Release Notes

NOTE: Updates are happening daily but these notes are updated once every two weeks.

2026-09-07

• The agent no longer loses long log lines. It reads the journal with journalctl -o json, which replaces any field where the name, an = and the value together reach 4096 bytes with null unless -a is passed. So a message of about 4088 bytes or more arrived as "MESSAGE": null — the entry was stored, the priority and unit and hostname were stored, and the text was gone. Stack traces, tracebacks, verbose SQL errors and pretty-printed API payloads all clear 4 KB without trying, which made this worst for exactly the lines worth keeping. Nothing reported it: journalctl exits 0 and the server accepted the entry. The agent now passes -a. If you ship the journal yourself with a journalctl -o json | curl pipeline, add -a to it too. To find out whether it has been happening to you, run SELECT COUNT(*) FROM logs WHERE json_valid(msg) AND json_type(msg, '$.MESSAGE') = 'null' against the source

2026-08-24

• Email is now a notification channel type alongside Slack, Telegram and Pushover. It works with any SMTP server — a provider such as Fastmail or Amazon SES, your company mail server, or a local relay. Set the server as host:port, credentials (leave the username blank for a relay that needs none), a From address and one or more comma-separated To addresses. Port 465 connects with implicit TLS; other ports upgrade to STARTTLS when the server offers it. Like every channel it has a Test button, so you can confirm delivery before pointing alerts at it

2026-08-21

• A website monitor now alerts only after two failed checks in a row. It sends a recovery message only after it sent an error message. Before, one slow response was enough to send an error alert. The next check passed and sent a recovery alert. If you saw error and recovery pairs about a minute apart, this was the cause. The site was not down
• You can now set the request timeout for each website monitor on its edit page. Choose 5, 10, 30 or 60 seconds. The default is 10 seconds. Before, every check used a fixed 5 seconds. That is too short for some slower services
• A failed check now counts as a check. Before, a monitor set to check every 10 minutes was checked again one minute after a failure. This is why a recovery alert always arrived within a minute. It also means a site that stayed down was checked every minute until it came back

2026-08-10

• Metrics with more than one label set — such as promhttp_metric_handler_requests_total, which reports one series per HTTP status code — are now stored as the sum of their series each scrape. Previously only one arbitrary series was kept, the rest failed with a UNIQUE constraint warning in the logs on every scrape, and because a scrape stopped at the first error other metrics from the same source could be dropped with them. Charts for an affected metric will show a one-time step up to the summed value
• A website monitor now alerts every time the site goes down, not only the first time. Error, recovery and keyword alerts are deduplicated by tag, and the window for a tag with no configured throttle is over a year — only the TLS expiry alert had one. So the first outage of a monitor notified you and every outage after it was silent, while the check history and the monitor page showed the failure correctly. Those alerts now use a 10-minute window, which still collapses two checks that land together into one message
• Max Frequency is now a field on the alert rule form. Pick 5 minutes, 15 minutes, 1 hour, 6 hours or once a day. Every rule was previously fixed at once a day with no way to change it, so a recurring problem — a failing payment webhook, a root login — reported itself once and then went quiet. Existing rules keep their once-a-day setting until you change them. Nothing shorter than 5 minutes is offered because rules are only evaluated every 5 minutes
• You can now choose which notification channel receives alerts. Tick Send alerts to this channel on the one you want; only one channel holds it at a time. Alerts previously always went to the first active channel by creation order, which was a trap rather than a limitation: each channel’s Test button sends to the channel you clicked, so adding Telegram alongside an existing Slack channel, testing it, and seeing it arrive told you nothing about where real alerts would go. With no channel marked the old behaviour still applies, and the Alerts page now labels the channel that receives them
• The Is Active toggle on a notification channel now saves. Switching a channel off had no effect — the form never applied the value — so the documented way to move alerts to a different channel did not work

2026-08-07

• A SQL search that fails partway through now says so instead of showing a short answer as a complete one. json_extract raises an error the first time it meets a line that is not JSON, and rows found before that point had already been returned — so a query over a source containing one plain-text line quietly returned a truncated result set and no error. Add WHERE json_valid(msg) to skip those lines
• Fixes CSV export, which ran your query against the application database rather than the log source you were searching. Every export of a FROM logs query produced an empty file with no error
• The Retention Days setting on a log source is now what the nightly cleanup actually uses. The setting saved correctly and was shown correctly, but the sweep deleted anything older than 15 days regardless — so a source set to keep 90 days kept 15, and a source set to keep 3 kept 15. Note that after this update a source set below 15 days will delete down to its setting on the next nightly run. A source set to 0 or a negative number is read as unset and keeps the 15-day default rather than deleting everything
• A broken cron job now sends one message instead of two. Job health is worked out from successful runs, so a job pinging state=fail on schedule was flagged as “no longer checking in” shortly after its failure alert — it had not stopped checking in, it was checking in with failures. That second message is now suppressed while a failure is outstanding, and returns once the job succeeds and then goes quiet for real
• A cron job that pings state=fail now notifies you within a minute. Previously the failed run was recorded and shown in red on the job page, but nothing was sent — you found out when the successful check-in failed to arrive, which takes about 12 minutes for an hourly job and about 5 hours for a daily one. The notification carries the status_code and message from the ping. A job that fails every run does not message you every run: the first failure notifies, then it stays quiet until the job completes successfully or a day passes
• Cron pings can now record details with a run. status_code, message and repeated metric=name:value parameters are stored with the ping — previously the documentation showed these but the server read only state and dropped the rest
• The cron job page now charts each numeric metric across the last 100 runs, one chart per metric name, so a job that is getting slower is visible before it starts timing out. The message and exit status are shown beside each recent run, and a non-zero exit status is flagged in red. Jobs that send no metadata see the page exactly as before
• Cron pings sent with POST or HEAD are now recorded. The cron page has always said all three methods work, but only GET was routed — a POST or HEAD ping was silently rejected
• Documents Pushover as a notification channel. It has worked in the app for a while but the alerting documentation only listed Slack and Telegram

2026-07-06

• Scrollbars are now styled to match the app theme everywhere, in both light and dark mode — previously only a few containers had themed scrollbars and the rest (including the main page scrollbar) used the browser default
• Metric types (gauge vs counter) are now stored in the metrics database instead of only in memory, so counter metrics render as per-second rates immediately after a server restart instead of briefly showing raw cumulative totals until the next scrape
• The live tail page now shows a “Reconnecting…” indicator and automatically resumes tailing when a request fails (e.g. during a server restart) — previously the tail silently stopped updating while still showing “Live”
• Metric charts now show a “stale” badge when a background refresh fails, instead of silently showing old data; the badge clears on the next successful refresh
• Refreshes the metrics page UI: metric names are now grouped by prefix into collapsible sections with a filter box instead of one long list, clicking a metric toggles its chart on and off (plotted metrics are highlighted in the list), charts render as cards in a responsive grid with a link to the metric’s detail page, and quick range buttons (1h/8h/24h/7d) reload every open chart at once
• Refreshes the metric detail page: adds a time range picker with quick range buttons (the page previously always showed the last 8 hours), a gauge/counter badge, and summary tiles for the latest, min, max, and average value over the selected range
• The live tail page now shows the keyboard shortcut cheat sheet (press ? or the hint button next to the Live indicator) listing the shortcuts that work while tailing (j/k row navigation, Esc)
• Removing a filter pill on the search page no longer mangles the query when a quoted phrase contains the same text as the filter — the exact filter token is removed instead of the first matching substring
• The search time range button now shows a compact label (“30m”, “2d”, “All”) on phones instead of just the dropdown icon
• Saved queries now capture the full search state: every selected source and the time range are stored along with the query and extracted fields, and are restored when the saved query is loaded (previously only the first source was kept and the time range was lost). The saved query edit page exposes the new source list and time range fields

2026-07-05

• Moves saved queries in the sidebar under the Search nav item as a collapsible chevron section (expanded by default on the search page), with a Manage Queries link at the bottom of the list, instead of a separate section below the main navigation
• Adds configuration export and import for moving Central Logging to a new server. Settings → Backup & Migration downloads a single JSON file with all configuration (log sources and their tokens, metric sources, alert rules, notification channels, website monitors, saved queries, transformers, API keys, users and settings). Import it on a fresh install and agents keep ingesting under their original source tokens — no reconfiguration needed. Log data is not included in the export
• Adds S3 backup settings to the web UI — endpoint, region, bucket, and credentials can now be set on the Settings page instead of (or on top of) environment variables. Settings saved in the UI take precedence
• Adds support for self-hosted S3-compatible storage (Garage, MinIO, …) for backups via a new endpoint option (also available as the BACKUP_S3_ENDPOINT environment variable)
• Fixes nightly backups: they now back up the actual application database and include every per-source log database (previously only a stale database path was backed up). Backups are uploaded under appdb/ and logs/{source-token}/ prefixes, and automatic cleanup of old backups only touches those prefixes so other objects in a shared bucket are left alone
• Makes the cron detail page readable on phones — recent runs are now shown as cards with time, user agent, and IP stacked vertically instead of a cramped 4-column table (which also gains headers and cell padding on larger screens), the frequency and next-run tiles stack on small screens, the ping URL scrolls horizontally instead of overflowing, and long job names wrap in the header
• Makes the hosts page readable on phones — hosts are now shown as cards with the key details stacked vertically instead of a wide 10-column table, with a sort dropdown replacing the sortable column headers. The full table is still used on larger screens
• Fixes an extra “phantom scroll” on phones where the last table row (and the top nav after scrolling up) was hidden behind the browser toolbar until you scrolled a second time — the layout now sizes to the visible viewport as the browser chrome shows and hides
• Improves the mobile experience: the menu is now a proper slide-in drawer that closes when you tap outside it or navigate, and includes Docs and Sign Out. Dark mode and settings are now reachable from the top bar on phones
• Makes the search time range picker usable on phones — relative presets (Last 30 minutes, Last 24 hours, etc.) are now shown on small screens, and the search button is always visible
• Wide tables (hosts, processes, SQL search results, notification channels) now scroll horizontally on small screens instead of stretching the page
• Makes the settings page readable on phones — each setting now stacks its name, input, and description vertically on small screens instead of cramming them into three table columns
• Adds a real login page with session-based authentication, replacing the browser’s Basic Auth popup for the web UI. Includes a Sign Out button in the nav, and the initial password setup now logs you in automatically. Basic Auth still works for curl/scripts and the API
• Fixes the failed-login lockout so it applies per IP address instead of per connection

2026-04-17

• Refreshes the home page: shows a welcome/onboarding view with tabbed code samples (curl, Python, Node.js, Go, file upload) and copy-to-clipboard buttons when you haven’t created any sources yet, otherwise shows a dashboard with 24h log volume tiles, top sources by volume, recent alerts, and quick actions

2026-04-16

• Refreshes the sources list UI: health indicator dot (fresh/stale/silent), last-log-received timestamp, relative usage bar, name filter box, a friendly empty state, and inline tail/edit/delete actions
• Refreshes the source edit page UI: grouped sections (settings, transform script, stats, send logs), tabbed ingest examples, stats cards, and a dedicated danger zone for deletion
• Fixes Transform script editor colors in dark mode
• Fixes log count and used bytes on the sources list not refreshing when new logs arrive (stats cache now invalidates on create/delete and expires after 30 seconds instead of 15 minutes)
• Fixes retention days not saving when editing an existing log source

2026-04-15

• Adds Pushover as a notification channel option

2026-04-11

• Adds relative timestamps on search results and cron monitoring (e.g. “3m ago”, “2h ago”) — updates live every 30 seconds
• Adds click-to-copy on field values in expanded log entries and a “Copy JSON” button in the detail header
• Adds keyboard shortcuts for search — press ? to see all shortcuts. Navigate results with j/k, expand with Enter, focus search with /, run queries with Ctrl+Enter, paginate with n/p, and open the time range picker with t.

2026-04-10

• Adds multi-source search (search across all log sources at once)
• Adds search tabs for keeping multiple searches open simultaneously
• Adds shareable search URLs (search state synced to URL)
• Adds “search around this time” — click the magnifying glass icon next to any timestamp to open a new tab searching around that moment with a configurable time window
• Adds sorting to host process table
• Adds notifications for cron job recovery
• Fixes website monitor checks

2026-04-09

• Adds dark mode
• Adds field filtering in search (Splunk-like field:value syntax)
• Adds ability to toggle alerts active/inactive from alerts list page
• Adds alert metadata (last fired time, alert count) to alerts page
• Adds create alert button from search page, pre-fills query and source
• Adds FTS query support for alert rules
• Adds recent successful logins to settings page
• Adds rate limiting on authentication
• Improves website monitor UI
• Fixes web monitor check intervals running longer than configured
• Web monitors can now check every 1 minute
• Shows check frequency on monitor detail page
• Cleans up response time display (e.g. 24ms, 2s)

2025-12-21

• Added sorting to /hosts page

2025-02-13

• Improves performance of website monitors page

2025-01-09

• Adds pretty print SQL button to search page

2024-12-08

• JSON extract fields now trim the msg field before extracting in FTS

2024-12-06

• Order FTS results by timestamp desc by default

2024-12-02

• Adds website URL to TLS expiration alerts

2024-12-01

• Adds ability to throttle alerts
• Throttles TLS expiration alerts to 24 hours

2024-11-26

• Improves SQL syntax highlighting colors

2024-11-23

• Fixes bug in pagination where extract fields wouldn’t persist

2024-11-22

• Adds ability to extract fields from the msg JSON in FTS

2024-11-20

• Adds pagination to full-text search results

2024-11-19

• Adds TLS expiration to website monitors list page

2024-11-18

• Improve cron monitoring UI

2024-11-17

• Improves cron monitoring UI on mobile

2024-11-16

• Improves website monitor UI for mobile
• Adds favicons to website monitors

2024-11-15

• Adds error rate and total log count to website monitor show page

2024-11-14

• Adds SQL syntax highlighting to saved queries and search
• Various mobile menu/UI fixes
• Adds left nav to mobile menu

2024-11-13

• Adds website monitor concurrency
• Improves notification message for website monitor alerts

2024-11-03

• Fix JS timestamp formatting bug

2024-10-26

• Reduce logging verbosity on website monitors
• UI styling fixes

2024-10-24

• Fix bug where saved query form didn’t save source ID

2024-10-23

• Adds custom user agent to website monitors

2024-10-19

• Fix host down alert

2024-10-19

• UI styling

2024-10-05

• Adds TLS error monitoring for website monitors

2024-10-03

• UI styling

2024-10-02

• Adds website monitor keyword alerts

2024-08-01

• Adds log tailing
• FTS returns latest when query is empty

2024-07-25

• Adds host process monitoring

2024-07-19

• UI styling

2024-07-13

• CLAgent OpenBSD host info is sent more often

2024-04-30

• Sign macOS binaries

2024-04-28

• Adds is_active to host so we can disable monitoring for hosts that are terminated

2024-03-19

• Hosts alert when no longer checking in
• Hosts UI cleanup, OS icon, sorting

2024-03-16

• Adds OS icons to hosts page

2024-03-06

• adds IP to website monitor logs, adapts log retetion to sharded log dbs
• Adds success message to cla install
• fix UI and broken links from alert rule show page
• fixes source selection from alert rule link
• mobile fixes

2024-03-01

• Adds highlighted search terms

2024-02-22

• toggle SQL/FTS
• show row count in log source page

2024-01-29

• Adds some styling to setup flow

2024-01-22

• Self-host JS files

2023-11-21

• Adds initial cron monitoring

2023-03-26

• Adds metrics tracking, support for prometheus metrics scraping

2023-03-19

• Hosts alert when no longer checking in
• Hosts UI cleanup, OS icon, sorting

2023-03-18

• Adds concurrent queue workers

2023-03-16

• Adds OS icons to hosts page

2023-03-15

• Fixes single log queue with new architecture

2023-03-14

• Switch to queue architecture

2023-03-06

• Log row expand UI fixes
• Mobile UI fixes
• Fixes source selection from alert rule link
• Fix UI and broken links from alert rule show page
• Adds success message to CL Agent install

2023-03-05

• Adds IP to website monitor logs, adapts log retetion to sharded log dbs

2023-02-29

• Adds highlighted search terms
• UI enhancement: Sticky top the log column heade

2023-02-28

• Adds self-update flag

2023-02-23

• Adds log sources
• Splits log DBs into separate database per source
• Better search
• UI enhancements

2023-01-27

• Adds installation/setup flow
• Automatic TLS certs
• Log alerts now indicate which are alerts are firing

2023-01-09

• Adds indicator next to firing log alerts

2023-01-08

• Adds show hosts page

2023-01-06

• Simple -update flag for clagent

2023-01-03

• Adds ability to delete log alert rules

2023-12-23

• Adds settings, page, delete cron, UI enhancements

2023-12-18

• Adds intial website monitoring, alerts coming next

2023-11-30

• Adds cron alerting

2023-11-28

• Adds IP, useragent to cron monitoring

2023-11-26

• Added basic cron monitoring without alerts, alerts coming soon

2023-11-20

• Initial release