Every change,
on the record.

See and end every sign-in, resolves that stick, and device silence that speaks up

• My account grew an Active sign-ins card: every signed-in browser with its address and last activity, a sign-out button on each, and "sign out everywhere else". Ending a session, changing the password or blocking an account takes effect everywhere within a minute.
• A signed-in browser now keeps its session through platform maintenance: the session is bound to your browser, renews as you work, and only a hash of it is ever stored on our side.

• Resolving an incident by hand sticks: it will not reopen until the condition actually clears. And when a condition comes back long after an automatic resolve, a new incident with its own number is born instead of an old one being resurrected.
• A reopened or reborn incident always carries the reading measured now, never a value remembered from an earlier day.
• A failing check on a freshly added host gets time to succeed first: the "how long has this been broken" math starts at the first attempt, so a brand-new install no longer opens an incident in its first minute.

• The anomaly feed got much quieter. A reading now has to move by an amount that matters in real units for its class of metric, not just by an amount that is statistically unusual — a process going from 0.1% to 0.2% CPU is no longer an anomaly. Metrics where only growth is bad stopped flagging drops, and our own probes' latency to localhost no longer judges itself. Detector thresholds arrive from the platform, so tuning never waits for an agent release.

• Silence became a signal. Two new rules: a warning when a device cannot be polled because its secret was never set on the collector — with the exact command to set it — instead of the device being called down; and a warning when an approved device has had no real poll for ten minutes, which keeps working even when the collector itself was removed from the fleet.
• A collector that refuses its team's template key now says so through failing checks, with the reset command right in the text, instead of going quiet.
• SNMP traps from sources that are not approved devices are dropped before the packet is even parsed.
• Config backups of network devices mask credentials in more syntax forms, and a backup that cannot be read cleanly fails loudly instead of storing a partial file.

• CIS checks inside containers no longer recommend the impossible: kernel-level items that only the host can change (the audit subsystem, certain sysctls) leave the container's score entirely. Outside containers, the audit daemon has to be running — merely installed does not pass.
• The "root can log in over ssh" finding judges effective behavior: root limited to keys, with passwords off, is not a finding — and the recommendation is prohibit-password, which keeps clustered hypervisors working. The metric follows the same rule.

• When live telemetry is briefly unreachable, the console says so calmly: a quiet strip under the header, skeleton screens instead of half-empty pages, paused background polling, and a single reload the moment it is back. Scheduled reports and exports never go out half-empty in such a window — they wait, or refuse with a reason.
• A hung connection is noticed as quickly as a refused one: seconds, not timeouts piling up.

• The host's Manage block shows the real age of the agent's access key, with a Rotate now button. A manual rotation is its own entry in the event stream and the audit log, with the name of whoever clicked it.
• Template permissions are enforced before anything else in the probe cycle: a probe your team denied never resolves its secret, and a denied listener keeps its port closed.
• Testing a device connection uses only credentials that belong to device monitoring.
• A dead connection is noticed within seconds, and the agent moves on to the next address immediately instead of waiting out long timeouts.
• Reinstalling the agent on a box whose record went quiet less than a week ago takes over that record's plan slot instead of counting as a second host.
• Small fixes: process names with spaces survive on macOS, Windows events larger than 16 KB no longer arrive empty, and update verification runs on about half the memory.

• Visitor network addresses do not travel in APM trace attributes: the agent strips them at the source, and ingest enforces the same rule. RUM beacons are accepted strictly same-origin, and collection respects per-site and per-visitor limits.

Cloned machines sort themselves out, critical alerts climb a personal ladder, and ten new rules join the catalog

• Clone a monitored machine — a template rolled out, a copied VM, a container restored elsewhere — and both sides now sort themselves out. The platform notices two machines living on one identity, keeps the original exactly as it was, and registers the copy as its own server within minutes, marked as a copy. The original's access key is refreshed automatically along the way, without a blink in its monitoring. And if the plan has no room for one more host, the copy is turned away with a clear reason instead of silently wrestling the original.
• A server restored from an old snapshot is recognized for what it is: wakora doctor plainly says the machine came back from a backup with retired credentials, and a single wakora --key brings it back under the same identity, history intact.
• On a machine where the agent's sealed identity can't be read — the classic cloned-disk symptom — the service now waits quietly and explains itself instead of restart-looping, and wakora --key on top of it re-registers cleanly.
• The trust pack documents the whole behavior, including the threat scenarios it covers: a cloned machine, a restored backup with an old key, and a live host re-registered with a team key.

• Critical alerts can now climb a personal ladder: up to three steps across your own channels, the first fires immediately, the following ones wait one to thirty minutes each. The whole ladder stops the moment anyone on the team takes the incident on — or it closes on its own. Each channel rings once per incident, duplicates with the team escalation are suppressed, and phone calls stay with the team's escalation policy. Set it up in My account on the critical severity row; if you don't, nothing changes — critical notes keep arriving on all your channels at once. Available on every plan.
• Thirty minutes before an on-call shift changes hands, the incoming engineer gets a heads-up on their first available personal channel — the second on-call, too. One note per handover, and it can be switched off in My account.

• If calls suddenly surge — an hour burning through more than a third of the day's calling allowance, or several calls blocked in a row — the workspace owners get a note, at most once an hour. The calls themselves are never silenced.
• Verifying a phone number got friendlier: the repeat-call button shows a real countdown and how many attempts remain, the pause holds even across tabs, and the code field survives a page reload while the code is still valid.

• Ten new rules joined the catalog, all watching rates rather than levels: MySQL lock waits and slow-query storms, Postfix deferred-mail growth, PowerDNS dropped queries, backend timeouts and SERVFAIL share, PostgreSQL deadlocks, NATS slow consumers and reconnection storms, and error bursts reported by network devices over syslog. Every one arrives as a warning and arms itself only where the matching service actually reports data.
• Heartbeat monitors for cron jobs now carry their own severity, chosen per job: a missed nightly backup can page as critical while a housekeeping script stays a warning. The REST API carries the field too, and a change applies from the job's next silence.

• OpenSSH started on demand via socket activation is now covered exactly like an always-on sshd. The ssh service is recognized by its unit rather than by a running process — so brute-force counters, port and config-integrity checks no longer fall silent on a box nobody is logged into — and when sshd can't print its effective config yet, the agent reads sshd_config itself, defaults and Include files included. RHEL-family hosts get their own definition variant automatically.
• A Redis that runs without a password no longer demands a stored secret: the check connects anonymously, and if the server does require one, it says so with the exact command to set it. ClickHouse checks follow the same rule — and pair nicely with a dedicated read-only monitoring user.
• The zero-touch HTTP metrics layer now loads on older Linux kernels: it adapts to the kernel's memory layout at load time instead of assuming a recent one, verified on kernels from 5.10 up — Debian 11 and 12 era included.
• Docker checks and container log collection no longer keep idle connections to the Docker daemon open between runs.
• wakora doctor now suggests service commands that actually exist on the host, matching the machine's init system instead of a generic form.

• A service switched off for monitoring stays in the host's service catalog, marked as off, instead of disappearing from the list — switching it back on is one click.
• The actions of an expanded incident — take on, resolve — now sit in their own row of buttons right under the incident.

Escalation calls move in waves, runbooks ride along with every alert, and incidents can be taken on straight from e-mail

• Escalation calls now move in waves. A voice step calls through its people one per minute instead of ringing a single person: an unanswered dial retries in two minutes, an answered call without an acknowledgement retries in five, and nobody gets more than two calls per incident. Pressing "1" or "2" on the phone acts on the whole wave, and when someone acknowledges from the console or Telegram mid-wave, the calling pauses — with a single reminder call to that person fifteen minutes later if the incident is still open.
• The order of a wave follows the escalation step itself: the on-call engineer first, then owners, then admins, then the rest of the team.
• Voice alerting got honest economics. Every plan that carries phone alerting includes a monthly allowance of answered calls; beyond it each answered call has a clear per-call price, and a monthly spend limit — with presets and a custom amount — keeps the total predictable. At 80% and 100% of the budget the workspace owners are notified; when the budget runs out, calls stop and every other channel keeps working. Agencies set the limit for their client workspaces from the Clients view, and the wholesale rate applies.
• Escalation for agency-managed workspaces no longer runs out of people: if a client team has no on-call schedule of its own, the agency's on-call engineer takes the call, then the owners, then the admins.
• A call is only ever placed to a verified number. A verified number is now locked in the profile and removed with a single click.
• The service notes around voice alerting — the evening coverage check, failed calls, budget warnings, a skipped call for someone without a verified number — now arrive in Telegram in the same clean format as incident digests: a clear headline naming the workspace, plain words, and one link to the page where it gets fixed. Owners without Telegram receive the same notes by e-mail, and for agency-managed workspaces they carry the agency's branding.

• Alert rules can now carry a runbook: a short note plus a link that reaches the person on call together with the alert. A runbook can cover the whole rule or narrow down by tag, host or object pattern — the most specific one wins, and when several match equally, all of them show, each explaining why it applies.
• The runbook travels everywhere the incident goes: the expanded incident in the console, Telegram, push, e-mail, webhooks, Slack, Teams and the Jira issue. Editing runbooks is its own permission in the role matrix, and the REST API and MCP carry them too. Available on the Pro plan and up.

• The response-time cards compute a true median for acknowledge and resolve times — one incident left open overnight no longer skews the picture. Next to each median stands a counter that was never visible before: how many incidents waited longer than an hour to be taken on, and how many took longer than a day to resolve.
• The host filter now narrows the whole page — tabs, counters and the daily trend bars, not just the list.
• The list grew honest pagination: "show more" walks deeper in steps of a hundred instead of stopping quietly.
• The weekly digest reports the same medians and slow-response counters, compared against the previous period.
• Incident e-mails now carry actions: take on and resolve, right in the message. The links are personal and live for 24 hours, and the page asks for one confirming click before anything happens — mail scanners that pre-open links cannot touch an incident. The action lands in the timeline as "from an e-mail link", and resolving a host that is still down safely degrades to an acknowledgement, same as everywhere else.
• Tapping an incident push opens the incident in the workspace it belongs to: the console switches to the right workspace automatically and reuses an already open tab instead of spawning new ones. This works for notifications already sitting on your phone, too.

• Recurring maintenance windows now keep the local time of whoever created them: a nightly window at 03:00 stays at 03:00 through daylight-saving changes.
• The sites grid on a host page no longer answers with stale readings: certificate and DNS verdicts age out when a site stops reporting, instead of showing the last known value forever.
• Pin a host page to a moment in the past and the sites grid now shows sites that existed back then but have since been removed from the web server — marked as removed, with the certificate and status verdicts of that moment.
• Report schedules print their last sent time in your time zone; it used to show UTC.

Availability stops counting our maintenance, push notifications earn delivery receipts, and search answers instantly

• Platform maintenance no longer touches your numbers. When our side restarts, the window is detected and forgiven for every host automatically — availability bars, the fleet view and SLO budgets all skip those minutes, retroactively included. Our maintenance is not your downtime.
• Excluded periods now subtract real minutes everywhere. The availability bar, the day tooltip, the fleet view and the SLO budget finally agree on both the percent and the minutes — a partially excluded day used to read differently depending on where you looked.
• Declaring an excluded period is two clicks: the dialog lists the host's actual reporting gaps for the last month, and clicking a gap fills the dates. Anything already forgiven doesn't appear in the list.
• A day counts only the minutes a host was actually obliged to report: the first day starts at the first contact, today ends at the last complete minute. A freshly added host no longer inherits debt from the midnight before it existed, and the minute still in progress is never judged as downtime.
• SLO incidents say what they mean: at 80% of the error budget the incident is called "SLO budget running low" and the card notes "target still met"; only past 100% does it become "SLO target missed".

• Push notifications carry the incident text itself now, so your device shows what happened immediately — even with the console closed.
• The devices list in your account shows honest per-device delivery: delivered, sent, refused with the code, or not shown. No more guessing which phone actually got the alert.
• Subscriptions revoked by the push service are retired automatically instead of lingering forever as connected-looking devices.
• Push on iOS became reliable: Safari drops a subscription when a push arrives and nothing is shown, and there was a path where nothing got shown. Every push now displays a notification, so iOS subscriptions survive.
• Critical incidents e-mail every recipient with an address by default, matching what escalation chains already did.
• The log excerpt on an incident is split around the moment it fired: twelve lines before, eight after, with a divider at the start — and an empty side says so in words instead of showing nothing.

• Waterfalls now draw untraced time. When a request spends a long stretch in code with no instrumented calls, that gap becomes a visible hatched row pointing you at the flame graph — instead of a waterfall that quietly ends early. Repeat counters (×N) moved out of span names, so they no longer disappear behind the ellipsis.
• The flame graph on a site page explains itself when per-site CPU attribution is impossible: if the host runs one shared PHP pool, the card says so and links to the host-wide flame instead of staying silent.
• Flame cards show the age of the freshest sample and warn only when the sampler has actually gone quiet for a while — an idle pool no longer triggers the warning.

• PowerDNS monitoring now covers native installs. The definition used to recognize PowerDNS by its optional HTTP API, which most packaged installs keep disabled; it now matches the server process itself, uses port 53 as the liveness check, and reads the full counter set through pdns_control — sixteen counters, with per-second and per-minute rates derived from the monotonic ones. Container installs that expose only the API keep working through their own definition.
• The SERVFAIL counter is read under the name the Authoritative server actually publishes — the old pattern used the Recursor's name for it.
• The DNS card on the host page leads with live values — query rate, cache hit ratio, answer latency — instead of opening with daily deltas that need hours of history before they can say anything on a fresh host.
• PostgreSQL and NATS counters grew rates: commits and block reads per second, rollbacks and deadlocks per minute; messages in and out per second, slow consumers and connection churn per minute. Monotonic totals are now chartable — and alertable once thresholds earn their keep.
• On MariaDB the service-unit gauge counted every alias of the same unit and read 3; it reads 1 like everywhere else.
• No new alert rules armed with any of this: a new signal never pages anyone on day one.

• The search palette was rebuilt under the hood and answers near-instantly. While a query runs, it shows a progress bar and skeleton rows instead of a premature "No results".
• Account settings are searchable from the same box — typing "password" or "timezone" takes you straight to the right screen.
• Site results rank by usefulness: APM first, then RUM, then incidents, with the full-text jump into logs last.
• Host status dots got per-meter memory: a disk hovering around the warning threshold no longer flips the whole host between green and yellow every minute.
• The Billing & plan shortcut in the avatar menu and the phone sheet follows the same role rules as the sidebar item, instead of leading ineligible users to a dead end.

• Idle now means idle. A consolidation suggestion requires a host that actually does nothing — negligible traffic, no requests, no services beyond the base set — not merely low CPU. A production box that is light on resources is a rightsizing row, not a "turn it off" card with a price on it.
• For agency workspaces the idle card prices a box at its full wholesale cost — the host plus its APM sites, sites and container groups — and never counts a domain or image that also lives on another active host.
• Network-flow usage is measured from exact per-window totals now, rather than summing the top flows of each window, so days dominated by thousands of small connections are counted in full. Top-talker views keep showing the top flows — that is what they are for.

• Synthetic transaction step errors mask test credentials everywhere they could appear — in the live cycle and in the test button, raw or URL-encoded.
• API errors no longer echo storage internals to the caller, and malformed workspace identifiers are rejected before any handler runs.
• Public endpoints got read, write and idle timeouts, so a stalled client cannot hold a connection open indefinitely; release downloads keep their own generous window.

• The docs split cleanly in two: Modules pages explain how each subsystem works, Workspace pages walk the console screens in the order of the console menu. Status pages and reports moved to Workspace with the rest, and the sidebar no longer shows duplicate entries.

The network map learns physical from virtual, incidents close themselves, and domain expiry reaches past RDAP

• The topology map no longer invents traffic. A link between two routers used to show the throughput of whichever interface the neighbor's discovery protocol happened to name — including virtual VRRP interfaces, whose traffic has nothing to do with the physical cable. Link members are now classified by what the devices themselves report (interface types are collected over SNMP): VRRP members are flagged and excluded from the numbers, and a throughput label is printed only when exactly one physical adjacency carries it. Otherwise the line lists its members in the tooltip instead of pretending to know.
• A dead device now looks dead. Neighbor tables collected before a device went silent used to be re-announced with a fresh timestamp forever, so a days-old corpse kept a live-looking edge on the map. A probe that has been failing for more than 24 hours now retracts the inventory it produced, and a line to an unreachable device is drawn gray and dashed with the open incident named in the tooltip — no throughput label on a link nobody can measure.
• Port-down and sensor incidents name their device. The incident entity used to be the bare port name, so two identical routers behind one collector folded into a single incident. Entities are now composite — device plus port, device plus sensor — and the incident title carries the device label from your registry.

• New rule: a filesystem mounted read-only. The kernel does this after disk errors, and a host in that state keeps sending healthy-looking metrics while being unable to write anything — logs, updates, its own journal. The rule was born from a real storage failure where boxes sat like that for a day and nothing could see it.
• Honesty about the same rule: its very first hit was a false positive, and the lie was ours. The detector read the mount table from inside the agent's own hardened sandbox, where the root filesystem is legitimately read-only — so it accused a healthy host. It now reads the init process's mount table, i.e. what the host actually sees, and EFI system partitions are no longer judged at all (operators mount them read-only on purpose; NTFS data partitions are still judged). The false incident closed itself twelve seconds after the fixed release connected.
• Domain expiry now works past RDAP's edges. Many TLDs never joined RDAP, so their expiry dates were invisible. The agent falls back to WHOIS — parsing by field name across 27 date layouts — caches results on a ladder tied to how soon the domain expires, and registries that publish no dates at all get an honest "no expiry data" marker instead of silence. Proven the same evening: a domain expiring the next day raised its warning — a date that simply did not exist for us that morning.
• Hosts with closed outbound networks get domain data anyway. If the box cannot reach WHOIS or RDAP directly, the lookup is relayed through the platform: the agent asks, the platform fetches from the authoritative source and relays the answer, capped per agent per day. This engaged itself on the first evening without any configuration.
• Every alert rule was audited with one question: when does this incident close by itself? The findings shipped as fixes. The generic "source disappeared" tail dropped from 40 minutes to three. Sparse metric families got closing windows sized from the measured gaps between their own data points instead of one global guess. A site removed from the web-server config closes its certificate and DNS incidents through inventory within minutes. Broken-probe and unreachable-device incidents close within seconds of the first success. Event-born incidents — a failed hypervisor task, a deploy regression — close after a quiet day, with recovery read from the data itself, so signals arriving out of order cannot leave a resolved problem open.
• A failed evaluation pass no longer counts as recovery: if the scan itself errors, incident state is kept, not judged.

• The incident timeline now says who was called and how the call ended, in words: "call answered · pressed 1 — taken on", "nobody picked up", "line busy", "the carrier rejected the call". The person called is shown on the event, and "Taken on" names the channel it came from — by phone, from Telegram, from Slack, from the console, from a push notification.
• Browser push notifications carry Ack and Resolve buttons, like Telegram has since July. Pressing one acts on the incident and answers with a confirmation notification. Fixed on the way: incident numbers in push texts rendered as an HTML entity instead of "#".
• Escalation steps fire on the second they are due. A step used to wait for the next minute tick, so "call after 5 minutes" meant anywhere between 5:00 and 6:00; the scheduler now looks ahead within the current minute and fires exactly on time. Voice calls gain the most.
• The expanded incident view got a facts table — started, resolved, host, object, a plain-words explanation — sitting above the timeline rail instead of three loosely scattered text rows.

• Community templates now run inside an explicit capability set. A template's signature proves origin, not intent — so what a template may do is decided at install. The dialog shows evidence rather than words: the exact command lines it would run, the names of the secrets it wants, the file paths it reads. Dangerous capabilities are off by default, and a template that tries something it was not granted produces a visible failing check saying "capability not granted" — never a silent nothing. Your own team's templates keep full access; the one thing nobody may do is publish metrics under another service's name, because alert rules stand on those names.
• The marketplace was rebuilt to read like the hosts page, and a template now opens a passport before installation: what it matches, which capabilities it wants (with the evidence), and the full definition under a fold — you can read what you are about to run. Install counts above nine are shown as ranges by design.

• The last two axes got prices: sites and running container groups beyond the plan quota are now billed as overage, with wholesale rates for agencies, instead of being counted but free. The usage tab also tells you when part of your site count is redirect-only domains.
• Workspaces without a card see the site quota as an honest wall for external probing: sites beyond the quota are listed grayed with an explanation, instead of silently not being probed.
• Yearly wire-invoiced workspaces are billed base yearly, usage monthly — mirroring how card subscriptions already behave.

• docs.wakora.io was rebuilt from scratch into 118 pages: per-OS install guides, a page for each of the 43 supported services — what is recognized, which metrics ship, which alerts arm out of the box and why those thresholds — six pages on alerting mechanics, module guides in pairs (how it works, and what it looks like in the console), an API section, and a reference catalog of all 107 built-in alert rules generated from the rule source itself, so it cannot drift from reality. Old URLs redirect.

Byte-for-byte builds proven on GitHub's runners, and zero reachable vulnerabilities

• Rebuilding the agent from the public repository with the documented command now yields the exact binary the update channel serves — and a public CI workflow proves it on every tagged release: tests on Linux, Windows and macOS, signature verification of the release manifest, a full rebuild from the manifest's recorded inputs, and a hash comparison. It runs on GitHub's runners with GitHub's toolchain, so the proof does not depend on our machines or our word. Our internal pipeline protects the release; the public one proves it.
• Honesty about how we got here: the first reviewer-style rebuild produced a different hash. Four causes, all structural — the compiler was embedding our internal commit, the export scrub had drifted a few log strings, the order of linker flags changes the build ID (so the documented command now fixes the order, not just the set), and the toolchain's own binaries leave a stamp. All four are fixed, and the release manifest now records the exact build inputs — toolchain, endpoint, certificate pin, publisher key — so a reviewer reads them from a signed document instead of prose.
• The trust pack gained a reproducibleFrom field: releases older than that can never be rebuilt from public source, and we would rather say so ourselves than have someone find it.
• The test suite is public now — 78 files. A source tree without tests cannot carry the claim "verify instead of trusting": a fresh clone runs the same checks our release gate runs.
• Releases are published as history, one commit and one tag per release, not as periodic snapshots.
• Running the full suite natively on Windows — instead of only cross-compiling for it — caught a real product bug: the agent held log files open in a way that blocked their rotation on Windows hosts. Fixed.

• Dependency vulnerabilities across the agent and every backend service: zero reachable, verified by call-graph analysis rather than version lists. Two lessons worth sharing. A dependency scanner reads only the module manifest and is blind to the standard library by construction — 22 of the 30 reachable findings lived in the pinned toolchain, not in any dependency. And the toolchain version must be read from the running binary: a stale directive makes the report wrong in both directions, showing fixed issues as open and hiding open ones as fixed.
• The profiler's bundled diagnostic assets are now fetched from version-pinned addresses and verified by a per-file hash before anything is allowed to execute. A floating alias with no integrity check was a supply-chain hole; now any upstream change is a visible edit instead of silent drift.
• The Windows installer verifies a publisher co-signature on the binary, instead of trusting a checksum served by the same origin as the binary itself.
• The version-pin floor was raised: pinning a fleet below the certificate-validation fix would have quietly reintroduced it. A remote downgrade is a vulnerability of its own, and the platform now refuses it.
• Two legacy diagnostic switches, inherited with the console's fifteen-year-old core, answered without authentication and could reveal internals. Closed.
• The agent's filesystem sandbox turned out stricter than the helper processes it launches: on hosts installed after August 8, the web-server config dump saw a read-only filesystem and site discovery came up empty. The agent now detects the condition and relaxes itself to a still-hardened profile at runtime; affected hosts recovered their site inventory within a minute of the release.

• Collection blindness is now an incident. A service whose probes have all been failing for six hours raises a warning that says so — absence of data no longer reads as health. The first pass across the fleet opened seventeen honest incidents.
• One package upgrade now produces one deploy event. Diffs used to be computed between adjacent discovery snapshots while an upgrade was still running: one host collected seven incidents in eight minutes. Changes now accumulate per server, a deploy is declared after ten quiet minutes, and the before/after audit compares windows around the whole run instead of anchoring mid-upgrade.
• Insight cooldowns moved to disk with a rising ladder — an hour, then six, then a day — and N+1 findings fold into one insight per endpoint with the worst query attached. Restarts on our side no longer reset anyone's cooldown.
• Hypervisor task failures are attributed to the machine that actually ran the task. Previously every cluster node reported the whole cluster's tasks, and two thirds of those incidents described a neighbor. Incident bodies now carry the reason the hypervisor itself recorded — in the console, Telegram, Slack, Teams and Jira alike.
• A continuous log storm used to read as six separate storms a day, because the release threshold sat below the traffic's natural dips. One breakage is one incident now.
• New signal: a site whose PHP backend does not exist. The static page answers fine, so nothing else could see it — every dynamic request returns 502 and the only witness was the error log. Measured before shipping: about 150 verdicts across the fleet, zero false positives, four real finds.
• Cluster-membership rules are judged only where a cluster exists. A single-node hypervisor keeps its cluster daemon inactive by design; the metric now simply does not exist there, so the rule cannot misfire by construction.
• Probes no longer assume a service listens on loopback. Sixteen catalog definitions carried a hardwired local address, so a database bound to a specific interface read as down while perfectly healthy; the probe now derives the address from what discovery actually found.
• Switching a service's monitoring off closes its open incidents immediately and retires its inventory rows, instead of leaving both to age out on their own.
• File-integrity and disk-forecast incidents close themselves now: a file that has not changed again within a day, or a forecast that stopped re-confirming, is a resolved condition, not an eternal open row.
• Identical consecutive log lines fold into one entry with a repeat counter before they leave the host. A hypervisor stuck in a security-module loop shipped four lines instead of 380; interleaved real traffic is untouched.

• Integrations got its own module: team chat, ticketing, data in, data out, and automation with AI agents — in one place, with honest statuses (connected, available, or planned) and setup dialogs where setup actually lives. It moved out of Alerting, which is once again about people: escalation, on-call, routing.
• The community catalog came alive. A discovered service without a signed definition now opens a dialog: see what discovery found, install a matching community template, request an official definition, write your own with a prefilled editor, or hide it. System plumbing is separated from real candidates — and the catalog no longer mistakes supported services for gaps when a unit name carries a version suffix or a distro alias.

• A node that loses its data store can no longer close incidents by silence: a blind evaluator now skips the cycle and says nothing, instead of reporting an empty active set that reads as "everything recovered".
• On-demand device tests find the node that actually holds the collector's connection, so a test no longer fails just because it was asked on the wrong side of the platform.

Ninety alert rules, a security audit, and the agent's source goes public

• The agent's repository is public: github.com/wakora-io/agent, under the Elastic License 2.0. One static Go binary, and now every line of it is readable before you install it. Why this license and not an OSI one is a story of its own — tomorrow's blog post tells it honestly.
• Site and trust material now say "source-available" instead of "open source" everywhere. The distinction matters to the people who review licenses for a living, so we made it before anyone had to ask.

• Six rule packs landed this week and the catalog now holds about ninety rules: cluster health (Proxmox quorum, HA resource errors, LINSTOR satellites, HAProxy backend pools), data services (Elasticsearch red status, Kafka under-replicated partitions, MongoDB connection slots, RabbitMQ backlog), mail, DNS, FTP and web (Dovecot and FTP brute force, Exim queue backlog, ClamAV signature age, 5xx storms), hypervisors, containers and the OS (libvirt storage, Kubernetes nodes and pending pods, IIS sites and pools), plus event-storm rules for log flooding and device traps.
• Every threshold was calibrated against live fleet data before shipping, and the calibration worked in both directions: rules whose trigger state turned out to be a normal condition on real hosts ship disabled with an explanation, and one rule was not built at all because thirty days of history showed nothing worth alerting on.
• Definitions can now declare rates over sliding windows and values derived across probes: connection-pool usage as a percentage of the server's own limit, container crash loops counted over a real window instead of a momentary spike, Redis memory against its configured ceiling.
• A failed Proxmox task (a backup, a migration) now has a proper catalog row — tune it or silence it like any rule — and the next successful task of the same kind resolves the incident automatically.
• Switch ports alert only when a port that was carrying link goes dark while administratively up. Spare ports never page anyone.

• For-durations now count data time, not wall time. A series that stopped reporting can no longer ripen into an incident off its last stale value.
• Count-based rules close themselves as soon as the event stream stops, instead of waiting for a cleanup sweep to notice.
• Host-down detection is three layers deep now: live socket transitions, a data-driven sweep that survives platform restarts, and a console-side sweep that closes orphaned incidents the moment the host is verifiably reporting again. We found six of our own acknowledged host-down incidents that had outlived a restart; that class is gone.
• SLO burn incidents name their host, and availability supports operator-declared excluded periods that are subtracted from expected minutes — for downtime you have decided not to count against a target.
• DRBD: the short-lived snapshot resources that backup jobs create are no longer judged as replicas. Each nightly backup was minting a false out-of-sync incident; the probe now skips them entirely.
• A race that could mint twin incidents when two deliveries landed in the same instant is closed with a lock at the birth point.

• Two independent security reviews went over the agent and the backend and produced roughly 110 findings. Each one was re-verified against the code before any fix — which mattered, because the reviews disagreed with each other, and re-verification caught a confident "verified correct" that was wrong in the most expensive place.
• The serious one: certificate-pin validation accepted a matching certificate at any position in the chain a server presented, so a crafted chain carrying our public certificate next to an attacker's could pass. We reproduced the attack in a test, changed validation to judge only the leaf, and shipped the same day.
• The agent no longer executes discovered binaries as root to read their versions. Binaries are classified by ownership and location; anything not root-owned in a root-owned path runs as its owner, or not at all.
• TLS checks on probed sites now verify the hostname, so a valid certificate for the wrong name reads as the problem it is.
• Secret material moved out of process command lines into environment files, and the agent now redacts credential-shaped arguments from process listings before discovery data leaves the host.
• Fail-open paths are closed: an unparseable version requirement in a signed definition now refuses instead of allowing, a broken log pattern withholds its counter instead of counting every line, and the hardening scan no longer reads "could not check" as a pass — an unknown drops out of the score instead of inflating it.
• Ingest hardening: the per-connection queue is bounded by bytes rather than message count, uninstall orders expire after 24 hours and replays are rejected, history reads clamp to the plan's retention on every path, and a misconfigured storage backend now refuses to start instead of silently acknowledging telemetry into the void.
• The rollout used version pinning as a freeze: client fleets stayed pinned to the release they already ran while the fixes soaked on our own hosts, then followed. The audit did not wait for a convenient week, and neither did the fixes.

• The audit log no longer loses agent-update history behind busier telemetry: machine events are fetched per kind at the source, so the update trail is complete no matter how noisy the neighboring event stream gets.
• Lifecycle and fleet views now name a team-wide version freeze for what it is. They previously claimed "auto-updates" on hosts that were deliberately held.

Network monitoring, from topology to config backups

• The full network module is live. Add SNMP devices by hand, approve them from discovered candidates, or let scheduled discovery scans sweep your ranges. SNMPv2c and SNMPv3 both supported; credentials are referenced by name and live only on your collector machines, never in our systems.
• Topology map with a weathermap: neighbors from LLDP and MikroTik discovery, switch-port edges from forwarding tables, drag to arrange, links colored by live utilization. Neighbors you do not monitor yet appear as ghosts.
• The address book answers "what is this": every IP and MAC cross-referenced against monitored hosts, devices and scan candidates, down to which switch port it sits behind. VLANs included.
• NetFlow v5, v9 and IPFIX. Flows are aggregated on your collector and only top talkers leave the box, never raw flows. Flow ingest is a new transparent billing axis, averaged over the month like the others.
• Device configuration backups: versioned pulls over SSH with strict host-key pinning, secrets masked on the collector before anything is transmitted, side-by-side diffs, and an incident when a config changes outside your baseline.
• Device alert rules: a UPS on-battery warning that escalates to critical when the battery runs low, sensor alerts, and unreachable-device detection from the poll results themselves.

• Proxmox clusters are first-class: quorum as seen from every member node (a split brain is visible by comparison), HA master and resource health, and finished migrations and backups in the event feed.
• DRBD and LINSTOR monitoring with eleven catalog rules covering degraded disks, lost quorum, stalled resyncs, offline nodes and low pools. On its first live cluster the probe surfaced silently out-of-sync replica data within minutes.
• Host availability now folds measured downtime into the day's number: a bad day reads "99.96% · 37 s down", not just a red dot.

• Rollout rings for agent updates: define canary and wave rings, set soak times, and releases promote themselves only while the rings stay healthy. Hold, promote or roll back a ring with one click.
• A definitions catalog in Settings shows every signed monitoring definition, its version, and the exact probes it runs, host by host. What runs on your machines is inspectable, not implied.

• A template marketplace with three trust tiers: official signed definitions, your own templates signed for your tenant only, and community templates, which install only after an explicit warning or become verified through review. A moderation kill-switch retracts a pulled template from every installation. Authoring comes with Pro and up.

• Multi-step transaction flows: up to ten HTTP steps with value extraction, assertions and a shared cookie jar, probed from every vantage point on a five-minute cadence with per-step timings. A test-run button shows the full trace before you save. One flow bills as one site.

• A custom report builder: scope it to the whole fleet or one server, pick the sections, choose 7 or 30 days and the report language, preview live and export to PDF. Agency reports carry the agency's own logo.
• End-of-life awareness: operating systems and service versions are checked daily against the endoflife.date feed, and versions past their support window are flagged with dates. Nothing is hardcoded; only components the feed actually answers for are shown.
• A carbon footprint estimate computed from core counts and real CPU load, labeled as the estimate it is, with editable coefficients.

• CVE severity now respects the distribution's own triage on every distribution, not just one format. A museum-piece CVE that a vendor marks unimportant no longer reads as critical because of a third-party auto-score.
• The Compliance tab is available on every plan. The trust pack is public by design, and the console view of it is too.

• Heartbeats moved to their own goroutine, so a busy probe cycle can no longer delay them: last-seen is steady and availability minutes are honest on loaded hosts.
• The agent now lifts any finite memory limit on its own control group. Page-cache accounting inside such limits was causing read storms on busy boxes; this closes the whole class.
• The installer verifies release signatures on old OpenSSL too: every asset now carries an ECDSA co-signature next to the ed25519 one, so Ubuntu 18.04 and 20.04 verify instead of failing.

• The hosts grid groups by your first tag, and the devices fleet offers cards and list views.
• The MCP server grew to 37 tools, and the REST API added transactions, marketplace, devices, flows and end-of-life resources.

Reports, immutable audit and a public trust pack

• New Reports section with four tabs: SLA, digest, capacity and exports. Reports come with Pro and up.
• SLA objectives with error budgets: pick a host, a service or a site, set a target, and the 30-day budget is tracked minute by minute. At 80% burned you get a warning incident, not a surprise at the end of the month. SLOs come with Business and up.
• The digest mails your week in one page: fleet uptime, incident count, MTTA and MTTR, the noisiest offender, and what is coming up: expiring certificates and domains, disks forecast to fill.
• Capacity view: disk-full forecasts, undersized worker pools, oversized memory reservations and idle host candidates. The savings math is marginal and honest: a host inside your plan quota shows no imaginary savings, and for agency-managed clients the money column is not shown at all.
• Scheduled exports render server-side to PDF or CSV and mail themselves on your schedule, in your local timezone, with day and hour converted together so a Saturday night schedule does not drift into Sunday.

• Every console action now lands in an append-only, hash-chained audit log: humans, API tokens and AI agents are each attributed as themselves. The chain verifies in the UI, and the evidence export re-verifies the full chain server-side, so a broken link cannot hide. Business and up.
• New Compliance tab: the subprocessor register, data residency and retention per plan, links to every trust document, and a cover letter generator that issues the pack prepared for a named recipient. Every issuance is itself audited.
• The trust pack went public at wakora.io/trust: eleven documents, from the security model to the standard-form DPA, regenerated with every agent release and signed with the same publisher key that signs the releases. Verification commands included. No forms, no gate.

• E-mail deliverability joined the Uptime page: SPF, DKIM and DMARC checks plus blacklist monitoring across four public RBLs, scored per sender domain. Domains are discovered from your monitored sites automatically; only domains that publish MX records are checked.
• The checks are honest about their limits. SPF counts DNS lookups recursively against the RFC limit of 10. DKIM probes common selectors and says so when it finds none instead of guessing. Blacklists that answer only registered resolvers are not queried at all, because a refusal is not a verdict.
• The blacklist alert rule ships disabled: some lists are noisy by design, so arming it is one explicit click per team.

• New REST resources: SLOs, report schedules, the audit log with server-side chain verification, and deliverability results. The MCP server grew to 32 tools.
• Two fixes straight from our own MCP testing: the log search needle was silently dropped on the API path and now filters as promised, and metric queries gained a metric-name catalog so a client discovers exact names instead of guessing patterns.

REST API, AI agents and agencies

• Public REST API at api.wakora.io. Everything the console shows and does is available over HTTP: hosts, metrics, incidents, alert rules, logs, APM, security, status pages, maintenance and billing usage. Available on Pro and up.
• Personal API tokens with read, act or admin scope, each bound to a single team when issued. A token never outgrows the role of the person who created it, and every call is audited.

• Wakora speaks MCP. Point Cursor, Claude or any MCP-capable assistant at mcp.wakora.io with a team token and it can read your fleet, search logs, query metrics and acknowledge incidents, under the same scope rules and the same audit trail as a human.
• 28 tools cover hosts, incidents, metrics, logs, APM, security and maintenance. Acknowledgements made by an AI agent are labeled as AI in the incident timeline, so a bot ack never impersonates a person. Available on Business and up.

• The Agency plan manages client companies from one console: a Clients view with live health per client, one-click switch into any client team, and any catalog plan assignable to each client.
• Clients never see billing. The agency receives one wholesale invoice covering its base plan plus what every client actually used.
• White-label: run the console on your own domain with your logo, name and colors. TLS certificates are issued and renewed automatically, and system emails go out through your own SMTP.

• Sign in with Google, Microsoft or Slack, for new registrations and existing accounts alike.
• Microsoft self-join for companies: verify your email domain once, and colleagues signing in with a company address land in your team automatically.
• Single sign-on works on white-label domains too.

• Slack: incidents post into your channel with Ack and Resolve buttons that act back on the real incident. On Starter and up.
• Microsoft Teams: incident cards delivered through Teams Workflows. On Starter and up.
• Jira: create an issue from any incident with one click, auto-create for criticals, and the resolution is commented back when the incident closes. On Pro and up.
• Prometheus: a metrics export endpoint, so an existing Grafana can scrape fleet status, incident counts and usage without any extra plumbing.

• Visitors can subscribe to your status page by email with double opt-in and unsubscribe with one click. Webhook subscribers cover the machines.
• A console incident can be published to your status page as a public post with one button, so the internal timeline and the public story stay separate on purpose.

• The console now speaks 29 languages, right-to-left scripts included. Everything a customer sees is translated: monitoring, account, login and the emails we send on your behalf.

• wakora uninstall removes the service, files and binary in one command. Removing a host from the console does the same remotely, and the telemetry stored for that host is wiped.

Public status pages

• Every plan can now publish a public status page. Pick whole hosts, single services or websites as components, name them in your customers' language, and the page tracks their live state from the same monitoring data you see in the console.
• Incident and maintenance posts with lifecycle states, written by a human. Monitoring data never auto-publishes anything: what your customers read is always something you chose to say.
• Branding without a designer: your logo, accent color, light or dark theme, and your own domain with TLS certificates issued and renewed automatically.
• Per-component uptime history, with the window set by plan: 24 hours on Free, 30 days on Starter, 90 days on Pro, a full year on Business and Agency.
• Every page ships a JSON endpoint and an RSS history feed for machines and readers alike.

• ClickHouse joined the catalog: process, TCP and HTTP health, running queries, connections, memory, table sizes, plus the merge-health signal that actually predicts trouble (parts per partition) and replica delay. Log collection is wired in, and down/parts/replica alert rules arm themselves once telemetry appears.
• Pure-FTPd joined too, covering both the standard and the MySQL-auth builds: version, live session count, login and transfer rates, and a brute-force alert on failed logins.
• Fixed a blind spot in MySQL and MariaDB down detection: the old rule watched a metric that disappears together with the process, so a fully stopped database could stay quiet. Down detection now reads the service state directly and fires even when there is nothing left to measure.

• EU VAT handled end to end: reverse charge for EU businesses with VIES validation of VAT numbers, correct country rates, and honest invoices on both card and wire payments.
• Card payments are live, including prorated plan switches mid-cycle and a self-serve portal for card management and cancellation.

• Synthetic external checks now run for every plan, including Free: your sites are probed from outside your own network, so an outage that is invisible from the inside still pages you.
• Any truncated text in the console shows its full value on hover.

Node.js APM, end to end

• Node.js joins PHP and .NET as a first-class APM runtime. HTTP rate, errors and latency come straight from the kernel with zero configuration, including the dynamic ports Node apps pick for themselves.
• Distributed traces via OpenTelemetry auto-instrumentation. The agent stages the change and shows you the exact command; your service restarts only when you decide, never on our schedule. systemd units, pm2 apps and Windows services are all covered, each with a guarded apply that rolls itself back if anything in the chain fails.
• Runtime telemetry per app: event loop lag, GC pauses, heap usage, plus a catalog alert rule for sustained event-loop lag.
• CPU flamegraphs for Node processes, opt-in per host and read-only by design: sampling uses perf, not an in-process inspector, so there is no debug port to expose.
• Each Node app gets its own APM card and its own opt-in billing unit, exactly like a website.

• New wakora doctor command: runs the connectivity chain in dependency order (binary, service, disk, identity, clock, DNS, TCP, TLS and key pinning, auth, data flow) and prints a plain-language verdict with the next step for every failure. wakora doctor --bundle packs a redacted report for support, with the same rule as everything else: secrets never leave the host.
• The installer now finishes with a doctor run, so a fresh install ends with a green checklist instead of silence.

Agent hardening audit and version pinning

• Closed a ten-item hardening audit of the agent (releases r218 to r220): panic recovery around every probe, race fixes in the metrics collector, atomic writes for identity and key material, honest at-least-once delivery under backpressure, and an offline spool that survives oversized records instead of wiping itself.
• The release channel is now a signed manifest with anti-rollback: the agent refuses an update that is not signed by our publisher key or that moves the version backwards, and the installer fails closed when the verification key is missing instead of skipping the check.
• Windows hardening: the agent's state directory is restricted to SYSTEM and Administrators, and the service image path is properly quoted.
• Version pinning with rollback (r221): pin any host to a specific agent version from the console and it converges there, up or down, with signatures verified either way. Unpin and it returns to latest. A follow-up (r247) added a three-layer guard so a pin can never fight the updater into a restart loop.

• Fixed a case where stylesheets and scripts served through PHP could return errors on RUM-enrolled sites: the snippet injection now wraps document requests only. Shipped as an artifact refresh, so no PHP services had to be restarted.

A much lighter agent

• Found and fixed the real cause of high disk reads on busy hosts: our own systemd memory limit was evicting the page cache the agent depends on, so every cycle re-read logs from disk. Read traffic dropped by three orders of magnitude on the worst box (r205). The agent now detects an inherited limit that is too tight and lifts it through systemd itself, live, without touching your unit files by hand.
• Journald is now read once per cycle by a shared reader instead of one journalctl process per probe, and per-site filesystem scans are cached by content signature.
• Discovery no longer re-runs on cosmetic process changes, ending a feedback loop that could rescan a host dozens of times an hour.

• Retired a false positive: bots probing for PHP files that do not exist no longer count toward the error-storm rule. A dedicated rule now catches genuinely broken sites by shape (few paths, many distinct visitors) instead of raw line volume, validated against a full day of live traffic before shipping.
• SSH brute-force counting no longer double-counts the daemon's echo lines and attributes attempts to the correct source address, with country lookup on the resulting security events.

July 2026 in review

The month most of the platform came together. The short version, area by area.

• Configless agent for Linux, Windows and macOS: install with one line, discovery finds your services, signed definitions from the catalog start measuring them. No YAML.
• Catalog breadth: web servers, PHP-FPM pools, MySQL, PostgreSQL, Redis, MongoDB, Elasticsearch, mail (Postfix, Dovecot, Exim), DNS, FTP, queues, load balancers, Docker, Proxmox, KVM, Hyper-V, IIS, MSSQL and Kubernetes.
• SNMP for the boxes you cannot install anything on: switches, UPS units, PDUs, with collector roles (primary and backup per site), sensor math done right, PoE, traps and informs.
• Domain lifecycle watching next to certificates: expiring registrations, dead DNS, drop-catch detection.

• Incident engine with rules that arm themselves when matching telemetry appears, inhibition (a down host does not page you fifty times), maintenance windows, per-server rule overrides and honest auto-resolve.
• Escalation chains with timezone-aware on-call rotations, overrides, coverage-gap warnings, and a phone call with voice IVR as the final step. Ack from Telegram, email, the console or the call itself.

• Full APM for WordPress, PHP and .NET: kernel-level RED metrics without touching your web server, method-level traces, CPU flamegraphs, N+1 query detection and per-plugin attribution. Activation is staged: the agent prepares everything and a human applies it. We never restart your services.
• Real user monitoring with Core Web Vitals, JS error tracking and geo breakdowns, plus a click-through from a slow page view to the exact backend trace that served it.

• Full log management: journald, files, Docker, Windows Event Log, IIS, MSSQL and syslog devices. Secrets are redacted on the host before anything is sent. Full-text search, live tail, per-source depth control and volume caps so a runaway debug log cannot surprise your bill.

• Console dashboard with live-breathing host pages and time travel, events timeline, security module (CVE correlation from your package inventory, CIS scans, file integrity, brute-force sources), synthetic checks from external points, and transparent usage-based billing with proforma invoices.