Skip to content

0.6.5 — 2026-10-29

0.6.5 masks secrets in log records by default (credentials, PRTG licence keys, private keys, tokens), reads Proxmox VE disk, ZFS and backup health, adds Azure Monitor, Azure Log Query and Microsoft Entra ID probes (Pro), and gives the console a page per probe. It also restricts the Windows data folder to SYSTEM and Administrators, keeps filetail from losing lines at a rotation on Windows and sends a quiet multiline record after 5 seconds, ends an exec command with its children when the agent stops, makes config check warn on keys nothing reads, and turns the PRTG Check Result channel off by default.

Before you upgrade

  • config check now warns on keys that nothing reads, so a configuration that exited 0 may exit 1. A key of a probe entry outside params (a typo next to name, type, params or custom_tags), and a key inside the prtg, prometheus or tls block of the http output, were accepted without a word; each is now a warning naming the probe or the key path. An unread key directly under a storage strategy such as http is also a warning now, where it used to be an error (exit 2). The agent is unchanged: it starts and ignores these keys, as before. Fix or remove the key, or allow exit code 1 in the script that runs the check.
  • IBM i hosts upgraded from 0.6.1 or earlier: about a fifth more series. Since 0.6.2 every metric the ibmi probe collects has its definition, so outputs publish metrics they used to drop with a mapping error: journals and journal receivers, output queues, licensed products, system values, subsystems, TCP, memory pools, library list, job queues, HTTP server and collector progress. On a test partition this took the probe from about 920 to about 1,120 series; the figure grows with the number of journals, receivers, output queues and licensed products. Hosts already on 0.6.2 to 0.6.4 see no change. To leave a family out, list its collector in disabled_collectors, for example disabled_collectors: [journal_receiver, output_queue, license]. See IBM i.
  • filetail multiline records are sent after 5 seconds of quiet. A record in progress used to wait for the next message, or for the agent to stop. It now goes out once no line has come for multiline.flush_timeout (5 s by default); a writer that pauses longer in the middle of a message has it split in two, the lines after the pause folding together into a second record. Set a longer timeout for it, or 0 for the previous behaviour. A record that would pass max_bytes_per_line is now sent and the next one started, instead of dropping every line past the cap. config check warns on negate: true with match: after and a pattern anchored at the start of the line: that is Filebeat's spelling of "a timestamp starts a record", which here folds every timestamped line into the record of the last line without one. Write negate: false. See filetail.
  • PRTG sensors no longer carry the Check Result channel by default. 0.6.4 added it to every database, application and active-check probe, referencing the senhub.probe.check.result lookup; on a PRTG core without the SenHub lookup files the sensor turned Warning (PE272). The channel is now off unless prtg.check_result_channel: true is set in the http output, and then it keeps the same lookup name and values. The same option governs the unresolved-target channel of http_check and tcp_dial (senhub.probe.check.target.unresolved), left out without it. Service channels of systemd and winservices no longer use the host.service.running lookup, with or without the option: they show a plain 0/1 value with an error limit below 1, so a stopped service still turns the sensor Error. On a winservices sensor created before 0.6.4, that lookup turned the sensor Warning (PE272) even with the lookup file installed, because PRTG cannot add a lookup to a channel it created as a plain number. PRTG keeps a channel that stops receiving data: if you installed the lookups and want to keep the channel, set the option before upgrading (0.6.4 runs with it and ignores it; only its config check reports it as unread); otherwise delete the channel or re-add the sensor. See Installing PRTG value lookups.
  • Linux hosts installed with senhub-agent install and upgraded from 0.6.3 or earlier: refresh the systemd unit. This concerns only hosts installed by the CLI (ZIP or script); the .deb and .rpm packages replace their unit themselves, and Windows has none. update replaces the binary but, up to this version, not the unit, and the unit written up to 0.6.3 forbids the read-only adjtimex call the clock synchronisation metrics need. The agent runs, but without senhub.system.clock.*, and its log says so. After the upgrade, run sudo /usr/local/bin/senhub-agent refresh-unit --yes, then sudo /usr/local/bin/senhub-agent restart; drop-ins under senhub-agent.service.d/ are kept. sudo /usr/local/bin/senhub-agent doctor reports a unit that differs from the binary's (install.unit) before and confirms it after. The upgrade to this version is run by the older binary, so it cannot do this for you; once a host runs this version, its next update refreshes the unit itself before restarting the service (--no-refresh-unit leaves it alone). See Refresh unit.
  • Secrets are masked in log records by default. Every log record now goes through a masking step before any output receives it: the value of password, passwd, pwd, passhash, apikey, api_key, token, access_token and secret parameters (query strings, form bodies, key=value text, JSON) becomes ***, and the credential of an Authorization: header is masked while its scheme is kept. This covers, for instance, a PRTG passhash= that a reverse-proxy access log shipped by filetail used to carry in clear. Records that contain none of these keys are unchanged. Masked occurrences are counted in senhub.agent.logs.redacted by probe and rule. To turn the built-in rules off, set logs.redact.preset: false; to mask more, add logs.redact.rules (name, RE2 pattern, replacement). See Logs Section.
  • The PRTG licence key, private keys, tokens and AWS keys are masked in log records by default. PRTG writes its licence key and system id in clear in Core.log and CoreActivationLog.log each time its core starts, so a filetail probe on those files shipped them. The log redaction preset now also masks the PRTG licence key (licensed for "<name>" (***)) and system id (SYSTEMID-***), the body of PEM private key blocks (also when each line of the key is a separate record of the same source: from the BEGIN line to the END line, every record of that source is masked, a log line written in the middle of the key included; a block with no END line is abandoned after 200 records or 64 KiB, with a warning in the agent log; filetail also masks the rest of a key when the agent restarts in the middle of it), JSON Web Tokens, AWS access key ids and the value of aws_secret_access_key, in every log record whatever probe read it. They are counted in senhub.agent.logs.redacted under the rules prtg_license_key, prtg_system_id, private_key, jwt, aws_access_key_id and aws_secret_access_key, names a custom rule can no longer take. See Logs Section.
  • Log masking also covers URL passwords, query-string keys and bearer tokens, and can be turned off per probe. The preset now masks the password of scheme://user:password@host URLs (url_userinfo), the value of ?key=, &sig=, &signature=, &access_key= and similar query parameters (url_query_secret), a Bearer credential written outside an Authorization header (bearer_token), and the values of refresh_token, id_token and client_secret. Logs received by the OTLP receiver are masked on the verbatim copy as well as on the flat one. log_redact: false on a probe entry leaves that probe's records unmasked. The two parameter rules were rewritten as a single linear pass: a 200-byte access-log line carrying a passhash= is masked in about 1.5 microseconds instead of 130. Measured on a host, masking costs about one point of one CPU core at 2,000 lines per second (2.4 % to 3.5 %). See Logs Section.
  • proxmox: Ceph, PBS, quorum, HA and replication are preview and off by default. The probe is validated on a single Proxmox VE node (QEMU guests, ZFS and directory storages). Cluster quorum, high availability, storage replication, Ceph-backed storages and Proxmox Backup Server storages are in preview: not validated in a real environment, and each is switched on explicitly with enable_cluster, enable_ha, enable_replication, enable_ceph and enable_pbs. Left off, a part makes no API call and produces no series of its own. The usage and capacity of every storage, rbd, cephfs and pbs included, are still published as before; their state series and the backup archives they hold need the flag. The HA, quorum and replication series seen with earlier builds disappear until you enable them. See Proxmox VE.
  • SNMP Poll: a device without a usable chassis serial is identified by its LLDP chassis MAC, before its engine id. The network.device.id precedence is now serial: > mac: > engine: > name: > mgmt:. The snmpEngineID can be set by configuration, and two switches carrying the same value became one device whose attributes alternated between the two. A device with no single chassis serial whose LLDP chassis id is a MAC address (a stack, or a switch that keeps its serial on a board) moves from engine: to mac: at its first sweep after the upgrade: its entity is replaced by a new one and its topology history starts again. The agent retires the old device and every entity under it (interfaces, routes, neighbours) with the reason rekeyed, so the change does not read as an outage; an agent stopped across the change leaves them to expire instead. Devices identified by serial:, and devices without LLDP or with a chassis id that is not a MAC, keep their id. When two targets of one agent still resolve to one id while their sysName or chassis MAC differ, the agent logs "two SNMP targets resolve to the same device id" once per pair and counts it in senhub.snmp.identity.collisions. A stack identified by its chassis MAC changes id when the MAC follows a new master, unless the stack keeps its bridge MAC (on Comware, irf mac-address persistent always); the old id and its subtree are then retired with the reason rekeyed, as is a replacement switch that keeps the name of the one it replaces. The device also carries its raw identity parts: hw.serial_number, senhub.chassis.serial_numbers (every stack member's serial), senhub.lldp.chassis_mac and senhub.snmp.engine_id; when the engine id embeds a MAC other than the chassis MAC, the agent logs "snmpEngineID does not embed the chassis MAC" and sets senhub.snmp.engine_id.mac_mismatch.
  • Collectors configured by environment variables with a Container Apps discovery start following its jobs. A collector whose applications discovery is declared with SENHUB_PROBE_* variables and that had no jobs probe publishes, after the upgrade, the executions of every job of the same subscription and resource groups (series, entities and console lines). Set SENHUB_PROBE_JOBS_TYPE=none before upgrading to keep the previous behaviour. Configurations written in files are unchanged.
  • SNMP Poll: system routes are left out of the topology. snmp_poll no longer publishes reject and blackhole routes, routes to multicast, loopback and link-local destinations, 0.0.0.0/32 and 255.255.255.255/32, local host routes to an address the device publishes, and local routes to a subnet broadcast address. Measured on a customer core switch, these are a few percent of the table; on smaller devices, local host routes can be a quarter of it. Routes the previous version published are retired with the reason excluded_by_config at the first complete sweep of each device after the upgrade, and so is a route the running agent stops publishing because of the filter; senhub.routes.filtered on the device counts the routes left out. The filter runs before max_routes, so its slots go to learned routes. Set include_system_routes: true on the probe to publish them again. See SNMP Poll.
  • process with top_n reports a per-name roll-up. With filter.top_n, the probe now ranks process names and reports the roll-up of each name in the top, without process.pid and process.creation.time on the series. Short-lived processes no longer create new series each time they enter the top, so dashboards built on per-process series under top_n change shape. Per-process series remain available with detail.per_pid: true, which agent config check flags with a cardinality warning.
  • A monolithic configuration is split into one file per probe. The agent splits a monolithic agent-config.yaml at start, as it has since 0.6.2, and config migrate does it on demand. Each probe now goes to its own probes.d/NN-<name>.yaml (numbered from 10, in the original order) instead of probes.d/00-host.yaml. A host still on a monolithic file is therefore split at its first start in 0.6.5. The resolved configuration is unchanged, the agent checks it before keeping the split, and running the migration again changes nothing. config init still writes 00-host.yaml.
  • Going back from an MSI install takes an uninstall or the older ZIP. The MSI refuses to install an older version over a newer one (code 1603), so a Windows host upgraded by MSI cannot be returned to 0.6.4 with the 0.6.4 MSI. Before upgrading, copy %ProgramData%\SenHub\: an uninstall deletes it, agent key included. The two ways back are in Going back to an earlier version on Windows.

Features

  • The console no longer keeps the administration key in its address. Opening /web/{admin-key}/ sets a session cookie and redirects to /web/_/...; scripts can send Authorization: Bearer <admin key> to /api/_/.... The key in the path keeps working; in an /api/ path it is deprecated and logs a warning once. PRTG, Nagios and Prometheus URLs are unchanged. See Web interface.
  • Console: a page per probe, and series on the Overview. probes?view=<name> shows one probe's state and full failure reason, current series, read-only configuration and recent events, and every probe or output row on the Overview and the Probes list now opens its page. The Overview adds a "Series exported" card (per output, top probes, created since start) when the build meters series, backed by the new GET /api/{key}/info/self-records. See Web console.

  • Proxmox VE: disk health, ZFS, backup and task series. The proxmox probe now reports physical disk SMART state and SSD life remaining (hw.physical_disk.status, hw.physical_disk.endurance_utilization), ZFS pool state, size, usage and fragmentation (hw.logical_disk.*, proxmox.zfs.pool.fragmentation), the age and outcome of each guest's last backup, the number of guests covered by no backup job and of enabled jobs, storage availability, the count of failed tasks, each failure also published as an ERROR log record, the state of HA-managed guests and cluster quorum (proxmox.ha.resource.status, proxmox.ha.quorum.status), and the status and last-sync age of storage replication jobs (proxmox.replication.job.status, proxmox.replication.job.age). Status series carry one point per state (1 for the current state, 0 for the others).

  • Azure Monitor probe (Pro). The new azure_monitor probe discovers the resources of one or more subscriptions through Azure Resource Graph, filtered by type, resource group and tag, and publishes their platform metrics, their provisioning and product state, and optional Service Bus, App Service Plan and VM disk figures. Entity emission is off by default; turn it on only with a Toise 0.23 or later, which registers the cloud.resource type (an older one refuses the records, counted in senhub.agent.export.rejected).

  • Azure Log Query probe (Pro). The new azure_log_query probe runs one KQL query on a Log Analytics workspace each cycle and publishes every row (channel, value, unit) as a gauge named azure.log_query.<channel>.
  • Microsoft Entra ID probe (Pro). The new entra_id probe reads one tenant through Microsoft Graph in 13 modules: secret and certificate expiry, directory synchronisation, users, licences, groups, applications, devices, service health, authentication methods, privileged access and security posture. Each module needs its own Application permission with admin consent.
  • SNMP Poll: choose which interfaces get metric series. The new interfaces block of snmp_poll keeps the nine per-interface series for the interfaces you select only: include and exclude regular expressions on ifName or ifDescr, a types allow-list (ethernetCsmacd, ieee8023adLag, or an IANAifType number), admin_up_only, oper_up_only, and a max_interfaces cap that logs a warning when it cuts. Without the block nothing changes. Topology entities keep every interface. See SNMP Poll.
  • Azure Container Apps: the jobs are followed with a discovery of the applications declared from the environment. When SENHUB_PROBE_<NAME>_TYPE=azure_container_apps has a discovery block and no SENHUB_PROBE_JOBS_* variable is set, the agent adds a jobs probe on the same identity and resource groups, so a container image configured by variables follows its Container Apps jobs without a second set of variables. It reads the Resource Manager API and the jobs' console stream, not Log Analytics. SENHUB_PROBE_JOBS_TYPE=none turns it off. See Azure Container App Jobs.
  • SNMP Poll: every MAC a device learned can be published as a neighbour. With the new neighbors: true parameter, snmp_poll reads the bridge forwarding and ARP tables of the polled and discovered devices and publishes one network.neighbor per MAC the device learned, identified by the device and the MAC, with the IP addresses its ARP table gives, a neighbor_of link to each port it was learned on and, when this agent knows the owner, a resolves_to link to the interface that owns the MAC. At most max_neighbors neighbours per device (1000) are published; the device carries senhub.neighbors.limit and senhub.neighbors.omitted, and the agent logs the cut once at Info. A failed table read keeps the previous neighbours. Off by default; without it nothing changes. The receiving graph must know network.neighbor and the senhub-agent/snmp-fdb and senhub-agent/snmp-arp scopes. No metric series is added. See SNMP Poll.
  • NetScaler: probe dump captures raw NITRO statistics (Pro). senhub-agent probe dump netscaler --out <dir> reads the configured netscaler probe and its credential, fetches stat/ns, stat/protocolip and stat/system once each and writes one JSON file per resource, readable by its owner only. No credential is written or printed, and a response that contains the password is refused. It is meant for support: a capture shows which counters an appliance exposes.
  • filetail: records emitted per file. The new senhub.filetail.file_records_emitted counter, tagged with log.file.path, counts the records published from each followed file. Next to senhub.filetail.file_size, a counter that stays flat while the file grows shows a file that is no longer read, which the probe-wide total hides behind busier files.

Fixes

  • secret rm no longer cancels silently in a script. When its [y/N] prompt got no usable answer (a script, a scheduled task, remote execution), secret rm kept the secret and exited 0. It now prints a message on stderr and exits non-zero, whether there was no input or the answer was not y; a piped y is still accepted. --yes skipped the prompt already; -y is now accepted too. See CLI.
  • SNMP Poll: the start-up hold of a device's topology is logged. A device with LLDP neighbours that no other snmp_poll instance has polled yet is withheld from the map for the first third of the entity liveness interval, so that no mac: placeholder is created for a neighbour another instance is about to poll. The hold was silent; the agent now logs it once per instance at Info, with the number of unresolved neighbours and the time left.
  • Windows: an MSI update says its signature was verified. The agent always checked the MSI's minisign signature before launching msiexec, but only the archive path logged it. The MSI path now logs Update MSI signature verified before the installer starts.
  • exec: a command running when the agent stops is ended with all its children. Stopping the agent (service stop, upgrade, restart) used to leave a running exec command and its children alive. They are now killed with the agent, on Windows too, where each command runs in a job object that also ends it if the agent dies. On Windows, a process the command leaves running after it exits is ended as well: run a daemon as a service, not from exec.
  • Windows: filetail no longer loses the last lines written before a rotation. At a rotation by rename and create, the lines the application wrote to the old file just before the rename (0 to 3 lines in a measured run) were never read. The probe now reads the end of the rotated file for up to one second, then releases it.
  • Windows: filetail picks up a rotated file within seconds. When a log was renamed and recreated within the first quarter-second of the tail's wait, and the new file had already grown past the position read in the old one, the tail went on reading the renamed file; the new lines arrived only when the stall check restarted it, 30 to 45 seconds later. The probe now fixes each file's identity when it opens it and, on Windows, checks every second that the path still names that file, restarting from the first byte of the new one.
  • filetail: a restarted tail no longer sends a few lines twice. When the probe restarted a tail that had stopped following its file (logged as tail does not follow its file; restarting it), the lines the old tail was handing over at that moment were sent again by the new one. The restart now waits, for at most five seconds, until the old tail has stopped, and resumes after the last line it sent.
  • filetail: a multiline record is no longer lost when the agent is killed. The read position saved on disk included the lines of a multiline record still being assembled, so an agent killed (kill -9, out of memory) before the record was sent restarted after it. The position now stays before a record until it is sent, and the record is read again at the next start.
  • Windows: %ProgramData%\SenHub is restricted to SYSTEM and Administrators. The folder holds the administration key, the secret store and the licence, but kept the default %ProgramData% permissions, under which local users can read files in subfolders. The MSI now sets a protected ACL, and the agent applies it before writing and repairs the folder and everything in it at start, which covers upgrades. A custom configuration path is left alone.
  • cassandra and docker no longer log "Metric has no OTel mapping" for senhub.probe.check.result. Both probes emitted the check result series without declaring it, so the OTLP and Prometheus outputs dropped it and logged a warning once per probe. It is now exported like the same series of the other database, application and active-check probes, and a test fails when a probe emits it without declaring it.
  • An unreachable SNMP device no longer stalls its probe for minutes. snmp_poll swept the topology of a device that answered nothing with a dozen reads in a row, each waiting for timeout and its retries, inside the poll cycle, and tried again on every cycle; a device that stopped answering after it was identified cost one wait per metric column on every cycle. A sweep and a poll cycle now stop at their first read that times out when nothing has answered yet; a sweep also stops its walks once it has run for one poll interval, and after a failure is tried again at the next cycle, then twice as late each time, up to five minutes.
  • OTLP: rejected log records are reported when the logs queue is off. When a receiver accepts a logs export but refuses some records (partial_success), the agent now counts them in senhub.agent.export.rejected and logs the receiver's reason with the logs queue disabled, as it already did with the queue enabled.
  • filetail: a path under /home, /root or /run/user now logs a warning. The systemd unit sets ProtectHome=true, which hides these directories from the service, so such a path was silently never read. The probe now warns at start and names the fix, a drop-in with ProtectHome=read-only, documented in File Tail.
  • Windows: install from the ZIP no longer runs over another install. On a machine where a senhub-agent service from another install is already registered (the MSI, or a ZIP extracted elsewhere), senhub-agent.exe install now stops without changing anything, and says how to upgrade that install instead.
  • install --ok-if-unchanged. Run again on a machine already in the requested state, install exits 3 and writes nothing. With the new flag it exits 0 instead, as config init --ok-if-unchanged already did, for GPO, SCCM or Intune scripts that read any other code as a failure. See Exit codes.
  • OTLP relay: relayed agents keep their identity, and the relay keeps its own series. An agent receiving other agents' metrics with otlp_receiver re-exported them under its own identity, and their probe names could retire the relay's own cpu, memory, logicaldisk and network series, which disappeared from the relay. Relayed points now keep only the source's probe identity, and the relay's own probes are no longer affected.
  • OTLP receiver: gzip bodies are accepted over HTTP. The otlp_receiver HTTP endpoint answered 400 to gzip-compressed requests, while the otlp output sends gzip by default, so an agent relayed over HTTP needed compression: none. It now accepts gzip and identity, answers 413 when a body, compressed or not, exceeds the 4 MiB receive limit once decompressed, and 415 for any other Content-Encoding.
  • OTLP receiver: no more "bound to ALL interfaces without authentication" warning when a bearer_token or allowed_cidrs is set. The startup warning was logged for any wildcard address, even when the receiver already required a token or restricted the source addresses. Both were enforced all along; only the warning was wrong. It now appears only when the receiver listens on every interface with neither.
  • OTLP logs: oversized exports are split, size refusals are not queued. Entity events and logs are now exported in parts no larger than signals.logs.max_export_bytes (3 MiB by default, below the 4 MiB message limit of common receivers). Parts are cut between records, so an entity always keeps its complete relationships. A gRPC RESOURCE_EXHAUSTED answer without a retry hint, like an HTTP 413, is now treated as a permanent refusal: the batch is counted and logged once instead of being queued and replayed forever. With a retry hint it is still retried. When the collector refuses a part for its size (gRPC RESOURCE_EXHAUSTED, HTTP 413, or the HTTP 400 "request body too large" of the OpenTelemetry Collector), the agent halves it down to a single record and lowers its working limit for the next batches, so a collector with a lower limit, such as 1 MiB, receives every record. A single record larger than the collector accepts is dropped and counted in senhub_agent_otlp_dropped_total{reason="record_too_large"}. When part of an export fails because the collector is unreachable, only that part is queued on disk: the parts already delivered are no longer sent twice nor counted as rejected. See Exports larger than the collector accepts.
  • doctor tests the event output with a POST. The reach test of an HTTP event output sent a HEAD request, which the event intake answers with 404, so doctor reported a working output as failed. It now sends a POST with an empty batch: a 400, 401, 403 or 405 answer proves the route exists, a 404 or a 5xx fails.
  • NetScaler: system throughput, TCP connections and packet rates are read from the right objects (Pro). These series read 0 on every appliance. They now come from stat/ns (throughput, HTTP rates, TCP connections) and stat/protocolip (packet rates and totals); a counter the appliance does not return is skipped with one warning instead of being published as 0.
  • ping_gateway and ping_webapp: 100 % loss is reported as 100 % (Pro). On macOS the 100.0% packet loss line was read as 0 % and the probe ended in an error. Total loss is now reported as packetLoss 100 on Linux, macOS and Windows, including localised Windows output and a target on the agent's own subnet that is down, whose "Destination host unreachable" replies from the local address Windows counts as received.
  • Windows: stopping the agent no longer waits on the local status channel. Closing the named pipe of the local status channel can hang in the pipe library; the agent's shutdown now waits for it 5 seconds at most.
  • config check names the ProtectHome fix for a filetail path under /home. On Linux, agent config check now warns, like the probe at start, when a filetail path is under /home, /root or /run/user, and gives the drop-in that makes it readable.

Known limits

  • SNMP Poll: a device first read with a failing ENTITY-MIB and sysName can briefly appear twice. A device whose very first sweep could read neither its ENTITY-MIB nor its sysName is published under the id that sweep resolved; once it reads in full, that first entry expires after the entity liveness interval instead of being retired. A device that stops answering its identity reads after it was identified keeps its id, and leaves the map with the reason unmonitored if the reads keep failing for three topology intervals; it is then resolved again from what it answers, and returns under its full id once it reads in full.
  • SNMP Poll: an identity read that fails for more than three topology intervals rewrites the device twice. When the reads stop failing, the subtree published under the id resolved during the failure is retired and published again under the full id: a device whose ENTITY-MIB reads keep failing and recovering on that time scale churns its topology. The device leaving with the reason unmonitored and reappearing under the id resolved from its partial answers are not linked: a reader sees one device leave and another one appear.
  • filetail: an abrupt stop can lose the last seconds of lines read, or send a burst again. After an abrupt stop (kill -9, power loss), the last seconds of log lines read by filetail may be lost, and a stop within about 2 seconds of a burst sends the whole burst again: the read position is saved every 2 seconds and the delivery is at least once. A normal service stop is not affected.
  • Log masking: a private key is masked for 200 records or 64 KiB at most. Beyond that bound, the rest of a key with no END line is not masked, and a key opened more than 64 KiB before the position filetail resumes from after a restart is not resumed.
  • secret rm in a Windows scheduled task waits for an answer. Windows gives a scheduled task started without redirected input a hidden console, so secret rm waits for its [y/N] answer. Pass --yes in scheduled tasks and scripts.
  • SNMP Poll: an SNMP error on an identity read other than the chassis serial reads as an empty value. The SNMP library ends a walk that gets an error status (genErr, noAccess) without reporting an error, so a failing sysName, sysObjectID or snmpEngineID read, or a first sweep under such errors, can resolve a lower rung of the device id for as long as the error lasts. Chassis serials that vanish are handled (the established id is held). The duplicate-id warning compares targets by host, not by port.
  • SNMP Poll: neighbours over max_neighbors leave by liveness expiry. senhub.neighbors.omitted shows that the table is cut; it does not show which disappearance the cut caused. Explicit removal is planned.
  • SNMP Poll: the first sweeps after the upgrade send many route deletions. Each device's first complete sweep retires the system routes an earlier version published, and repeats the deletions on two more cycles so a dropped one is sent again: on a fleet of a few dozen switches this is about a thousand deletion events, most of which the receiving graph has nothing for and ignores. They are sent once per agent process: if they are lost on the way (a receiver down for those minutes), the routes leave by liveness expiry instead.
  • SNMP Poll: a short outage that ends just before the silence threshold can still make the device leave. After a failed sweep the next attempt waits longer each time (up to five minutes); an outage that ends less than one such wait before the silence threshold (three topology intervals) is only seen to end after the threshold, and the device leaves the map with the reason unmonitored until the next successful sweep. With the default 10-minute interval this needs an outage close to 30 minutes.
  • SNMP Poll: a device that answers no GET uses its sweep budget faster. Each identity value is read with a GET and walked when the GET does not answer, so on such a device each value costs two reads of the sweep budget. A sweep cut by the budget does not retire the system routes an earlier version published; that retirement waits for the first sweep of the device that completes.