Agent changelog

What changed in the agent from version to version.

Agent changelog #

What changed in the agent – the program running on your systems. Platform changes are in the website changelog.

How to bring it up to date: updating the agent (agent-update).

1.3.0 · 2026-08-18 #

Measuring DNS properly.

• The agent gained its own DNS querier. The built-in resolver only answers "which address does this name have?" and hides everything that makes a measurement: the time to live, who answered, whether the answer was authoritative, and whether signatures came along. And it can only ask the resolver the system prescribes.
• A DNS measurement now queries up to three kinds of server and compares the answers: the local resolver, the authoritative name servers of the zone, and optionally public resolvers. The value lies in the difference — it finds redirections, broken anycast nodes and half-rolled-out changes.
• New record types: CAA, DS, DNSKEY, plus SOA with all its timers. AXFR is deliberately absent — a zone transfer is not a measurement, it is a copy.
• On DNSSEC we say only what we know: whether signatures came along (RRSIG) and whether the queried resolver accepted them (AD bit). Validating ourselves would mean recomputing the chain of trust from the root — a half-finished validator says "valid" where it only means "found nothing".
• For anycast services the identifier of the answering node is carried along (NSID) — it tells a broken node from a broken service.

1.2.0 · 2026-08-18 #

IPv6 on equal footing.

• Every Sonar measurement now reports which address family it used, plus the resolved address. The result no longer holds just a round-trip time but also the path — and it is the comparison between IPv4 and IPv6 that carries the real information.
• If a target resolves to A and AAAA, the agent now measures both: the server creates two assignments, one per family.
• The blocklist gained three ranges: the documentation range 2001:db8::/32, 100::/64 (discard-only) and 2002::/16 (6to4). A new test keeps both sides — agent and server — in step.
• The raw socket for traceroute now listens on :: directly for IPv6 instead of falling back.
• More IPv6 settings are collected (forwarding, use_tempaddr, autoconf, accept_ra_defrtr, disable_ipv6) — they feed the new dashboard checks.

1.1.0 · 2026-08-18 #

Inodes.

• The agent now also collects inode usage per filesystem. A filesystem can be full while space remains: when inodes run out, every attempt to create a file fails with "No space left on device" while df -h shows forty percent free. It is one of the most confusing failures there is — and statfs delivers the numbers anyway, so it costs no extra work on the system.
• Not every filesystem has them: btrfs and XFS allocate inodes dynamically and report 0. The value then stays empty instead of claiming 0%.
• This feeds the new dashboard alert "Inodes running out".

1.0.0 · 2026-08-18 #

Version numbers that mean something.

• The agent is now 1.0.0 instead of phase-25-4-g09c790d. The number follows Semantic Versioning: the first digit changes when something breaks (protocol, configuration format), the second for new capabilities, the third for fixes. An update now tells you what it means — the old identifier only told you how many commits had passed.
• Build time and commit are still there: node64-agent --version shows both.
• The server now compares versions by rank, not as text. Previously 1.10.0 would have ranked below 1.9.0 — a bug that would have surfaced exactly at the tenth release.
• If you still run a phase-… build you will see the update notice: such identifiers count as older than any semantic version.
• Nothing changed in what the agent collects. Same agent, just with a number that says something.

phase-18 · 2026-08-17 #

Modules can be switched separately.

• The security check can be turned off per device, independently of the measurement network. When it is off, the agent does not collect the inventory at all – it is not sending less, it gathers nothing. Measured: 532 packages and 22 KB become 0 packages and 1 KB, and collection takes 4 ms instead of 770 ms.
• Per-device reporting interval, set in the dashboard. Less often is always possible, more often only as far as your plan allows.
• node64-agent update – the agent updates itself on request, with a verified signature. Nothing still happens automatically.
• Fixed: the one-shot run node64-agent once never applied the server's settings (including the monitored file paths) – it started from defaults every time.

phase-17 · 2026-08-17 #

More measurements, one important bug less.

• Data volume per network interface is now collected (received and sent).
• Fixed, and this one mattered: the agent read mount points from its own view instead of the system's. Because the service runs hardened (ProtectSystem=strict), it saw its own root filesystem as read-only and reported every mount point as "read-only". The analysis skips read-only filesystems when checking disk usage – so on every regularly installed instance, "disk filling up" detection was silently disabled. If you run an older version, update.

phase-16 · 2026-08-16 #

Python packages and Debian derivatives.

• pip packages are collected. Anything installed via pip install does not appear in the system package manager – and was therefore never checked for vulnerabilities. Now it is.
• Debian derivatives (Parrot, Kali and relatives) additionally report their real Debian base so vulnerability matching works. Before, those systems produced no results at all.
• Ransomware and malware traces: ransom notes, mass-encrypted files, age of the virus scanner signatures.

phase-15 and earlier #

The agent was built in phase 12 and has grown since: drive health (SMART), filesystems, pools (ZFS, mdadm, btrfs), container hardening, network bonds and bridges, kernel settings, log signals and the Sonar measurement network.