the internal tick, so healthy hosts no longer transiently expire from the topology under normal operation. (#454)
Fixed License The /license/status API reported a hardcoded list of 4 Free-tier probes; it now reports the real Free tier. (#676)
Fixed systemd The generated root unit places StartLimit* settings in the correct [Unit] section and stages ExecStart properly, so restart rate-limiting actually applies. (#576, #577)

Security¶

Security Windows The Windows binaries are now Authenticode-signed (SENSOR FACTORY SAS, Certum) — both the bare senhub-agent.exe in the ZIPs and the binary the MSI installs, in addition to the already-signed MSI installer. No more SmartScreen "unknown publisher" on manual runs. (#622)
Security Redis The Redis probe now supports TLS client-certificate authentication (mTLS) via tls_cert_file / tls_key_file, plus a custom CA bundle with tls_ca_file. (#405)
Security Dependencies gRPC was bumped to 1.82.1 to address GO-2026-6061, and golang.org/x/text to 0.39.0 to address GO-2026-5970. govulncheck reports no known reachable vulnerabilities in this release.