Releases

Linux packages, fleet deployment, and a credential leak closed

• Signed Linux packages and repositories, plus three ways to deploy at scale: an Ansible collection, a Helm chart and a Podman Quadlet unit. Probes can also be declared from environment variables.
• Security — act on this one. A credential embedded in a probe's connection URI (scheme://user:password@host: MongoDB, Redis, PostgreSQL, AMQP) was written in clear to the agent log in 0.6.1 and earlier. 0.6.2 masks it. If you used such URIs: upgrade, delete or rotate the old log files, and change that account's password.
• Breaking: a host's name is now one value everywhere — a host.name override that only reached metrics and logs now also names the host entity and its systemd units. The host.id is unchanged, so the topology node is the same node.
• Lighter at rest. Probe definitions and console pages are parsed when first needed rather than all at start, and five lines that fired on every healthy cycle moved from INFO to DEBUG.

Full release note →

Metric names and units follow the conventions

A corrective release, but one that renames series. promtool check metrics flagged 0.6.0: some were exported in milliseconds, microseconds, hours or bits per second, where both the Prometheus and the OpenTelemetry rules ask for seconds and bytes.

• Durations are now in seconds, throughputs in bytes per second, and a list of gauges loses its .total suffix. Dashboards, alerts and recording rules on the old names need updating — the note carries the full table.
• Zabbix item keys follow the metric names. Re-run zabbix setup to refresh the templates; items under the old keys stop receiving data and keep their history.
• The Zabbix server is set at install time — ZABBIX_SERVER for the MSI, --zabbix-server for config init, an environment variable for the container. A new host registers and fills in by itself.
• Topology. A route is identified by its destination and its next hop, interfaces carry their subnets and addresses, Windows hosts publish their routes, and SNMP devices no longer flicker.
• The console reports measured values. Resident memory and CPU are now the real figures, with the Go heap shown beside them.
• Watch out on Linux: senhub-agent update run by 0.6.0 installs the new binary without restarting the service — finish with sudo systemctl restart senhub-agent.

Full release note, with the renamed metrics table →

Native Zabbix, a separate administration key, and entities by default

The largest release so far. Read the upgrade list before you take it: ten points, and two of them change data you may already be querying.

• Zabbix, both directions. An active agent that registers itself and pushes on :10051, a passive one that answers polls on :10050, TLS and pre-shared keys, and templates generated from the probe definitions — imported for you by senhub-agent zabbix setup. Zabbix 6.0, 7.0 and 8.0.
• A separate administration key. The console and the configuration API no longer answer to the agent key. A bookmarked console address now returns 401 — open it with senhub-agent console, or get the address with console --print.
• Entities by default in the container, the agent shows its instance id (senhub-agent key instance-id), and logs and traces from the machine carry its host identity. config check now warns when an OTLP output would send no entity event at all.
• Probes. The counters a native Zabbix agent reports, on Linux and Windows. A new probe for Azure Container Apps jobs. The Veeam probe now says which protected objects get no job status. And every probe page lists every metric it produces.
• Watch out: service.instance.id becomes a UUID and changes once — series keyed on it restart. An unfiltered process probe keeps only its per-name roll-up. A Nagios value equal to the threshold is now OK. ActiveMQ and Redfish metrics are renamed, and SNMP interface series move to network_interface_name.

Full release note, with the upgrade steps →

Container image corrections

Fixes to the official container image first published in 0.5.5.

Full release note →

A console on the box, and an official container image

• Rebuilt web console. A Probes page with an editor and a Test button, a Settings page for port, bind address and licence.
• Self-signed TLS when no certificate is supplied, so the console is not served in the clear by accident.
• Official container image at ghcr.io/senhub-io/senhub-agent, alongside an OSS variant.
• Operational fixes. agent config check now reads the values, uninstall cleans up even with no unit present, and the agent keeps going when inotify is saturated.
• Three breaking changes on tag and channel names — see the note.

Full release note →

Per-container network counters

• Container networking. Counters read from the container's own network namespace rather than its cgroup, plus restart count, names, images, labels and state — so containers are no longer identified by id alone.
• Hardened unit. /var/lib/senhub-agent is marked non-executable; the unit and the binary now move together.

Full release note →

OTLP receives logs and traces; the licence becomes a file

• OTLP receiver accepts logs and traces, not just metrics; a signals list chooses what it takes.
• Licence in its own file. license.jwt sits next to agent.yaml — hand a customer one file to drop in place.
• OS Updates probe (free, type: os_updates): pending updates, pending security updates, reboot-required status.
• Multi-tenant export. A tenant field stamps X-Scope-OrgID on every signal.

Full release note →

Dell PowerStore

A PowerStore probe (commercial) monitors storage arrays over the PowerStore REST API — cluster state, hardware faults and capacity.

Full release note →

Secrets leave the configuration file

• Secret store. ${secret:NAME} references resolve at config load time, so passwords and tokens never sit in plaintext on disk.
• OS-native backends chosen per platform: age-keyfile on Linux, systemd-creds as the hardened option.
• CLI. agent secret set/get/list/rm/status — a value is never accepted as a command-line argument.
• Migration. config_version 3 seals inline plaintext secrets into the store on boot and rewrites the file.

Full release note →