• A reminder mail before your licence ends. The licence server now emails you 30 days and again 7 days before your licence ends, with the licence key, the end date and what to do next: choose a plan at the end of a trial, check the payment method of a yearly subscription, or contact us to renew. Monthly subscriptions renew themselves and get no reminder. This comes with an update of the licence portal, not with a release of AtlasEye.

• Signing out forgets what your account had loaded. When someone signed in on the same browser tab after you signed out, AtlasEye could show them pages with your account's data, such as the user list, devices or settings, for up to five minutes. Signing out now empties that memory, even when the sign-out request itself fails.

• NIS2 deadlines reach you wherever you get alerts. Each report a NIS2-reportable incident owes its CSIRT now raises an alert on the Alerts page and the bell, and on every active email, Telegram and webhook channel, in that channel's language: 6 hours before the early warning is due, 12 hours before the incident notification and 7 days before the final report, and again once a deadline passes unfiled. Marking the stage as filed closes its alert. The alerts go to your own channels, never to a CSIRT.

• Write the report sections in the NIS2 panel. A new Report details section takes the indicators of compromise, the affected services, the mitigation measures applied and ongoing, the root cause, the outstanding actions and the cross-border impact details. They go into the reports instead of TBD and empty lists, and every time in a report now shows its zone (UTC).
• Name who files the reports. Settings → General has a NIS2 reporting contact card: your NIS2 registration or VAT number and a contact name, email and phone. Every NIS2 report names them with your organisation, and a CSIRT's reply to an emailed report goes to that contact. The NIS2 panel warns while the contact is incomplete, and still sends.

• You choose which other Member States get a copy. While cross-border impact is on, Email to CSIRT offers each affected Member State for a copy, none ticked: the CSIRT of your own country always gets the report, and the directive has it inform the other states. The email is easier to check: it names the stage in words, the incident's title and the other affected states, carries a severity badge that follows the incident, and gives the SHA-256 of the attached file. A copy keeps the file name of your country's report.

• Security update for a bundled library. AtlasEye now ships certifi 2026.10.19, the list of root certificate authorities its Python services trust for HTTPS connections. It removes one of them, eMudhra's emSign ECC Root CA - G3: the private keys of eight certificate authorities under it were compromised, so anyone holding one could issue a certificate for any website (advisory GHSA-6q48-6c7w-9gw2). A server whose certificate depends on that authority now fails the certificate check; every other connection works as before.

• Alerts about the AtlasEye host arrive while no licence is active. Without an active licence, alerts about AtlasEye's own host, such as a disk filling up or the API not answering, never reached your email, Telegram or webhook channels, while alerts about your devices did. Both now arrive.

• NIS2 deadlines follow the directive. The final report is due one month after the notification, as Article 23 says, not 30 days: from mid-January to the end of February, 30 days gave up to two days more than the law. The NIS2 panel shows the moment the deadlines count from, and you pick it from a calendar. A time in the future is refused, and each change of it is kept in the incident's timeline.
• NIS2 reports go only where you meant. The CSIRT country is no longer preset to Germany: choose it before you download or send. Email to CSIRT and marking a stage as filed each ask you to confirm first, and the email confirmation names every CSIRT that will receive it. A report lists the impacted Member States, and the email goes to them, only while Cross-border impact is on. Cancel drops your unsaved NIS2 changes; before, they went out with the next save.
• Better NIS2 report files. The German and French layouts name every sector in their own language. A control character pasted into a title or a description no longer makes the Italian XML unreadable. The email calls the report's SHA-256 a checksum, not a signature. Each NIS2 save and each filing now shows in the Activity Log, and on a phone the NIS2 panel fits the screen.

• The dashboard shows one globe, and its tiles count every event. The events and countries tiles at the top of the dashboard now count every event of the last minute and every country it came from, so a busy network no longer reads 200 events and only the countries among them. The second globe, Live network activity, is gone: it counted only its own latest 30 events, so its numbers did not match the tiles. A dashboard layout that showed it opens without it, and on a phone the small globe shows no numbers of its own. If the count is ever unavailable, the tiles count the events the page has received, and a + after a number means the minute held more. The tiles say "1 country active", not "1 countries active", and use each language's plural forms.
• A long help text can be read from its first line. The help text beside "Network at a glance" on the dashboard is taller than the window, and its first lines sat above the top of the page, out of reach. A help text that does not fit the window now scrolls inside its box, keeps a small gap to the top and bottom of the window, and opens at its first line every time. A help text that only just fits above or below its icon may now open on the other side, where it has room.
• The map in the World Map's IP details shows again. Opening an IP on the World Map showed a blocked-page icon where its small map belongs. The page's own security settings did not allow the OpenStreetMap map, although the gateway did; both now allow it.
• The dashboard globe holds still while you point at it. Pointing at an arc or at a server's point on the turning globe showed its details for a moment, and then the globe turned it away. The globe now stops turning while the pointer is on an arc or a point, and turns again when the pointer leaves.
• Security update for a bundled library. AtlasEye now ships aiohttp 3.14.5, the library its Python services use for HTTP. It fixes three published security advisories: a connection that could stay open without sending anything, requests that could use too much memory or processor time, and a cookie marked secure that could be sent without encryption. Nothing changes in how AtlasEye works.

• Settings → System moves the web ports. A Full Access user can now move AtlasEye's web ports on the Web ports card in Settings → System, as well as with sudo atlaseye web-port. AtlasEye then puts the old ports back by itself unless someone opens the new address and presses Keep these ports within 5 minutes. The card says when the address users open needs sudo atlaseye url set https://NAME:PORT, with the name already in it. It also says what else the move changes: before it, the single sign-on callback to allow at your identity provider, and that Service Manager agents need setting up again; after it, the Public App URL to change in Settings → General, because links in notifications use it.
• Single sign-on works on a moved web port. When users open AtlasEye on a port other than 443, for example after sudo atlaseye web-port --https 8443, single sign-on now gives your identity provider the callback address with that port, https://NAME:8443/api/v1/auth/oidc/callback, and brings users back to the same address and port after they sign in. Allow that callback in your identity provider. An install on 443 sends the same callback as before, so nothing changes in its identity provider. The server name in the callback no longer comes from a header that a client can add. If a proxy in front of AtlasEye replaces the server name and passes the original one only in its own X-Forwarded-Host header, set OIDC_REDIRECT_URI in .env to the public callback address, then run sudo atlaseye compose up -d --no-deps --force-recreate api.
• Service Manager agents and the status feed work on a moved web port. After sudo atlaseye web-port --https 8443 --http 8080, a Service Manager agent you set up is given the address with that port: https://NAME:8443, or http://NAME:8080 while AtlasEye still uses its self-signed certificate. Before, it was given port 443 or 80, where another web server may answer, and the agent sent its credential there. The links in the status page's Atom feed keep the port too. Agents set up earlier keep the address they were given: where it no longer reaches AtlasEye, set them up again. An install on ports 80 and 443 gives the same addresses and links as before. A cache in front of AtlasEye must key its copies on the Host header.
• AtlasEye says what still uses the old address after the web ports move. When you open AtlasEye on another port than the Public App URL names, for example after sudo atlaseye web-port --https 8443, the setup checks now show a warning, because links in notifications would still lead to the old port. Change the Public App URL in Settings → General to the new address. When users reach AtlasEye on the port it names, through NAT or a proxy, select Acknowledge instead. sudo atlaseye web-port and sudo atlaseye url set now end with what still names the previous address: the Public App URL, the single sign-on callback to allow in your identity provider, Web Analytics snippets already pasted into websites, and Service Manager agents to set up again. When .env sets OIDC_REDIRECT_URI or AGENT_CALLBACK_BASE_URL, they name that address too. Behind a proxy that replaces the server name, set OIDC_REDIRECT_URI to the public callback address and AGENT_CALLBACK_BASE_URL to the public address, then run sudo atlaseye compose up -d --no-deps --force-recreate api. On an install set up without an address, web-port no longer tells users to open https://localhost:8443/.
• Dates stay on one line. On a phone, a date inside a sentence, such as the day your licence ends or the time an account is locked until, could break after a hyphen; in Persian and Arabic the line then read "-2026" above "10-18". Such dates now stay whole. On a phone the licence, disk space and setup banners show their button under the text, so a date and time there no longer break inside the time. In Persian and Arabic the disk space banner now shows a folder such as /var/lib/docker with its slash in front.

• AtlasEye's web ports can move. sudo atlaseye web-port --https PORT moves HTTPS off 443 and --http PORT moves plain http off 80, for example when another web server on the host already uses them; sudo atlaseye web-port alone shows the ports in use. The command checks the new ports first and changes nothing when another program or container uses one, and it puts the old ports back when AtlasEye does not answer on the new ones. No page in the web interface changes them. The redirect to HTTPS, atlaseye status and the update checks follow the new ports. After a move, give the address users open its port with sudo atlaseye url set https://NAME:PORT, and open the new ports in your firewalls. Setting GATEWAY_HTTP_PORT and GATEWAY_HTTPS_PORT in .env and recreating the gateway still works, without the checks. An install that moves neither keeps 80 and 443, and a rollback to an older release publishes 80 and 443 again.

• Make the World Map taller or shorter. A bar under the World Map changes its height: drag it, or select it and use the arrow keys. Home and End go to the smallest and the largest size, and Enter puts the map back to filling the window. Your browser remembers the height. A map taller than the window scrolls with the page, and its IP details open over the screen. In full screen the map fills the screen and the bar is hidden. On the globe, the mouse wheel no longer scrolls the page while it zooms; at the smallest or largest zoom it scrolls the page.

• The World Map answers a new time range at once. A time range or filter you picked used to wait up to 30 seconds for the next refresh. The map now asks at once and keeps the bubbles it shows until the new ones arrive; a thin bar along the top of the map shows that it is updating.
• Live events blink once where they come from. With the live feed on, each new event blinks once on the map, with a ring, and fades in about 2.5 seconds. With Traffic lines on, its line to the server that logged it fades with it. Events that arrive together blink one after another, and up to 28 are on the map at once. Pause holds them where they are. With reduced motion turned on in your system, each event shows as a still dot for 6 seconds. The looping pings of the six busiest senders are gone.
• The live feed stays in time order. The World Map's live feed could jump between older and newer events every 1.5 seconds. It now stays in time order, newest first, and holds the last 100 events, so an event that arrives late, for example from a device whose clock runs behind, still shows and blinks.
• A warning beeps once. The alert sound and highlight fired again for every warning among the last 100 events each time a new event arrived. They now fire once for each new warning or more serious event, also when the sender's clock runs a little behind.
• The threat marks and timeline follow the latest query. After a quick change of range or filter, the threat marks and the timeline could show the answer to an earlier query, or keep it after a failed request. Only the answer to the latest query is shown now, and a failed request clears them.
• Empty sections in the IP details read clearly. In the details of a World Map IP address or country, "No activity data" and "No recent logs" ran into the section title. They now sit on their own line under it.

• The capacity advice gives the command. When the measured load is above your sizing profile, the Capacity card (About page, and the Dashboard's System Overview) now names the command that switches to the next profile, sudo atlaseye profile set <profile>, and says what it does, instead of telling you to edit .env by hand.

• Failed changes explained in your language. When a change of the Syslog listening port or of the HTTPS certificate fails or is refused, the card now says why in the page's language instead of in English.

• The DNS health board loads faster with many zones. It asks Cloudflare for your zone list once, instead of once more for every zone it grades.
• DNS pages report a Cloudflare outage sooner. When Cloudflare stops answering, the DNS pages say so after one timeout instead of waiting through every zone first.
• The Log Explorer search hint reads in full. The hint in the search box ran past the edge of the box and was cut off, on every screen size and in every language. It is now short enough to read whole, on a phone too, and in every language it says the box also searches IP addresses.
• The Process filter lists only what you can still see. In the Log Explorer, with a host, a severity or a search chosen, the Process list offered processes that showed no rows. It now lists only the processes your other filters can still show, and it updates when you change one.
• Facilities 12 to 15 have names in new logs. The collector stores them as ntp, audit, alert and clock instead of unknown, and a message without a tag gets that name as its process instead of facility-12 to facility-15. Logs received before the update keep their old names.
• The integrity warning says why in your language. When the check of AtlasEye's program files fails, the banner at the top of the page and Settings → Licensing now give the reason in the page's language instead of in English.
• The SLA report fits a phone. On a narrow screen the SLA / Uptime Report table ran past the edge of its card; it now scrolls inside the card. On a wide screen the Devices total no longer touches the Download CSV button: the totals start on their own line.
• Help uses the names on the screen. A few Help pages named controls that have changed: the search box of the Log Explorer, the Mute button (once called Block), the 1H and 6H time ranges of Syslog Security, the Backup & Archive page and the Syslog card of the status page. They now use the names the pages show, and the WHOIS note gives the messages the lookup really shows. The German, Spanish and Portuguese Help said that read-write accounts can open Service Manager and that Profile shows your device scope: Service Manager needs Full Access, and an administrator sees your scope in Users.
• Persian and Arabic Help checked line by line. Every Help text in Persian and Arabic was compared with the English text and with the screen it describes. Facts that had drifted, button names that differ from the screen and terms that changed from page to page are fixed, so each idea has one name everywhere, the one the screens use. A few screen texts change with it: in Persian the SLA report, the GoDaddy settings title, the World Map tools and a Service Manager warning; in Arabic the status page banner settings.
• Role names in Persian and Arabic. Help and the messages in Settings, Users, the AI assistant, rollback and system reset now name a role the way the Users page does, instead of full, read_write or read_only or the English name. Configuration snapshots have one Persian name and one Arabic name everywhere. The Profile page and the role filter of the Access Matrix show the role's name in every language, not its internal id.
• Licence messages in your language. When an action is refused because the licence is not activated, has expired, does not include the feature or has reached its device limit, the message now gives the reason in the page's language instead of in English. Only a Full Access admin is told to open Settings → Licensing; everyone else is asked to contact an administrator.
• The Infrastructure page says when its figures are missing. When the platform's Prometheus does not answer, the page now shows a yellow notice above the figures instead of zeros that looked real. The notice goes away by itself once Prometheus answers again.
• Role names in German, Spanish, French, Portuguese and English. Help and the hints in Settings and on the About page now name a role the way the Users page does, for example "Vollzugriff", "Lectura/Escritura" or "Lecture seule", instead of full, read_write or read_only. The Access Matrix cards name the roles the same way, and the explicit grants card says "write" and "read" in your language instead of "w" and "r", on a small line under the number. On a narrow phone the timezone field of the Profile page no longer makes the details table scroll sideways: a long placeholder ends in "..." instead.

• Your own HTTPS certificate from the browser. Settings, System has a new HTTPS certificate card. It shows the certificate in use and when it expires, and a Full Access user can install their own there, as PEM files or one PFX file. AtlasEye checks the certificate first, and puts the previous one back when the gateway does not serve the new one.
• The location credit sits under the maps. The small "IP Geolocation by DB-IP" line, with MaxMind's credit while your own MaxMind key is in use, now sits under each map, globe or table that shows a location, and next to AI answers, instead of at the end of the page footer. On a phone the footer no longer wraps onto several lines.
• A Host filter IP finds that sender only. In the Log Explorer, an IP address in the Host filter also found every address that contains it: 10.0.0.1 also found 10.0.0.10 to 10.0.0.19 and 10.0.0.100 to 10.0.0.199, in the table and in Export CSV. It now finds that one sender. A name still finds every host whose name contains it.
• Manual Purge by host deletes only that host's logs. In Syslog Settings, Manual Purge with a host also deleted the logs of every host whose name or address contains it: purging 10.0.0.1 also deleted the logs of 10.0.0.10 to 10.0.0.19 and 10.0.0.100 to 10.0.0.199. The preview count and the purge now match the host exactly: type its name or address as the Log Explorer shows it, and press Preview to see what will be deleted.
• The Log Explorer opens on the last 24 hours. It used to search every stored event, so Export CSV could hold up to 50,000 rows from other days. A Last 24 hours tag above the table shows the range; close it, or clear Time range, to search every stored event. Opening the Log Explorer from another page keeps the range that page passes.
• The World Map's IP details fit a phone. On a phone, the details of an IP address opened inside the map, so View all logs could sit below the bottom of the screen, and an IP opened from a country's list appeared under that list. The details now cover the screen, above the country list, with View all logs in sight.

• Help names the OK button as the dialog shows it. In Spanish, Persian and Arabic, the Help steps for adding an IP address, an IP range, a NAT rule, a port forward or a user said to press "OK", but those dialogs show "Aceptar", "تایید" and "تأكيد". Help now uses the word on the button.
• Help describes the Dashboard's Reset as it works. Help said that Reset in the Customize dashboard drawer shows every section, the globe included. Reset goes back to the default layout, where Live network activity stays hidden, and Help now says so in every language. In Persian and Arabic, Help also puts a section's drag handle in its top right corner, where those languages show it.
• Arabic Help uses the words on the Arabic screen. Many Arabic Help steps, FAQ answers, glossary entries and page hints named a button, field or tab by its English label, such as Save, Remove or Purge, while the Arabic screen shows حفظ, إزالة and تطهير. Help now names each control as the screen shows it, including the confirm buttons of dialogs.
• Spanish, German and French Help use the words on the screen. Some Help steps named a button, column or option by its English label, such as Customize, Raw or None (Service Only), while the page shows Personalizar, Roh or Aucun (services uniquement). Help now names each control as the screen shows it. The Syslog Analytics step also calls the threat-row menu Copy block rule, as its button does.
• Portuguese Help uses the words on the Portuguese screen. Many Portuguese Help steps named a button, column or tab by its English label, such as Save, Refresh or Export, while the screen shows Guardar, Atualizar and Exportar. Help now names each control as the screen shows it.
• Persian Help uses the words on the Persian screen. Persian Help steps, FAQ answers, glossary entries and page hints now name each button, column and tab as the Persian screen shows it. The Timeout field of a device now reads as a time limit instead of a pause, and the button that ends a session reads Revoke (ابطال) instead of the word the app uses for Cancel, as the API token button already does.
• The IP range dialog and the Service Manager checks use your language. The Status choices, the Comment field and the examples in the IP range dialog, and the OK and FAIL results of the Service Manager's nginx and certificate checks, were in English whatever language you chose. They now show in your language.
• Source IPs show a name beside them. An event's source IP, the remote address in its log, now shows the name you gave that address: an IP address or range under Sender names and locations, an IP Addresses hostname shown in Syslog, or a monitored device's name. It reads Name (IP) in the log list and its details, on the World Map, on the Dashboard, in Syslog Analytics and on the Security tab, and the IP stays on screen. Searches, filters, links and block rules still use the IP, and the exports add the name in a column of their own.
• The World Map fits a phone. On a phone, the Live Feed and the IP details panel now fit the map, and the panel's event count is in your language. In Persian and Arabic, the IPv6 address on the View all logs button reads in the right order, and the button's label wraps instead of running out of it. In the country details panel, each count stays at the end of its row.
• Persian and Arabic names are no longer stretched in IP lists. On Windows, a Persian or Arabic name in an IP chip or another field that shows machine text had its letters spread wide. It now shows in a normal Persian and Arabic font.
• The threat cards show IPv6 addresses in the right order. In Persian and Arabic, an IPv6 address first in the Brute Force, Port Scan or Privilege Escalation card read out of order and moved the names after it.
• Help fits a phone. On a narrow screen, a long word in a feature description and the runbook links in Help no longer push the page sideways, and the Open page link sits under the description, so the description uses the full width.
• Paths read the right way in Persian and Arabic Help. Help showed a path such as /thank-you as thank-you/, and a page address such as /ips as ips/. Paths now read left to right.
• The GeoIP database card names .env correctly in Persian and Arabic. The file name read env., and the brackets after it were flipped.
• The Dashboard and the threat cards use the Persian and Arabic comma. In Persian and Arabic, the GeoIP database tag, the device clock skew list and the IP lists of the Syslog Analytics threat cards now separate their parts with ، instead of a Latin comma.
• Names shown beside an IP address stay on one line and in order. An IP Addresses hostname and a device name are now refused when they hold a line break or an invisible character that changes the text direction, as a sender's name already was: beside an IP address, such a character could reverse the address. A CSV import reports such a row as an error and imports the others. The device name in the onboarding wizard now has the 100-character limit of Add Device, and a device added there without a name, whose host name is longer than 100 characters, is named after the first 100 of them instead of failing at Apply.
• The About page describes AtlasEye in your language. The line under the product name was always in English.
• The AI Usage help lists every AI feature. It named five of the ten features the page counts.
• In English, "Summarize this page" works on the Log Explorer without an AI model. The assistant now gives a fixed summary of the visible logs, marked as such, as it does on other pages, instead of saying it is not configured.
• On Persian and Arabic pages, IP addresses and map coordinates read in the right order. The parts of an IPv6 address no longer swap places, and the minus of a negative coordinate stays in front of the number. The same holds for a negative number typed into a number field, and for the example coordinates of the server location.
• More of Syslog, the World Map and the Dashboard is in your language: the threat summary, the severity tags of the Security Dashboard, the title of the IP details, the age of the GeoIP database, the ages in the Live Feed, and the refresh choices of Syslog Analytics and the Live Feed.

• DNS shows a zone's status in your language. Drift details name the record fields as the Records table does, and in Persian and Arabic those fields no longer run into each other. Add domain with an empty domain shows the field error.

• File names and paths read the right way in Persian and Arabic. In Help, Syslog, Settings and other pages, a file name such as .env read env., a path such as /metrics read metrics/, and a negative number such as -90 read 90-. They now read left to right, and so do ports such as :80, prices such as $0.00, Telegram handles such as @BotFather and web addresses such as https://, which read 80:, 0.00$, BotFather@ and //:https.

• The bell shows a device that goes down. When a monitored device goes down, a Device Down alert now appears in the bell at the top of the page and in the Alerts list, and a degraded device shows Device Degraded. The alert follows the device and clears itself when the device is back up. A device that is already down gets its alert at its next check. Turning off a device's alerts or a maintenance window still stops only the notifications.
• The alert bell fits a phone. On a phone, the bell's panel ran off the left side of the screen and hid each alert's severity and condition. It now opens inside the screen. The severity in the panel is in your language, and in Persian and Arabic a condition such as disk:/ and an alert message in English read in the right order, in the bell and in the Alerts list. In the Alerts list, the Acknowledged state stays on one line. The hint over the bell no longer covers the top of the open panel.

• The World Map uses the whole window. The map now grows with the window, and the tools you use less often (colour mode, the legend, projection, export, the share link, saved views, the IP filters and AI analysis) sit behind a Map tools button. They start shown on wide screens and hidden on smaller ones, and your browser remembers your choice. A point's details are no longer hidden under Top Countries: the list folds to its title while they are open and opens again when you close them. Top Countries rows also answer to Enter and Space, and in Persian and Arabic the map's panels sit on the mirrored side and a point's coordinates keep their minus sign in front.

• The log list says when it cannot search. When the log store was down, slow or out of memory, the Log Explorer showed an empty list, as if no logs matched. It now says which of these happened and offers a Retry button. On the Dashboard, the same failure raises the loading-error banner instead of showing zero events.

• The Process filter finds every process. The Process list in the Log Explorer offered only the five busiest processes of all time. It now lists up to 500 processes that logged in the chosen time range, busiest first. When there are more, a note under the list says how many, and typing searches all of them. If the list cannot be loaded, it says so.

• Export CSV holds what the table finds, and opens cleanly in Excel. Export CSV now always downloads the file the server builds from the table's own search and filters: every matching row, up to 50,000, with its times in UTC. Persian, Arabic and accented text stays readable in Excel, the message after the download gives the number of rows in the file, and an export the log store cuts short fails instead of producing an incomplete file.

• Time ranges such as Last 15 min move with the clock. With auto-refresh on, a time preset kept showing the window it was picked in. It now always covers the chosen span up to the latest refresh, and the time controls show the range in use.

• Auto-refresh no longer piles up searches. On a slow log store, auto-refresh started a new search every 10 seconds even while the last one was still running. It now waits for the last one, updates the list without dimming it, and updates the counters every minute. With auto-refresh off, coming back to the browser tab no longer reloads the list you are reading.

• Paging stops at 10,000 results and says so. The Log Explorer can page through only the first 10,000 results, and pages past them could come back empty. The pager now stops there, a line under the table suggests a narrower time range or fewer filters, and the footer still gives the exact total.

• The counters above the log list say what they count. A line above them now says they cover every stored event and that the filters change only the table. A host's count no longer stops at 99+.

• Excluding a word no longer empties the log list. A word typed to exclude made the whole search fail, so the list looked empty. It now hides only the lines that contain the word.

• The Host filter ignores case. Typing Router-1 now also finds router-1.

• Facilities 12 to 15 show their names. The Log Explorer now shows ntp, audit, alert and clock instead of the numbers 12 to 15.

• The Log Explorer reads right in Persian and Arabic. The Persian footer shows the number of entries again, the total uses your language's number format, and the arrow in the time filter tag points the reading way.

• Log messages keep their own direction. A message in English reads left to right and a message in Persian or Arabic right to left, in the log table and in the log detail, whatever language the page is in. A long message wraps between words, so an IP address or a port number is no longer split across two lines; after two lines it ends with "…", and a click on the row shows all of it. The severity tag stays on one line in every language, and the log table fits a 1440 px screen without scrolling sideways. On a phone the time in the log detail no longer breaks in the middle.

• Help for the Log Explorer covers these changes. It explains the Process search, the export file, the 10,000-result paging limit and what the list shows when the log store cannot answer, in every language.

• A Cloudflare, GoDaddy or firewall that does not answer no longer stalls other pages. While a DNS page waited for Cloudflare or GoDaddy, or Block on device waited for a firewall, other pages such as Settings could stop loading and show a 504 error. Now only the page that needs that service waits for it.

• Small wording fixes. The World Map says "1 event" instead of "1 events", a Process list that cannot be loaded no longer mentions hosts, and German texts on the World Map, in Syslog Settings and in the WHOIS notices use ä, ö, ü and ß.

• Arabic notice about excluded addresses. In Arabic, the Syslog notice that counts the excluded IP addresses read in English for 2 to 99 addresses. It now reads in Arabic for every count. In French, Spanish and Portuguese, counts of exactly one million, two million and so on also read in English, and now read in their own language.

• The notice about excluded addresses fits a phone. On a narrow screen the notice above the Syslog pages squeezed its words to a letter or two per line and, with many excluded addresses, could be taller than the screen. It now wraps like normal text, shows at most three lines of addresses, and keeps Manage in Settings next to the close button, also in Persian and Arabic.

• Process names in the Log Explorer stay on one line. A long process name such as systemd-networkd-wait-online wrapped a few letters per line and made its row tall. It now ends in an ellipsis and shows the full name when you point at it. In Persian and Arabic the Process filter no longer cuts off the beginning of a Latin process name.

• The GeoIP age warning fits an air-gapped install. When the GeoIP database is old, the Dashboard warning told every install to allow HTTPS to download.db-ip.com. An air-gapped install, or one not activated yet, never downloads, so it now says to update AtlasEye, and points to the Server runbook in Help & Features for copying in your own GeoLite2 City file instead.

• The World Map fits a phone. On a phone the time ranges above the World Map ran off the screen; they are now a menu. The Top Countries list starts folded there, so the map stays visible, and opens with one tap. The countries button in the map toolbar now shows whether the list is open.

• World Map on narrow screens. The open Top Countries list no longer covers the notes beside the map's status badge, the severity filter shows its whole label, and the Arabic 30-day range reads correctly.

• Dates read in order in Persian and Arabic. After Persian or Arabic text, dates such as 2026-10-13 in the licence notice, the public status page, backups, record retention, rollback, DNS, Services and other messages read 13-10-2026, and some showed the time before the date. They now read in order.

• The AI assistant no longer reports made-up settings. Without an AI model, asking it to summarize a Settings page used to say that two-factor sign-in and Turnstile were off, whatever they were set to. It now says that no AI model is configured.

• Charts read correctly in Persian and Arabic. The labels beside a chart's axes no longer run into the chart: names, IP addresses and values sit next to their axis, IP addresses read in order, and a shortened Persian or Arabic name ends in "…" where it should, in every language.

• Top Talkers fits a phone. On a phone the source names take less room, so the bars have space; an IP address shows in full and no name breaks onto two lines. The tip over a bar labels the count in your language.

• AI Usage speaks your language. The cost chart, the By feature and Calls tables and the filters name each AI feature and call result in your language, such as "Alert triage" or "Timed out", where they showed an internal tag such as triage or timeout. The Dashboard's AI feedback panel names its sources the same way.

• AI Usage fits every screen. The feature and status filters show long names in full. On a phone, the cost chart's tooltip stays on screen and shows every line. In Persian and Arabic, the tooltip keeps a name such as "DNS traffic insight" in one piece and shows amounts as "$0.05".

• The Dashboard's AI cards read correctly in Persian and Arabic. Each card keeps its buttons at the far end of its title, each AI prediction keeps its buttons at the end of its line, and icons and status dots no longer touch their text.

• The topology map shows each role only what it can do. With Read Only access the map is for viewing: nodes stay where they are, no links can be drawn, and the "Failed to save node position" and "Access denied" messages no longer appear. Read/Write users move, link and edit nodes as before; removing a node or a link takes Full Access, which the server already required.

• Network is now IP Management. The sidebar group with IP Addresses, IP Ranges, Conflicts, NAT Rules and Port Forwards has a name that says what it holds, in every language, and Help uses the same name.

• The topology map fits a phone. On a phone or a narrow window the Shapes and Inventory panel no longer takes half the screen: press Shapes and inventory above the map to open it over the map, and find the other map actions under More actions. The map gets the room instead, and nothing scrolls sideways, in any language.

• Spot a sender nobody named. The World Map's Live Feed and the Dashboard's live list have a filter button that shows only the events whose sender has no name, so a device nobody knows stands out. On the World Map the live dots and lines follow the filter; on the Dashboard it changes only the list, not the globe. The Live Feed's title and buttons stay on one line in every language, and in Persian and Arabic the buttons line up with the panel's edge. While the feed is paused, the Paused label sits on its own line below them.

• Give a sender a name. In Syslog Settings, under World Map locations, the table now called Sender names and locations gives a sender a name you recognise, a location, or both. Syslog then shows that name instead of the hostname or IP address its logs carry: in the log list and its details, the top hosts, Syslog Analytics, the World Map and the Dashboard. A dotted underline marks the name: point at it to see what the logs carry, which the log details also show. Filters and searches still use the logged value, and the exports add the name in a column of their own. An entry can now be edited in place. On a phone, the log details show their fields under the message.

• Show an IP address by its hostname in Syslog. In IP Addresses, a record's form has a new box under Hostname: Show this name in Syslog and on the World Map. Tick it, and logs sent from that address show the record's hostname in place of the address, within about 30 seconds. A name given under Sender names and locations in Syslog Settings still comes first. This needs a licence that includes IP Management.

• Monitored devices name their logs. A sender with no name of its own now shows the name of the monitored device it matches, by the device's hostname or IP address, wherever Syslog and the Dashboard show a sender's name. A user limited to some devices sees only those devices' names. A name given under Sender names and locations, or an IP Addresses hostname shown in Syslog, still comes first.

• Help says who can name a sender by its hostname. Anyone who may edit IP Addresses, a Read/Write or Full Access user, can tick Show this name in Syslog and on the World Map. Only a Full Access admin can change Sender names and locations, and a name given there always comes first. The Activity Log records each change to the box or the Hostname.

• The Persian DNS page reads in Persian. Backups, snapshots, restore and zones on the DNS page were partly in English. They now read in Persian, and the help text names the buttons, tabs, columns and tags as they appear on screen.

• Persian writes Cloudflare in Latin letters. The Persian interface spelled Cloudflare three ways: Cloudflare, کلادفلر and کلودفلر. It now writes Cloudflare everywhere: on the DNS page, in Settings, in Help and in Web Analytics.

• Problem reports list only real errors. A form sent with a required field empty was listed among the recent errors in Report a problem as "[object Object]", and enough of those pushed real errors out of the report. A form check that fails is no longer recorded there; the form still shows which fields need a value.

• The AI Assistant button stays out of the way of dialogs. On a phone, the round AI Assistant button could cover the buttons at the bottom of an open dialog, such as Review report in Report a problem. An open dialog or panel now covers the button instead, and the button is back when the dialog closes.

• The Dashboard full-screen view hides the page behind it. In the light theme, in a browser that cannot switch to full screen, such as Safari on an iPhone, the page used to show faintly through the empty parts of the full-screen view. The view is now fully opaque.

• The Dashboard full-screen view reads right to left in Persian and Arabic. The line between the event list and the globe was drawn at the edge of the screen; it now runs between the two. The note on the globe about missing arcs sits in the right-hand corner, and in every language it keeps clear of the far edge of the globe.

• Date pickers fit on a phone. The calendar that opens from a date field was wider than a phone screen, so some days and the OK button were out of reach, and in Persian and Arabic a range could not always be picked. On a narrow screen the calendar's parts now sit one above the other. The calendar takes at most half the screen and scrolls inside itself, so it no longer opens above the top of the page.

• Date ranges fit the screen. In Notification history both dates of the range field were cut off, and on a phone the Syslog viewer's range field ran past the edge of the screen. Both fields now fit their card. Notification history shows both dates in full except on the narrowest phones; on a phone the Syslog viewer still hides the end of each time.

• Arabic day names fit the calendar. In Arabic, the calendar that opens from a date field showed each day's whole name above its column, and the names ran into one another. It now shows one letter a day, as in Persian. In Portuguese, screen readers now name the keys of the calendar's year buttons in Portuguese.

• Smaller API and monitoring worker containers. They no longer carry the test suite or the scripts only the build uses. The Python packages installed in them are unchanged.

• More of the interface speaks your language. In German, Spanish, French, Portuguese, Persian and Arabic, the buttons, labels, messages and Help texts that still showed English are translated, and the Help pages name the controls the way the screen shows them. Product, protocol and file names stay as they are. The plan descriptions on the pricing page are translated too. A page your licence does not include names the feature in your language instead of a code.

• The user menu is always within reach. On a laptop or a tablet the top bar could run past the edge of the screen and hide the user menu. The top bar now fits from 768 px up, in every language. On a screen narrower than 1200 px, phones included, the language choice sits in the user menu.

• Persian and Arabic mirror the menu arrows. The arrows that open and close the sidebar, the AI chat history and the full-screen event list point the way the text reads.

• Build dates read in order in Persian and Arabic. The build date on the About page, in the GeoIP settings and on the Dashboard no longer shows its parts in reverse order, and the Dashboard gives the GeoIP database's age in your language.

• The Dashboard fits the smallest phones. On a 320 px screen the figures at the top of the Dashboard and the AI findings stay inside their boxes, with the Ask AI button on the screen, and the AI summary reads in full lines under its score.

• AtlasEye fits a phone better. Pages use more of a phone's width. The AI chat opens on the conversation, and the list of conversations opens over it with one tap. On NAT Rules, Port Forwards and IP Ranges the Create button is back on the screen. Toolbars, card buttons and settings values wrap or stack under their labels instead of squeezing, cutting their text or running past the edge.

• Card titles and session lists read in full on a laptop. The Backups and Syslog Archive cards on Operations show their whole titles and descriptions, and the browser column of the session lists no longer runs into Last seen. Your Profile shows the sign-in method of each session in your language.

• The AI assistant answers about the page you are on. Asked what a page does, the assistant could describe the Dashboard instead, with its device counts and syslog totals, on a page that shows none of them. It now reads what the open page shows when you send the question: its headings, labels, help texts and buttons. Figures a page hands over, such as the Dashboard counts, go only with questions asked on that page. The AI Chat guide in Help says what the assistant reads.
• DNS backups and token checks in your language. The Source column of DNS Backups (Manual, Automatic, Bulk, Before delete) and the result of the last Cloudflare or GoDaddy token check (Active, Invalid, Expired, Disabled; Valid, Invalid) now show in the language you picked, and their help says what each one means. After you remove the Cloudflare account, the confirmation says "Cloudflare account removed" instead of just "removed". On a narrow screen, a long change in the snapshot diff no longer starts a line with a dot, and the Source words and the "removed" tag of DNS Backups stay whole. Settings → GoDaddy names the environment (Production or OTE / test) instead of showing prod or ote.
• The fullscreen globe on the Dashboard works with the keyboard and screen readers. It opens as a dialog: the focus moves into it, Tab stays inside, and Esc closes it even where the browser shows no real fullscreen; the focus then goes back to the Fullscreen button. The page behind it cannot be reached while it is open, and the AI Assistant button no longer sits on top of it. On a tablet showing the globe without browser fullscreen, turning it upright and back brings the globe back at full size.
• A user limited to some devices no longer sees the names of other devices on the World Map. The host list showed a monitored device's name next to every sender it matched; it now shows it only for devices the user may see.

• The IP geolocation credit no longer takes lines of its own. On pages that show locations, "IP Geolocation by DB-IP" now sits at the end of the footer line, after "Powered by cdnCore". While your own MaxMind GeoLite2 database is in use, "GeoLite2 data by MaxMind" follows on the same line, linked to MaxMind, in place of a long sentence with its web address on a line below. On a phone, the footer text no longer runs under the round AI assistant button.

• Persian and Arabic read right to left as soon as a page opens. After opening or reloading a page in Persian or Arabic, the AI assistant button sat at the bottom right, its panel opened from the right, and the menu, tables, forms and dialogs kept their left-to-right layout until you picked the language again. Now the button sits at the bottom left, its panel opens from the left, the phone menu opens from the right, and every page, the sign-in page and the public status page included, lays out right to left from the start.

• The licence agreement and the privacy policy show only their own text. In English, a note meant for whoever publishes these texts appeared above the licence agreement, the privacy policy and the licence box you accept before activating. It no longer appears.

• The licence, privacy and pricing pages fit a phone, and Persian and Arabic mirror the whole layout. On a phone, the title of these pages no longer breaks inside words: the back link moves under it. A wide table in the privacy policy scrolls inside its box instead of making the page scroll sideways. On the pricing page in Persian or Arabic, the English plan descriptions read in the right order. In Persian and Arabic the back buttons and the menu button point the right way, and the spacing around the header buttons, the language picker, your user name and the footer links mirrors the English layout.

• The date boxes on the Activity Log and Access Events pages show in your language. They read "Start Date" and "End Date" in English whatever language you picked; now they use the words of your language, and the help guide for Access Events names them the same way.

• The filters of the Activity Log and Access Events pages fit a phone. The search box and the date boxes no longer run past the edge of the page, and the Verify Chain button is no longer cut off: the buttons move to a new line when they need the room.

• Arrows in Persian and Arabic point the way the text reads. In many Persian and Arabic hints and help texts, an arrow meaning "then" or "goes to" pointed right, back at the step before; it now points left. Where a hint names English menus in a row, such as Cloudflare → My Profile → API Tokens, they now read in the right order too. The arrows on the pages follow as well: the redirect target and upstream on Service Manager, the time range of a maintenance window, the History panel, Inventory conflicts, the DNS Change watchdog and snapshot diff, the arrow on NAT Rules and Port Forwards, the Quick Insights links on the Dashboard and the "Full guide for this page" link in help tips. An IP range, a field change on the Users page and the Status (24h) line of a device page now always read left to right, start first. On Service Manager, a web address or file path no longer loses its first or last "/" to the other end of the line.

• AI findings in your language. The AI Security Insights card on the Dashboard, the AI insights on Syslog Analytics, the AI analysis panel of the log viewer and the top threats of the weekly report now show the finding type, the trend, the last scan and the finding counts in the language you chose, and lay out right to left in Persian and Arabic. The English text the AI writes keeps reading left to right there, and a scan time keeps its date in one piece. On a phone, the Dashboard findings, the AI insights on Syslog Analytics, the AI analysis panel and the weekly reports fit the screen. Repeat addresses say "1 scan ago" instead of "1 scans ago".

• Port Forwards and NAT Rules in your language. Adding or editing a port forward showed its fields, choices and port range errors in English; they now use the language you picked. In Arabic, the dialog titles, the Name, Type, Protocol, External IP and Internal IP columns and the Deprecated and Planned statuses on Port Forwards, NAT Rules, IP Ranges and IP Management are no longer in English, and in Portuguese the Name label is translated. The Source and Destination column titles of NAT Rules are translated in every language, and so is the status of an IP in a deprecated or planned range on Inventory conflicts. The Help for these pages names their buttons and fields as you see them, in Arabic, Persian, German and Spanish.

• NAT rules and port forwards on a phone. On a narrow screen, the public and internal sides of a NAT rule or port forward now sit one above the other, so IP addresses and ports are no longer cut off.

• Inventory conflicts on any screen. The six counters sit in one even row on a wide screen instead of leaving one alone on a second row, and a long counter name is no longer cut off. On a phone the page title stays on one line with its icon.

• DNS snapshot diff in plain words. Diff vs previous now shows a record's proxy setting as Proxied or DNS only, and a TTL of 1 as Auto, as the records table does, instead of true, false and 1.

• The Dashboard's live event list keeps up with a busy network, and holds still while you read it. New events now enter the list one after another instead of landing all at once (in a large burst, the oldest enter together), and the page redraws only the rows that changed rather than the whole list. When your system asks for reduced motion, new events appear at once. While your mouse pointer or the keyboard focus is on the list, it holds still and a tag such as "3 new" counts the events waiting. It moves again when you leave it, or after 10 seconds without a mouse move or key press, so a mouse left resting on a wall screen cannot freeze it. The Pause button still holds the list until you resume it. The severity chip on each row now shows the syslog level number, from 0 (Emergency, the most serious) to 7 (Debug), in the World Map's colours; hover it for the level's name. The Help centre lists all eight. The source address column is wider, a long IPv6 address keeps its last part in view, and selecting an address to copy it no longer opens the Syslog viewer.

• On a tablet or a narrow window, the Dashboard's globe and live event list fit the page. Below 1100 pixels wide, where the two stack, they ran past the edge of the page and cut off the list's host column, with a grey bar between them. Both now fit, and the bar is gone.

• In Arabic and Persian, the live event list shows the start of a long host or process name. It used to cut off the start and show the end.

• Screen readers hear more of the Dashboard's live event list. A row that AI analysis flagged now says so when it is read out, and the dot beside the Live event stream title explains itself when you reach it with the Tab key, not only under the mouse.

• AtlasEye now comes with the DB-IP Lite IP geolocation database and keeps it up to date by itself. It no longer ships MaxMind GeoLite2, and the separate GeoIP updater is gone. DB-IP Lite (CC BY 4.0) is built into every release: each release carries the newest monthly copy that existed when it was published, or an earlier one if DB-IP could not provide it then. Pages with locations credit it. An install that reaches the internet also fetches each new monthly DB-IP Lite database on its own, so the World Map no longer waits for the next AtlasEye update. Once it has checked for a newer one, the Dashboard shows "Auto-update: DB-IP monthly". With your own free MaxMind key (GEOIPUPDATE_ACCOUNT_ID and GEOIPUPDATE_LICENSE_KEY in .env), AtlasEye downloads GeoLite2 itself and the Dashboard shows "Auto-update: your MaxMind key": it asks MaxMind every 12 hours and downloads only a newer file. GeoLite2 is used while it is at most 30 days old, and the Dashboard tags it "GeoLite2 (your MaxMind licence)". Air-gapped and offline installs download nothing and keep the copy that came with their last update. The GeoLite2 copy that earlier releases installed is no longer used, and the geoipupdate container is no longer needed: the update empties that copy (a copy you replaced yourself is kept) and removes the container. It keeps the container's image, so after going back to the previous version the old updater can start again without a download. Going back to 1.2.349 or 1.2.350 also keeps country lookups working: this version copies its DB-IP database to where those versions look for it. When the updater on your server predates this cleanup, the next update does it, and this one prints a harmless warning that geoipupdate failed to start. On a server that was on 1.2.348 or older before this update, the old atlaseye-geoipupdate container stays until that next update. To remove it now, run docker rm -f atlaseye-geoipupdate. If you set GEOIPUPDATE_PROXY for the old updater, set ATLASEYE_OUTBOUND_PROXY in .env instead: the GeoIP downloads now use it, like every other request AtlasEye sends to the internet. The alert for an old GeoIP database now waits until the DB-IP copy is 60 days old and says what to check.

• Add your free MaxMind account in Settings → System to use GeoLite2; DB-IP Lite refreshes monthly on its own. The new GeoIP database card shows the database in use, its age, where the MaxMind key comes from and the last check. Type your account ID and licence key, press Test key, then Save: AtlasEye uses the key within the hour, with no restart, and never shows it again. A key saved there takes the place of GEOIPUPDATE_ACCOUNT_ID and GEOIPUPDATE_LICENSE_KEY in .env, which stay the fallback. An air-gapped install downloads nothing; the Server runbook in Help & Features shows how to copy a GeoLite2 file in by hand.

• The licence agreement now names the IP-location data AtlasEye includes. Version 1.4 of the licence agreement (EULA) changes only section 3.4, in all seven languages: it says that AtlasEye includes the DB-IP IP to City Lite database (CC BY 4.0), and it names GeoLite2 only as data you download with your own MaxMind account, under your own agreement with MaxMind. The installer bundle carries the new text. A licence that is already activated keeps the version accepted then, and nobody is asked to accept again; the next activation shows version 1.4.

• The IP geolocation credit appears only on pages that show locations. The database credit (IP Geolocation by DB-IP) is no longer under every page. It appears on the pages that show where traffic and sign-ins come from: the Dashboard, the syslog viewer, analytics and World Map, sign-in history and sessions, your active sessions on the Profile page, Web Analytics, the AI chat, and the AI assistant while it is open. The World Map and Dashboard full-screen views keep their credit as before. While your own MaxMind key is in use, MaxMind's GeoLite sentence appears below the DB-IP link, which stays: locations stored before the key came from DB-IP.

• Set the World Map server location in Syslog Settings. A new World Map locations card under Syslog & Security → Syslog Settings sets where the World Map traffic lines and the Dashboard globe arcs end. Enter latitude and longitude in decimal degrees and press Save location: there is no container to recreate. A location saved there wins over the one in the server's .env, and Remove saved location brings the .env location back. A tag says where the location in use comes from: Saved here, From the server's .env, or Not set. Only a Full Access admin can change it, and AtlasEye never looks the location up online. The World Map and the Dashboard show a change the next time they are opened.

• Place individual log sources on the World Map, and see why the globe is empty. The World Map locations card now has a Sender locations table where a Full Access admin gives one sender — an IP address, a CIDR range or a hostname — its own point on the map. Each traffic line and each Dashboard globe arc now ends at the source that sent the log: at its own saved point, else where its public IP is, else the default location. The map shows one pin per place, naming who logged there. When the Dashboard globe has live events but no source has a point yet, a note explains why it shows no arcs and points an admin to Syslog Settings.

• Updates are ready to retire the GeoIP database copy that came with AtlasEye. Nothing changes with this release. Once a later release stops using that copy, an update empties the file, leaving it in place at 0 bytes, but only if it is still the copy AtlasEye installed: a copy you replaced yourself is kept. When that release also drops the weekly GeoIP update (geoipupdate), the update removes its container, and its image if nothing else uses it. Neither step can make an update fail.

• The Dashboard names the IP geolocation database in use, and every page credits it. The System overview shows which database turns addresses into countries, its build date and age, and whether your MaxMind key keeps it up to date or it came with this release. When your own GeoLite2 download is over 30 days old or cannot be read, AtlasEye no longer uses it: the World Map, sign-in locations and Web Analytics use the copy that came with AtlasEye, and the Dashboard says why. The warning about an old database now gives its age. The page footer credits the database in use, with a link to its maker, and so do the World Map and Dashboard full-screen views.

• With "require 2FA" on, an account that has not enrolled can only enrol. When the two-factor policy is Required, or Force 2FA for Admins is on for an admin, the web UI already sent such an account to its 2FA setup, but the server still answered it everywhere else. Now a password or SSO sign-in of an account that has not enrolled reaches only the 2FA enrollment steps, on a page of their own, and every other request from that session is refused with 403 TWO_FACTOR_SETUP_REQUIRED until it enrols; the API documentation, the live syslog view and the SSH terminal stay closed to it too. A session that was already signed in is held from its next token refresh. API tokens keep working: an integration that uses an API token is not affected, but a script that signs in with the username and password of such an account is refused until the account enrols.

• The atlaseye command works right after a new install. A new install now puts it on the PATH. Installs made with 1.2.345 to 1.2.348 did not: the installer showed "could not link the atlaseye command", and sudo atlaseye answers "command not found" there. On such an install, run sudo bash /opt/atlaseye/scripts/atlaseye link once (air-gapped: the same file in the bundle directory the stack runs from). Applying an update does not add the command, so run it once even after updating.

• Alert credentials no longer appear in the monitoring log. Each alert sent to Telegram or to a webhook wrote its full address to the log of the monitoring service, and that address holds the Telegram bot token or the webhook's secret. The log now leaves those lines out. A failed send is still logged. If you have shared that log with anyone, create a new bot token or webhook secret.

• "Security Settings" under Syslog & Security is now called "Syslog Settings". It is the same page at the same address, with the same settings: only the name changed, in all seven languages, so it no longer reads like the Security tab of Settings. The help, the alert messages and the installer's closing notes that send you to this page use the new name.

• The World Map no longer asks an outside service where your server is. When no location was set, AtlasEye asked a free online service where your server is. That service is licensed for non-commercial use only, and every request told it your server's public address. The lookup is gone. The World Map traffic lines and the Dashboard globe arcs now end only at the location set in .env with SYSLOG_SERVER_LAT and SYSLOG_SERVER_LON, in decimal degrees; an empty value counts as not set. Recreate the api container after setting them, because a restart does not read .env again. An install that relied on the automatic estimate shows no traffic lines until the location is set, and the traffic lines button in the World Map toolbar says how to set it.

• The medium size is supported. Load tests in October 2026 confirmed medium: up to 1,000 devices and 1,000 syslog events per second on average, with peaks of 4,000, ran for 24 hours without losing a message. Plan for 4,000 per second at most: a test at 5,000 lost messages. The minimum host for medium is now the size that was tested, 16 vCPU and 32 GB of RAM (it was 8 vCPU and 24 GB), and a new medium install probes up to 40 devices at a time instead of 20. A host below that minimum, new or already installed, can still run medium: the host check, the installer and sudo atlaseye doctor warn about its CPU and memory, the Capacity card on the About page advises adding vCPU or RAM, and sudo atlaseye profile set medium asks you to confirm. Only a host below the floor AtlasEye needs to run at all is refused. When you give the installer no size, such a host now gets small. For such a host, choose small, or give it 16 vCPU and 32 GB of RAM. An existing medium install keeps probing 20 devices at a time after the update: run sudo atlaseye profile set medium to raise it to 40, and sudo atlaseye profile to see what differs.

• An update that stops before it restarts the services now puts the service definitions back. An update installs the release's service definitions (the compose/ folder) shortly before it restarts the services. If the update stopped in between, the services kept running their old version under the new definitions, and the next attempt could keep the new definitions as the ones to go back to. The update now puts the previous definitions back when it stops before the restart. If it cannot, the update log shows the command to run.

• Going back to the previous version from a shell on the host now keeps a copy of the current data, and your current security and retention settings. Right before it restores the backup, the rollback command saves the current database to a file of its own in backups/pre-update/, so what going back discards stays on the host. Each try saves its own copy and nothing deletes them: delete one yourself once you have decided how to go forward (section 6 of INSTALL.md). The command needs more free disk space than before. --no-safety-dump skips the copy when there is no room, after a warning that nothing can then bring back what going back discards. After an update that finished, going back now keeps the stricter value of each sign-in security setting, each retention period at the value that deletes less, and Turnstile, syslog firewall blocking and the status mirror as they are now. Service Manager redirects set to end at a given time no longer end on their own, changes to managed servers stay off until an admin turns them on again, and the audit log records the rollback with the old end times. When it cannot keep these settings, it says so before it asks. It also warns when Service Manager tasks are still pending or running, because going back cuts them off. If going back is cut off, run the same command again: it shows whether the database was restored, and either finishes going back or, when it was not restored, can start the newer version again.

• The monitoring worker can no longer start an update, a prune or a syslog port change. A new secret in .env, UPDATER_MUTATING_SECRET, now guards Apply Update, Prune Now and the Syslog page's port change. Only the API and the updater hold it: the monitoring worker, which reads the rest of .env, gets it empty. New installs generate it. On an installed host, the update to this version still runs the previous update script, so the secret reaches .env at the update after it; an air-gapped update adds it at once. Until then, Apply Update and Prune Now use UPDATER_SHARED_SECRET as before. If you change the secret by hand, recreate the API and the updater together.

• An update job's full details now need Full Access. Opening one update job by its id, with its log, now answers only to an admin with Full Access (GET /api/v1/licensing/updates/job/<id>); other accounts get "403 Forbidden". The log can hold error output from the host's tools. Settings → Updates, the page that shows these details, was already for Full Access admins only. The update status that every signed-in user's browser reads to offer a reload after an update still answers to everyone, without the log unless the account has Full Access.

• With a paid licence, download the offline bundle from the licence portal. With an active paid licence, the Downloads page of the customer portal offers the signed offline bundle of the two newest stable releases, starting with the next one, each with a .sha256 file to check the download. The page shows the commands to check and extract the bundle, and the fingerprint of our release signing key, which the key inside the bundle must match. For high assurance, also compare that fingerprint with the one support sends you over another channel. A download that stops can be resumed from your browser. Trial and demo licences do not include the bundle; support still sends it on request. This comes with an update of the licence portal, not with a release of AtlasEye.

• An account that must change its password can do nothing else until it does. The first sign-in of the installer's admin, or of an account whose password was reset from the host shell, already opened the change-password page, but the server still served that account everywhere else, its API tokens included. Now every other request from it is refused until the password is changed, and live updates, the API documentation and the SSH terminal stay closed to it. If an integration runs with the API token of an account whose password was reset from the host shell, it stops until someone signs in as that account and changes the password.

• The host check reports an old OpenSSL with everything else. On a host with OpenSSL older than version 3, the installer stopped on that one problem before it checked the host, and --check did the same. The installer now checks the whole host first and lists every problem at once, OpenSSL included.

• The install guide runs the host check with sudo. The portal's install guide ran the host check without sudo. When your user is not in the docker group, Docker refused it, and the check failed on a host that was ready. The guide now gives sudo bash atlaseye-preflight.sh, as INSTALL.md does.

• You can now change the port devices send syslog to. On Syslog & Security → Security Settings, the new Listening port card shows the port devices send syslog to, one number for UDP and TCP, and a Full Access admin can change it there. AtlasEye restarts the syslog collector and then the web interface, so the page loses its connection for up to a minute and reconnects on its own. When you move away from port 514, port 514 stays open beside the new port by default, so devices you have not reconfigured yet keep working; a move between two other ports opens 514 only when you ask for it, and the confirmation then says so. While it is open, the card lists the devices that still sent to port 514 in the last 24 hours, so you know when to close it. Allow the new port inbound on the host firewall, UDP and TCP. When a change cannot start, the card says why, for example that an update is running; when a change fails, it says what went wrong and whether the previous settings are back. Help now names the port in use.

• The syslog port can move from the host, and a new install can start on another port. sudo atlaseye syslog-port shows the port devices send syslog to, and sudo atlaseye syslog-port 5140 moves it, UDP and TCP. It takes 514 or a port from 1024 to 65535, since the lower ports belong to the host's own services such as SSH, and it refuses a port that is already in use. If the syslog collector does not come up on the new port, it puts the previous settings back and says so. Moving away from port 514 keeps 514 open beside the new port, so devices you have not reconfigured yet keep working; close it with sudo atlaseye syslog-port 5140 --no-keep-514 once no device sends to it. Updates keep the port. A rollback to a release from before this one puts syslog back on port 514, and says so. For a new install, --syslog-port 5140 gives the installer and the host check the port, for example when the host's own rsyslog keeps 514. Allow the new port, UDP and TCP, in every firewall between your devices and the host before you reconfigure the devices. INSTALL.md section 4, "Changing the syslog port", has the details. The setting is for Docker Compose installs. The offline installer takes --syslog-port with this release; the one-line install takes it once the licence portal is updated, and stops with a message instead of installing on 514 when your channel's release is older than the option.

• The syslog listening port is 514 or a port from 1024 to 65535. The ports below 1024 belong to the host's own services, such as 22 for SSH, so the Listening port card no longer offers to move syslog there and says why. When a port change fails after a long run, the card still names the cause.

• Settings → Updates says when a syslog port change is running. While a change from the Listening port card runs, a note above Apply update says so, and the button is offered again when the change finishes. Before, the port change was listed there as the last update job.

• The country database's 30-day limit now checks when MaxMind built it. The release build used to check when the file was last copied, which could let an older database through. It now reads the build date stored inside the database, so a new install's country database really is at most 30 days old when the release is built.

• Confirm dialogs follow dark mode. In dark mode, confirm dialogs such as Change port and short pop-up messages came up white. They now use the dark theme like the rest of the page.

• The installer no longer shows a misleading cosign warning. A connected install on a host without cosign warned that the downloaded files were only as trustworthy as the download. The installer checks the vendor's signature on the release before it downloads anything, and now says that instead.

• Installs and updates no longer warn that the registry credential is stored unencrypted. docker printed that warning after every successful registry login, although the installer and the updater both remove the credential when they finish. A failed login still shows docker's reason.

• You can now roll back the last update from Settings → Updates. A new card, "Roll back the last update", lets an admin with Full Access go back to the version that ran before the last update. Before you start, it shows what leaves the live system and what is carried over, which settings keep their current value, which security changes are reverted, which redirects and Service Manager tasks are affected, and how long the site is down. When something blocks a rollback for now, such as a backup that is running, the card says what and, where only the server can help, shows the command to run there. When the server cannot offer a rollback, for example on an air-gapped install, the card is not shown; the Help says why. To start, you tick four statements, type the word ROLLBACK and enter your password and, with 2FA on, your authenticator or recovery code. While the site is down, the card shows how far the rollback got and when the site should be back. If the site stays down much longer than expected, it shows the command to run on the server. At the end it shows the result of each check, with what to do about a failed one. After a rollback that succeeded, the page reloads into the older version.

• A new command brings back what going back to the previous version set aside. Right before a rollback restores the older database, it saves the current one to a safety dump in backups/pre-update/ on the host, but the Backups page could not restore that file. Once you have updated again to the version you went back from, or a later one, run this from the install directory: sudo bash scripts/stage_restore_dump.sh pre-rollback-<UTC time>.sql.gz. It checks the dump and copies it into Backups, where you restore it in Administration → Backup & Archive. It never replaces a backup of the same name. While an update, a rollback or a prune runs, it refuses: run it again when that has finished. On an air-gapped install, run it from the bundle directory you ran the rollback from. Section 6 of INSTALL.md, "Going forward again", lists every step. An update now also warns, in its log, when it applies again the version you went back from after that version's update had finished. It still goes on, because updating again is the first step of going forward. The warning starts with the update after the one to this version.

• A syslog port change is now in the audit log even when the updater does not answer in time. The entry used to be written only once the updater confirmed that the change had started. When that answer never came, the port could still change with no entry saying who asked for it. The entry is now written in that case too, without a job id.

• Apply Update now waits for the updater to finish restarting. After an update, the updater restarts itself about 30 seconds later. An update started in those seconds was stopped partway by that restart. Apply Update now asks you to try again in a minute instead, as rollback and the syslog port change already did.

• A slow Docker no longer makes a started update look failed. AtlasEye now waits up to a minute for the updater to answer Apply Update, instead of 10 seconds. The new syslog port change waits as long.

• A syslog port change that is still running shows again after a reload. If you reload Syslog & Security → Security Settings while the listening port is changing, or open the page in another tab, the Listening port card shows the running change with its steps instead of the form, and says how it ended once it is done. A change that finished before the page was opened is not shown again: the card then shows the port in use.

• Resetting a user's password can now make them choose a new one. The Reset Password dialog on the Users page has a new box, "Must change password at next sign-in", ticked each time the dialog opens. With it ticked, the user's next sign-in asks for a new password, and until they change it, their personal access tokens (API keys) get error 403. Untick the box for a service account that signs in with this password or uses such a token.

• The Help now explains how to go back after an update. The Updates section of the Server runbook now starts with the "Roll back the last update" card in Settings → Updates, the Troubleshooting answers name it, and the Feature catalog lists it. Together they say who can use it and until when, what it keeps, what leaves the live system and stays only in a safety copy on the server, and how to get that copy back once you have updated again. A new Troubleshooting answer explains why the card can be missing: on an air-gapped install, while the server's own check refuses (for example, too little disk space), or when there is nothing to undo. The command on the server is still there for when the web interface does not answer, and the Help now says that it keeps less than the card. The Settings → Updates guide used to say that everything written since the update is lost; it now says where that data goes, how long the way back lasts and which updates cannot be undone.

• You can now delete a user for good. On the Users page, a Full Access admin can delete a disabled account: press Delete user on its row, or Delete in its details panel, and type its username to confirm. The account's password, two-factor authentication, sessions, API tokens, device permissions, email, display name and time zone are erased. An SSO-linked account stays bound to its SSO identity, so that person cannot sign in through SSO again. It is renamed deleted- followed by its id, so its username and email can be used again straight away. Its history stays, and so do its AI assistant chats and AI feedback. The Activity Log and Recent Activity on the Dashboard still show Full Access admins the name it had, tagged Deleted. Everywhere else, such as the history of an IP address, it shows as deleted- followed by its id. Activity Log exports gain a user_deleted field, the last column in CSV files. Deleted accounts are hidden until you switch on Show deleted. You cannot delete your own account or the last Full Access admin, and a delete cannot be undone.

• A command approval that gets no answer now says the result is unknown. When you approve a command in the assistant's chat and the server gives no answer, or answers with a server error, the card no longer says that the command was not run, because it may have run. It now shows "Result unknown" and no button to run the command again. Reopen the conversation from AI Agent → Chat: a command that ran shows its result there. If no result shows, check the device before you approve the command again.

• A long first start after an update no longer undoes the update. The first start of a new version prepares the database before AtlasEye answers. With a large chat history, this one-time step can take several minutes, and the update took the wait for a failure and went back to the previous version. The update now waits up to 15 minutes. A normal start is not slower. An update from a shell on the host waits longer only when it takes the release's own files (--refresh-installer-files).

• Correction: taking the release's own files from a shell on the host needs the update script of 1.2.346 or later. The 1.2.346 notes did not say so. An older update script stops with "unknown flag" and changes nothing, and it cannot replace itself. On such a host, do this once: ask support for the signed offline bundle of the release, check it as the air-gapped install guide describes, copy its scripts/update.sh and scripts/lib/ into the install folder, then run sudo bash scripts/update.sh --refresh-installer-files. Section 6 of INSTALL.md gives the commands.

• A rollback that can never finish now says what to do instead. When the backup taken before the update, or the images of the previous version, are gone for good, a rollback can never finish. The rollback now says so and shows the commands that give up going back and update instead, after you restore the database from another backup where it may hold part of the backup. The commands that updates and rollbacks print now also work when the path of the install folder has a space.

• The install guide now says which ports are open, where AtlasEye connects and what not to do. INSTALL.md lists each outside connection AtlasEye makes: when it makes it, which proxy setting it uses and how to turn it off. Its firewall section now also shows how to limit who reaches the web interface, next to the syslog example. Docker opens its ports past ufw and firewalld, so both examples filter in the DOCKER-USER chain. The first-run checklist ends with a Do and don't list. It opens with the three notes the installer prints at the end: back up .env, list your syslog senders and filter the published ports. Help, Getting started, shows the same three notes after the syslog step. The minimum Docker, compose and kernel versions and the port list in the guides are now the ones the installer checks.

• Changing the address users open takes one command, and the host check says how to fix each warning. When the installer finds no usable name or address for the host, or when you move AtlasEye to another name, point the name at the host in DNS and run sudo atlaseye url set https://NAME. It takes the same addresses as the installer's question and refuses anything else without changing anything. It keeps a copy of the previous .env, restarts only the parts of AtlasEye that use the address, and puts the old .env back if AtlasEye does not come back healthy. The self-signed certificate the installer made is remade for the new name. A certificate of your own is kept, and the command tells you when it does not name the new address. Links in notifications use the Public App URL in Settings → General, and the command tells you when that differs. Section 4 of INSTALL.md has the details. Before an offline install, and in scripts/preflight_host.sh --offline, the host check now also looks for the two tools that verify the bundle, cosign and sha256sum, so a missing one shows up with the other problems instead of after them. Every warning of the host check now says what clears it.

• Setup checks: an empty syslog allowlist can be accepted, and a failed scheduled backup now shows. If no device sends syslog yet, the syslog allowlist check no longer stays open: choose Acknowledge on the Setup and security card of the Dashboard, or in the Limit who sends logs step of the guided setup, then add the devices with Edit allowlist when you connect them. Acknowledge never covers a syslog collector that accepts every sender. When a scheduled backup fails, for example for lack of disk space, the Backups check now shows Action needed and the time the failed run started, instead of saying that daily backups are on. It clears when a newer backup exists, from the next scheduled run or from Create Backup on Backup & Archive.

• An air-gapped installation no longer tries to reach the licence server. It still checked for updates online every hour and tested the licence server's address whenever a page showed the system's health. On a network without internet access these attempts failed, and Settings → Updates showed the update check as unreachable. Now nothing is sent: the update check shows that no check has run, and updates are installed from a signed bundle, as the Offline / air-gapped update card describes.

• Installing needs one container image fewer. A new installation no longer downloads, and the offline installation bundle no longer carries, a web server image that AtlasEye never ran. The offline bundle is smaller, and a connected installation has one download fewer. An existing installation keeps the copy it already has. Nothing uses it, so you can free the space with docker image rm nginxinc/nginx-unprivileged:1.27-alpine.

• Third-party images no longer change without a release. AtlasEye runs some images it does not build: PostgreSQL, Redis, OpenSearch, Prometheus and a few more. Until now some of them came as whatever build their publishers had last put under the version AtlasEye asks for. Each release now names the exact build of each one. A connected installation, and each update, downloads those builds before it stops anything and uses them; the offline installation bundle carries the same builds. PostgreSQL and Redis never go back to an older build: if your server already has a newer one, it stays, and the update log says so. If a download fails, the update stops with everything still running the version you had. Check that the server can reach the public image registries, then apply the update again. An installation that updates from a version without this change gets the named builds at its next update.

• The installer checks the release's signature before it downloads anything. The one-line install now checks that the release it is about to install carries AtlasEye's signature, with the same key the in-app update uses, and downloads exactly the installer that the signed release names. If the check fails, it stops and nothing is downloaded. The check needs OpenSSL 3, which Ubuntu 22.04, Debian 12 and RHEL 9 have. On an older system, such as Ubuntu 20.04, Debian 11 or RHEL 8, the installer now stops and says so: use the air-gapped install there.

• The installer downloads exactly the AtlasEye images of the signed release. The one-line install now downloads each AtlasEye image by the exact identity that AtlasEye's signed release names, as the in-app update does, so an image changed on the registry afterwards is never installed. If the release does not name one of them, the installer stops before it downloads any.

• New installs start with a more recent country database. The installer now carries a GeoIP country database that was at most 30 days old when the release was built, down from 90. The Dashboard calls the database stale after 30 days, so the automatic weekly update (geoipupdate) remains the way to keep it current.

• An update that stops early puts the previous version's images back. An update downloads the new version's images first and switches the running services over later. If it stopped in between, for example because a download failed or a safety check refused the update, the previous version kept running, but the new images were already the ones the services would start from. Starting the services again could then run the new version on the old database, and if a second try of the update failed, it could not go back to the previous version. Such an update now makes the previous images the ones to start from again before it ends, and its log says so. An update runs the update steps of the version already installed, so updates from Settings → Updates get this from the update after the one that installs this version. An air-gapped update gets it with this release's bundle.

• The host check now asks for OpenSSL 3 before a connected install. The one-line install needs OpenSSL 3 to check the release signature and stops on an older system, but the host check (atlaseye-preflight.sh, or bash scripts/preflight_host.sh in the install directory) could still say the host was ready. It now fails on OpenSSL 1.1, LibreSSL or no openssl, names the version it found and the package to install, and --ignore-check=openssl cannot accept it, since the installer would stop anyway. With --offline, and on a server where AtlasEye already runs, it does not ask for OpenSSL. The host requirements on the licence portal now list OpenSSL 3 for the online install. The check in the install directory comes with this release; the downloadable host check and the portal's requirements are updated on the licence portal separately.

• The installer's last message is no longer lost. When the installer or the offline update stopped on an error, the line that says why could be missing from its log and from the screen, most often on a busy host. The log now keeps it.

• The licence portal has an install guide. The guide at /portal/install needs no sign-in. It gives the host requirements, the sizing table, the host check and the three install steps, and the welcome and trial e-mails now give the same steps. When a release's installer image is not available yet, for example while it is being published, the installer now stops before it changes anything and says to run the same command again in a few minutes. These changes are on the licence portal and need no update.

• Going back after an update says exactly what it did, and release notes read more clearly. When an earlier rollback was cut off while it restored the database, the next run now first warns that the database may hold all, part or none of the backup, even when it then stops with an error, and if the backup file is gone it tells you to restore the database from another backup. After a cut-off restore, if stopping the services fails, the next run now names the services that may still run on that database and shows the command that stops them. A rollback now says the database was not changed only when that is certain, and says the errors came from the database only when they did. The rollback after a failed update, the automatic one or the one an air-gapped update tells you to run, does the same: when it cannot tell whether it restored the database, it now says so and shows the command that goes back by hand. In Settings → Updates, a release whose notes were withdrawn after publishing shows no text instead of its old notes, and headings inside a release's notes show smaller than the release's own version heading.

• Alert mails say what is most likely wrong, where to see it and how to fix it. Each alert mail lists the likely causes, the most likely first. Where AtlasEye shows the problem, the first step names that page and the link in the mail opens it. The next step is the fix: in AtlasEye where it can be done there, otherwise a command, with the install folder to run it in (/opt/atlaseye). A log command comes only last, for when the alert still fires, with its output to send to support. Slow-request mails now say whether the whole API is slow or one endpoint, what that endpoint waits on (for example the AI provider, the licence server, a device, Prometheus, a notification channel, the identity provider or OpenSearch) and how many requests it served; when the endpoint served only a few requests, the mail says that a few slow ones are enough to fire it. When the other endpoints answer in time and the slow one waits on nothing outside AtlasEye, the mail names that endpoint's own work first, most often a database query. For an endpoint that waits on the licence server, the mail points to the tag beside Last Heartbeat in Settings → Licensing: where it reads "unreachable", it says to allow HTTPS to the licence server through the firewall or proxy; where it reads "airgap" (an air-gapped install), it says to leave the firewall as it is. A slow health check on an air-gapped install is expected and does no harm: the health check still waits for the licence server, which never answers there. A slow heartbeat on an air-gapped install is this server's own work, because the heartbeat never contacts the licence server there; the mail says so and points to Host and Database in System Health. A failing task that only PostgreSQL can stop points to PostgreSQL and the data disk: the clean-ups of old incidents, alerts, notification log entries, DNS snapshots and sign-in events, the status page uptime sample, and the checks that carry on when a host, site or search they reach fails (certificate expiry, service rediscovery, configuration snapshots, temporary redirects, Web Analytics traffic alerts and syslog threat alerts). The other clean-ups, the scheduled reports, the syslog alert rules and the container log check catch their own errors, so their mail names an error in AtlasEye. The Web Analytics retention mail points to each site's Retention (days) in Manage sites.

• Going back after an update restores the database whole or not at all, and never runs while an update from the same directory runs. A rollback now puts the database backup back in one step: when it is cut off, the database stays as the update left it instead of holding part of the backup. Before anything changes, a rollback refuses a backup that holds something a normal backup never contains, or one cut off before its end. Run by hand, it also checks that the disk has room to unpack the backup, and it stops every AtlasEye service except the database while it runs (on an install that updates online, the updater keeps running); a service the previous version did not have stays stopped, and the rollback names it with the commands that remove it or start it again. An update, a rollback or Prune Now started while another of them runs from the same directory refuses to start. On an air-gapped install each bundle directory counts on its own, and Prune Now can still start while an update runs, so do not start it then. An update also refuses while a rollback from the same directory has not finished, and shows the command that finishes it; on an air-gapped install, finish a rollback before you run the update of another bundle. Before the rollback puts back the previous version's compose files, it keeps a copy of the newer ones and names the ones changed since the update; if it cannot make that copy, it says so and leaves the newer files in place, and the previous version starts with them. When the automatic rollback after a failed update does not finish, the update shows the full command that finishes it; a rollback you run by hand says what to do next. A rollback you run by hand after an update that never finished now also asks you to type ROLLBACK first, and says that the update never finished. After an air-gapped update has rolled itself back, a rollback run by hand no longer restores the backup a second time: there is nothing left to go back to.

• The AI assistant asks before it runs a command, and is clearer about what it sends and why it cannot answer. When a command on a device would help, the assistant now proposes it on a card in the chat that shows the host, user and exact command; it runs only after a Full Access admin approves it, once, and an unanswered card expires after 10 minutes. The chat masks text that looks like a password or key in your messages and chat titles, also in conversations saved before this update: the update rewrites saved chats and their titles for good. Masking matches patterns: it can miss a password, so do not type passwords into the chat, and it can also hide ordinary text that looks like a password. The assistant asks for an SSH password only on the card, when the device has no stored login; that password is used for that one login and is never saved or shown to the AI model. Each role sees only the assistant actions its permissions allow. The daily briefing, Auto-correlate and rule-based predictions are now labelled as fixed rules rather than AI, and Auto-correlate shows the groups before it creates any incident. When the assistant cannot answer, it says why: AI not set up or turned off, a rejected key, a timeout, a rate limit, a network problem or the daily spending limit. Calls on a paid model without a price show "price unknown" instead of $0, and the AI chat no longer carries a vendor name.

• The syslog rate-limit alert behaves the same for every window length. The alert "Syslog senders are over the per-sender limit" now counts the messages over the limit, in Enforce and Monitor mode. Its mail is now titled "Over the per-sender limit: syslog messages", followed by how many messages went over the limit in the last 5 minutes. It fires when messages have gone over the limit at least once in every 5 minutes for 15 minutes, so a flood shorter than about 10 minutes raises no alert. Before, its timing depended on the window you set: with a one-hour window a single short burst could raise it up to 75 minutes later, and with a window under 10 seconds a burst could go unseen. A sender is named only once its window has ended, so the mail and the list "Senders over the limit (last hour)" can name no sender while the alert is active, and with a long window the mail can name a sender of an earlier window. "Now" in that list means the sender went over the limit in the last completed window, which with a long window can have ended up to an hour ago. If Apply Update warned that it left the alert rules file as it is because it was edited on your server, take this release's copy with the command in that warning. If that warning said this release's copy could not be parked beside it, there is no command in it: the next update tries to park its own copy there again, and when it can, its warning gives the command. If the same warning comes back, check the free disk space and that the folder of that file belongs to root, as after a standard install. Until then this alert keeps its old rule, and the number in its mail counts senders, not messages. If Apply Update said it left that file as it is for another reason, or that it could not fetch this release's installer files (see the next item), the next update tries again. Keep Prometheus running, because the update checks the new file in Prometheus first. If it reported an error that it could not put the file back, run the command in that error first. Until then, too, the number in the mail can count senders.

• An update that cannot fetch its installer files says all it leaves alone. If the Apply Update log says "atlaseye-dist pull failed", or that the signed manifest "pins no atlaseye-dist digest", the update could not fetch the release's installer files. It then leaves the compose files and the monitoring configuration as they are too, not only the host scripts it names, and the next update tries again. From the update after this one, that message names all three.

• The free-space checks of an update and of the installer say GiB. Before it downloads the new version, an update checks the free disk space on the server and writes the result to the update log, or to your terminal when you run scripts/update.sh yourself. The air-gapped update (scripts/update_airgap.sh) checks the same limit, added to the size of the images it loads, before it loads them. Both gave the sizes in GB, but they are GiB, the unit the Apply Update dialog uses for the same limit. Both now say GiB. The installer counts the free space on Docker's disk in GiB too: its disk check now gives that space, the 30 GiB minimum and the size below which it warns in GiB, and so does the "Hard floors" note under the sizing table in the documentation and on the portal's downloads page. The note also says that these checks read the disk sizes of the table as GiB, and atlaseye status and atlaseye profile show give the free space in GiB too.

• An update from a shell on the host can take the release's own scripts. sudo bash scripts/update.sh --refresh-installer-files takes this release's scripts, compose files and monitoring configuration, as Apply Update does. This keeps them current on a host where Apply Update is not supported, such as one with Docker userns-remap. Without the flag, a run from a shell on the host leaves them as they are and now says so, instead of downloading them for nothing. In a git checkout the flag is refused, because git owns those files there.

• An update from a shell on the host checks the right addresses. The checks at the end of an update asked addresses that exist only inside the updater, so from a shell on the host an update that had gone fine rolled itself back unless four settings were set by hand. The update now checks this host's own ports, and so does scripts/rollback.sh. The four settings still override them.

• A failed update rolls back while the new version runs. When an update failed after the new version had started, the automatic rollback could not restore the database while that version still used it, and gave up with the database unchanged. It now stops the new version first, as a rollback by hand already did, and starts it again if the database cannot be restored.

• The host check lists every problem at once. Run bash scripts/preflight_host.sh before you install: it now runs every check and lists each problem with its fix in one report, so a single run tells you everything to change. It changes nothing on the host. Before, run with sudo, it also raised vm.max_map_count and net.core.rmem_max; now it reports a low value with the commands that raise it and keep it after a reboot, and the installer raises it during the install, as before. When vm.max_map_count is already high enough, the installer now also saves it in /etc/sysctl.d/99-atlaseye.conf, so that it survives a reboot; it never lowers a value already saved there. If you accept a failed check, for example less RAM than the hard floor on a test host, run the check with --ignore-check=ram: that check is listed as ignored and counts as a warning. The os, arch, curl, docker and compose checks cannot be ignored. The check exits 0 when the host is ready (with or without warnings), 1 when it is not, and 2 on a wrong option. On a host that already runs AtlasEye, running this check with sudo no longer raises net.core.rmem_max: if it reports that value as low, run sudo sysctl -w net.core.rmem_max=8388608, add the line net.core.rmem_max=8388608 to /etc/sysctl.d/99-atlaseye.conf, then run sudo docker restart atlaseye-syslog.

• Check a host before you buy. The host check is now one file that anyone can download, with no login and no licence. On the host you plan to use, run curl -fsSLO https://license.atlaseye.eu/portal/static/atlaseye-preflight.sh and then sudo bash atlaseye-preflight.sh. It changes nothing on the host, and the downloads page shows it as its first step. To check the host against the size you need, add --profile with lab, small, medium or large, or --devices with your number of devices (and --eps with the average syslog messages per second you expect). Add --offline on a host without internet access, and --proxy http://HOST:PORT when the host reaches the internet through a proxy. Section 2 of INSTALL.md lists every requirement it checks, with the ports and the proxy setup.

• The host check finds more, and the installer stops on more. The check now also looks at the kernel version, how Docker is installed, Docker's storage driver, data directory and cgroup version, SELinux, the disk type, the clock and its NTP synchronisation, an active ufw or firewalld (the ports Docker publishes pass by them), and every port AtlasEye uses. Each problem is listed with the commands that fix it. The installer now stops on each of these, where before it went on:

• Port 514/udp or 514/tcp in use (this was a warning). If the host's own rsyslog holds it, keep rsyslog and comment out its network input lines (imudp and imtcp, in /etc/rsyslog.conf or /etc/rsyslog.d/), then run sudo systemctl restart rsyslog.
• One of the internal ports 5432, 6379, 8000, 9200, 5601, 8081, 9100 or 9090 in use on 127.0.0.1. Stop the program that holds it, or move it to another port; run the check with sudo to see which program it is.
• Podman (also behind the podman-docker package), rootless Docker or the Snap package of Docker. AtlasEye needs Docker Engine run by the system daemon; the check prints the commands that install it on your distribution.
• Docker Engine older than 24. The check prints the commands that upgrade it.
• SELinux enforcing while Docker's own SELinux mode is on. Turn off Docker's SELinux mode as the check shows (SELinux itself stays enforcing), then run sudo systemctl restart docker.
• A Docker Compose version the check cannot read. Before, this was a warning and the 2.23 minimum went unchecked. Install the Compose plugin 2.23 or later.

A port that a running AtlasEye container holds passes, so the check also runs on a host that already runs AtlasEye. To go ahead in spite of one of these, run the installer or the check with --ignore-check=ports, --ignore-check=docker-variant, --ignore-check=docker-engine or --ignore-check=selinux; the Docker Compose check cannot be ignored. Without --offline, the check also fails when the licence portal or an image registry cannot be reached over HTTPS, when the clock is more than 300 seconds off, or when the check goes through a proxy that Docker does not use. - Offline updates check before they change anything, and keep a log. Before it touches your installation, scripts/update_airgap.sh now checks Docker, Docker Compose 2.23 or later and curl, and then the free space on the disk that holds Docker's data: it needs the size of the update images plus a margin. Before, it asked for a fixed amount in all, however large the images were. UPDATE_MIN_FREE_GB in .env now sets that margin, in whole GB; the sizing table in INSTALL.md gives the default. For Apply Update the same setting is still the whole free space it needs, because Apply Update cannot know the size of what it downloads. UPDATE_DISK_MOUNT still moves Apply Update's check to another mount point; an offline update no longer uses it, because it loads the images onto Docker's disk, and it warns when the setting is there. Everything the update prints also goes to a log under /var/log/atlaseye. When it stops, it says at which of its 12 stages, whether your running version changed, and where the log is. - Offline updates check the whole system and roll back on their own. After it recreates the services, an offline update now waits for the gateway, the application behind it and every container, as the installer does. Before, it waited only for the gateway, which answers even when the application does not. When the gateway or the application never answers, for example after a failed database migration, or the software integrity check fails, it puts the previous version back by itself, database included, and saves the failed version's logs in the update log, with passwords and tokens masked. The message says whether the rollback finished. It does not roll back when you set AIRGAP_NO_AUTO_ROLLBACK=1 to keep the new version for diagnosis, or when the snapshot comes from an earlier run of the same update: restoring that one would also delete everything written since, so the message gives its age and the command instead. When the new version answers but a container is not healthy, or Docker Compose reported errors, the update stays in place and exits with code 2; running it again is safe. After an automatic rollback, do not run scripts/rollback.sh: it would restore the snapshot again, and anything written since would be lost. - AtlasEye can reach the internet through a proxy. If your server reaches the internet only through a proxy, set ATLASEYE_OUTBOUND_PROXY in .env to http://host:port (https:// for a proxy that speaks TLS) or http://user:password@host:port. In the user name and password, percent-encode every character other than a letter, a digit or - . _ ~ (@ is %40). Licence activation and checks, Check now, the hourly update check and Apply Update then reach the licence server through it, and so do Telegram, Turnstile, Cloudflare DNS and GoDaddy. Your devices, Prometheus, OpenSearch, Proxmox, single sign-on, webhooks and AI providers stay direct. The weekly GeoIP download has two settings of its own, GEOIPUPDATE_PROXY (host:port) and GEOIPUPDATE_PROXY_USER_PASSWORD (user:password), described in "Updates behind a proxy", section 6 of INSTALL.md. Docker downloads the update images itself and needs its own proxy: see "Behind a proxy" in section 2 of INSTALL.md. A value that is not a proxy URL keeps the application and the monitoring worker from starting, and stops Apply Update before it changes anything; the message never shows the value, which can hold a password. When the licence server cannot be reached, the licence banner now points to this setting. - What to do after this update. Nothing, unless your server reaches the internet only through a proxy. Then set ATLASEYE_OUTBOUND_PROXY in .env and recreate the application and the monitoring worker with the command in "Updates behind a proxy", section 6 of INSTALL.md: a restart does not read .env again. Apply Update reads it on every run. For the weekly GeoIP download, set GEOIPUPDATE_PROXY too; the same section has the command that applies it. - Going back after an update stops safely when it cannot tell whether the database was restored, and the senders list says when it cannot name the senders. If the database restore of a rollback ends without showing whether it went through, for example after a lost connection, the rollback now leaves the services stopped and tells you to run it again, instead of starting them on a database that may hold only part of the backup. Running it again restores the whole backup. It also stops before it changes anything when it cannot read which services are running. In Syslog settings, "Senders over the limit (last hour)" now says the list is not available when the syslog collector counts senders over the limit but cannot name them, instead of showing that no sender went over the limit. - Settings → Updates shows the notes of every release an update brings. When an update skips releases, the release notes now list each release under its own version heading, newest first, below a line that says how many releases the update brings. Before, only the newest release's notes showed and the others were under All releases. The list starts with the first update published after this release; for anything it does not cover, All releases still has the full history. - Alert mails no longer slow down the alert receiver. Alerts from the monitoring stack are now accepted at once and mailed right after, so a slow mail server no longer makes the receiver look slow and no longer raises false "slow /webhook" warnings. Slow-request alerts name the full address of the slow request again, and problem reports name the address of each failed request again instead of "[unmatched]". - Container log limits, and a horizon for the sign-in history. Settings → System → Container log limits sets the size of one log file and the number of log files kept for every container AtlasEye runs, 50 MB and 3 files unless you change them. The containers of the AtlasEye host take new limits at the next update you apply from AtlasEye. cAdvisor and the exporters that AtlasEye installs on a monitored host take them when AtlasEye installs or sets them up again; the manual cAdvisor command on the Containers tab carries them too. The card lists each container of the AtlasEye host with its log settings, and two new alerts warn when one of them writes its log without a size limit, or when AtlasEye can no longer check. History Retention has a new row, Sign-in history: kept 730 days unless you change it, and sign-ins that still count toward an account lockout are never deleted. - HTTPS with Docker user namespace remapping: a key that another user owns is fixed too. With remapping, a private key that a user other than root owns and only that user can read was left as it was, with a warning, even when that user was not the web server's user, and then HTTPS did not come up. One such key is a key given to user 101, which the guides used to say for every server. When /etc/subuid and /etc/subgid both have a line for dockremap, Docker's default remapping user, installing and updating, online or air-gapped (scripts/update.sh or scripts/update_airgap.sh), now leave such a key as it is only when the web server's user owns it. Any other key is changed from inside a container; when that container cannot change it, a warning gives the commands, with the owner the key needs. Without those lines the key stays as it is, with the warning, as before. The installation guide, the admin guide, the air-gap guide, .env.example and the HTTPS steps of the Help now send servers with remapping to the owner the key needs. - Backups that retention cannot delete are reported. When backup retention cannot delete an old scheduled backup, for example because of its file permissions, the log of the monitoring worker, which runs the retention (docker logs atlaseye-monitoring-worker), now names the backup and the kind of error, and the entry of that retention run in the audit log lists it as failed. Before, the backup stayed on the disk without a word. Retention tries it again at its next run. - The disk space warning shows the right unit. The banner that warns when the server's disk fills up gave its sizes in GB, but they are GiB (1 GiB is 1024 × 1024 × 1024 bytes, about 7% more than 1 GB). It now says GiB in every language. The dialogs that refuse Apply Update, when the disk is 95% full or more or when it has less free space than an update needs, give the sizes in GiB too.

• The installer checks the host before it uses your licence. The connected installer now checks the host first, against the size you choose. When the host is not ready, it stops before it uses your licence key or downloads anything: fix what the report lists, then run the same command again. To check a host without installing, run bash atlaseye-install.sh --check. It needs no licence key and changes nothing on the host.

• One run of the installer asks every question first. The installer asks all its questions before the long steps start: the size of the install, your licence key (connected install only) and the address users will open. After the last answer it finishes on its own. For an unattended install, give the answers as options or environment variables instead, as INSTALL.md section 3 describes.

• A failed install can be run again with the same command. When an install stops part-way, run the same command again: it picks up where it stopped and keeps what the first run set up, the generated passwords included. Run the installer inside tmux or screen, so that a dropped SSH session does not stop it.

• Every install writes a log. Each run of the installer writes /var/log/atlaseye/install-<date and time>.log, readable by root only, and prints its path at the start and at the end. Attach it when you contact support. The admin password is never written to the log: it is shown on the terminal only. An install run without a terminal writes it to the file INITIAL_ADMIN_PASSWORD in the install directory instead, readable by root only. Delete that file after your first sign-in.

• The installer asks for the address users will open. A new install asks for its address, such as https://atlaseye.example.com (Enter takes this host's name), or takes it from --url. AtlasEye uses it as its Public App URL, the address in the links it sends, and names it in the self-signed certificate it creates. An unattended install without --url takes this host's name and warns. To change the address later, see "Changing the address" in INSTALL.md section 4.

• A new install is sized for your network. The installer asks how many devices you will monitor and how many syslog events per second they send on average (Enter estimates the rate from the device count), or takes --profile. It then sets the database, search and metrics settings of the profile that covers both, from the sizing table in INSTALL.md, and checks the host against that profile. Enter at the first question picks the largest profile this host can run. An existing install keeps its settings; to change the size later, run sudo atlaseye profile set <profile>.

• Factory reset asks for the new admin's password. System Reset (Factory Defaults) now asks for a temporary password for the admin account it creates again, and checks it against your password policy before anything is deleted. The admin changes it at the first sign-in. Before, the new admin got the password from the installation's .env file, which stays in that file and in every backup.

• Air-gapped hosts: the container log limits are checked first. An air-gapped host does not get Settings → System → Container log limits: you set ATLASEYE_LOG_MAX_SIZE_MB and ATLASEYE_LOG_MAX_FILES in .env by hand. update_airgap.sh now checks them before it loads the new images, and install_airgap.sh before it starts the first container. A value out of range stops the command with the line to fix, instead of failing half way through the update.

• Air-gapped hosts: going back asks first whenever the new version stayed. The rollback.sh command an air-gapped update prints when it leaves the new version running (after a success, after a warning about a container that is not healthy, or after a failure it did not roll back) now asks you to type ROLLBACK first, stops the newer services before it restores the database, and cannot run a second time once it has gone back. Before, outside a clean success, it went back without asking and without stopping the newer services first.

• The installer sets up your proxy. When your server reaches the internet only through a proxy, give it to the installer with --proxy http://host:port, or in ATLASEYE_PROXY as section 3 of INSTALL.md describes. The installer downloads through it and, on a new install, writes it to .env as ATLASEYE_OUTBOUND_PROXY, so AtlasEye uses it from the first start. A value AtlasEye would not accept stops the installer before it downloads anything. An existing install keeps its .env: to change the proxy there, see "Updates behind a proxy", section 6 of INSTALL.md. Docker still needs its own proxy setting: see "Behind a proxy" in section 2 of INSTALL.md.

• New atlaseye command on the host. Jobs that took a long docker compose command or a hand edit now take one command, run with sudo from any directory. sudo atlaseye status checks the containers, the health checks, the certificate and the disk. sudo atlaseye doctor also checks the host and the required settings in .env, and names the next command for each problem it finds. sudo atlaseye logs api shows the log of one service with secrets masked. sudo atlaseye support-bundle writes one file for a support ticket to /var/log/atlaseye, with secrets masked. It never leaves the host by itself: you decide whether to send it. A password in .env shorter than 6 characters is too short to mask: sudo atlaseye doctor names each one, so change it, or check the bundle for it before you send it. sudo atlaseye cert install --cert FILE --key FILE checks your own certificate, installs it and puts the previous one back if the gateway does not serve the new one; cert self-signed renews the generated certificate and cert show shows the installed one. sudo atlaseye profile shows the sizing profile in use, and sudo atlaseye profile set medium resizes the install to another profile: it checks the host first and lists what restarts and what can be deleted before it changes anything. sudo atlaseye reset-admin status shows the state of the admin accounts, and reset-admin unlock or reset-admin reset lets an admin back in when nobody can sign in. sudo atlaseye recovery-kit saves .env and the certificate in one encrypted file to keep off the host. sudo atlaseye compose ps, or any other compose command, runs against the files of your install from any directory. compose config prints every value in .env, passwords included: keep its output to yourself. sudo atlaseye uninstall --keep-data stops AtlasEye and keeps its data, for a move to a new host; sudo atlaseye uninstall --purge deletes AtlasEye with all its data, backups stored on the host included, after you type PURGE. INSTALL.md §5, §7, §8 and §10 show each command in use. On an install you update in the app, run this once, with your install directory in place of /opt/atlaseye: sudo bash /opt/atlaseye/scripts/atlaseye link. It puts the atlaseye command on the path. Run the same command whenever the shell answers atlaseye: command not found.

• A setting the server refuses at startup is no longer repeated in its log. When the server refused a password or key in .env because it was too short or still the example value, its error message showed the value itself. It now names only the setting and the reason.

• HTTPS with Docker user namespace remapping: the key is given to the web server's user when a container cannot do it. On a server with remapping, a container cannot change a private key that root owns, such as one that root has just written, so installing or updating ended with a warning and the web server could not read the key. When /etc/subuid and /etc/subgid have lines for dockremap, Docker's default remapping user, installing and updating now give the key to the web server's user from the host and print the owner they gave it, and so do sudo atlaseye cert install and cert self-signed. With another remapping user, section 5 of INSTALL.md shows how to put the certificate in place by hand.

• Security update for a bundled library. AtlasEye now ships multidict 6.9.1, a library its Python services use to hold HTTP headers. It fixes a published security advisory about a memory leak. Nothing changes in how AtlasEye works.

• The alert mail and Syslog settings now name the senders over the per-sender limit. When senders go over the ingestion rate limit, the alert mail now lists their addresses, up to 10. Syslog & Security → Security Settings → Ingestion Rate Limit has a new list, "Senders over the limit (last hour)": each sender, the most messages it sent over the limit in one window, the name of its allowlist entry and whether it is over the limit right now. The list refreshes every minute, so you no longer need the collector log to find a noisy sender. When many senders go over the limit at once, which often means forged source addresses, the list names 20 and counts the rest on one line.

• A browser that saw a redirect loop during an outage now recovers by itself. During such a loop a browser can store the redirect and keep using it after the server is fixed. Parts of the app then kept failing in that browser until its cache was cleared, for example showing "No license activated" on a licensed installation. When a request fails that way, the app now sends it once more past the browser's cache, which also replaces the stored redirect, so the browser recovers on the next request without anyone clearing its cache.

• Changes are no longer refused as read-only right after a licence is activated. Right after a licence was activated, for example on a new install, some changes such as adding a device could be refused for minutes with a "License required" message, although Settings → Licensing already showed the licence as active. Scripts that call the API got "unlicensed: read-only mode — activate a license to make changes". Changes are now accepted within a second of the activation.

• Old syslog can now be archived automatically every night. Until now the Archive retention action kept every day of syslog in search, so the log store grew until the disk was full and new logs stopped. In Syslog & Security → Security Settings, Retention Policy, with Auto-lifecycle on, set the action to Archive and switch on Archive automatically. Once a day from 03:30 UTC, each day of logs older than the retention days is written to an archive file, the file is read back and counted, and only then is that day deleted from search; up to 10 days a night, oldest first. Before it saves, the card shows what is due now (the number of days, their size, the free space for the files and the nights it needs) and asks you to confirm. Delete archive files after (days) deletes the automatic files once their logs are that old, for the storage limitation of GDPR, in every mode, also with Archive automatically off; 0 keeps them. Setting or shortening it first shows how many files it deletes and their size, and asks you to confirm. The files are listed in Administration → Backup & Archive with Source Automatic and their size. They are the only copy of those logs and they stay on this host, so download them there, or copy them off the host with docker cp atlaseye-api:/app/backups/. <dir> as you do with your backups. When the disk lacks space for the next file, the run stops there, keeps that day in search and says so on the card, and an alert warns when archiving has not finished cleanly for two days. Nothing changes until you switch it on: a new install still deletes logs after 30 days, and an update keeps your current setting. Archive + Delete is no longer offered; a policy saved with it keeps deleting as before.

• An archived day can go back into search. In Administration → Backup & Archive, Restore to search loads an archive file, automatic or one you made, into its own copy that Log Explorer searches with the rest, and the row shows Restore running while it loads, then In search. Remove from search deletes the copy and keeps the file. Retention and archiving never delete a restored copy; Manual Purge deletes matching logs from it too. Until now a restore needed an outside tool.

• Behind a proxy or CDN that handles HTTPS, the site no longer loops. While HTTPS is on, plain http to port 80 is sent on to https. A proxy that handles HTTPS itself and talks plain http to this server had its own traffic sent back to https, so every page loaded in an endless loop. Such a request now goes through when it says it came over https: an X-Forwarded-Proto: https header, which most proxies and load balancers send, Cloudflare's CF-Visitor, or Forwarded: proto=https. GATEWAY_HTTP_REDIRECT=false is now needed only behind a proxy that sends none of these. If the update warns that your compose files do not pass that setting to the gateway, set TLS_ENABLED=false instead.

• The redirect to https is now temporary (307) instead of permanent (308). A browser keeps a permanent redirect for good, so a wrong one could not be taken back from the server. If your users already saw the loop, each of them clears the browser's data for the site once.

• Apply Update now checks the sign-in page the way visitors reach it. It checked only the application behind the gateway, so an update could report success while visitors got nothing but redirects. It now opens the sign-in page through the gateway, over http the way a proxy does and over https when HTTPS worked before the update. If the page answered before the update and no longer does, the update is rolled back; if it did not answer before either, the update reports a warning, because a rollback cannot mend that. The air-gapped update does not have this check yet. When BASE_URL in .env is a public address, the update also opens it before and after: a redirect loop that came with the update rolls it back, and any other problem with that address is reported as a warning, because it can fail for reasons outside this server.

• You can go back after an update that succeeded. Until now an update applied with Apply update left no way back once it finished, even when the site turned out broken afterwards. Now the last lines of the update log name a command that goes back to the previous version; run it on the host: cd /opt/atlaseye && sudo bash scripts/rollback.sh. It restores the database backup taken when the update started, so everything written to AtlasEye since then is lost: settings, devices, users, alerts, incidents and their history. Before it changes anything it shows when the update finished, the version it goes back to and how old the backup is, and asks you to type ROLLBACK; anything else cancels. While it goes back the site is down: it stops the newer version right before it restores the database, and the site answers again once the previous version has started. If it fails after the database was restored, it says so and what running it again does: normally that only puts the previous version back, without restoring the database a second time. It works once, and only until the next update starts. Keeping it costs disk space: one set of the previous version's images stays on the host until the next update that succeeds. INSTALL.md section 6 shows how to see that set, and how to give up the way back to free the space. The update to this version cannot itself be undone this way; every update after it can. An update run with SKIP_BACKUP=1 leaves no way back, and neither does an update applied with Apply update that failed and put itself back. On an air-gapped install, going back after a successful update now asks the same question first.

• A burst of UDP syslog is no longer lost without a trace. The host's kernel could drop a burst of UDP syslog before AtlasEye read it, and nothing in the product showed that it happened. The syslog collector now asks the kernel for a larger receive buffer, the installer raises the host limit that caps it (net.core.rmem_max), and a new metric, syslog_udp_rcvbuf_errors, counts any drop that is left. To read it on the host, run curl -s 'http://127.0.0.1:9090/api/v1/query?query=syslog_udp_rcvbuf_errors'. A new install sets this up for you. On an existing install, run sudo bash scripts/preflight_host.sh once in the install directory, then docker restart atlaseye-syslog. If the preflight stops on another check before this one, raise the limit by hand: run sudo sysctl -w net.core.rmem_max=8388608, add the line net.core.rmem_max=8388608 to /etc/sysctl.d/99-atlaseye.conf, then run docker restart atlaseye-syslog.

• A new install opens a guided setup page after the first sign-in. Seven steps take you through what a new install needs first: activate the licence, name the install, add a notification channel, protect admin sign-in, turn on backups, add the first device and limit who may send logs. Each step shows what is already in place and opens the page where the rest is done, and you can skip any step and come back to it later. The page opens by itself only for an admin with Full Access, and only on an install that has no device yet, so an install that is already in use is not interrupted. Once someone chooses "Don't open this page automatically", it never opens by itself again. You can always find it under Help & Features → Getting started, which now also shows a Full Access admin which of its steps are done. On this page and in Settings → General, the time zone list now offers UTC at the top.

• Full admins see the setup and security work that is still open. After this update, full admins see a "Setup and security" card at the top of the Dashboard. It lists the same checks as the setup page: what is still open, why it matters and the button that fixes it. When everything passes, the card shrinks to one line. While items are open, you can fold it. The other pages show a banner for four problems only: an expired gateway certificate, a certificate that expires within 14 days, a syslog collector that accepts every sender, and alerts that have no active notification channel to go to. Only one banner shows at a time, only once a licence is active, and closing it hides it in that browser tab until you close the tab. When no notification channel is active, a device page no longer says "Using all active channels": it says that the alerts of that device reach no one. On an install that is already in use, nothing opens by itself. Help center → Guides by page → Setup and security status explains every check.

• A new install accepts syslog only from the senders you list. Until now an empty sender allowlist let every device that could reach port 514 write into your logs. A new install now drops every syslog message until you add the first sender at Syslog & Security → Security Settings → IP / CIDR Allowlist, and that page says so while the list is empty. The summary at the end of the install names the same page.
• An install that accepted syslog from every sender keeps doing so after this update, and now tells you. No device stops logging when you update. An install that already lists its senders, or was set to accept only listed senders, works as before. If you set that with SYSLOG_ALLOWLIST_MODE=strict or ATLASEYE_ENV=production only in the shell that runs docker compose and not in .env, add SYSLOG_ALLOWLIST_MODE=strict to .env before you update: the update reads only .env to tell whether your collector accepted only listed senders. Where every sender is accepted, the allowlist card now warns about it and offers Add senders seen recently: it shows up to the 100 busiest devices that sent syslog in the last 7 days, with private addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, fc00::/7) already selected, and adds the ones you pick as one change: the collector applies all of them at its next sync, and if the save fails, none is added. Public addresses are marked and left unselected, because a sender address is easy to forge over UDP; shared (CGNAT), loopback and link-local addresses are marked and left unselected too. When more devices sent syslog than it shows, it says so: add the others with Add IP / CIDR, where one CIDR entry covers a whole subnet. Once one sender is listed, syslog from every other address is dropped. The card counts the senders the collector applies. A change takes effect after the collector's next sync (about two minutes with the default settings); until then the card shows both numbers, and if they still differ after that, it tells you where to read the collector log.
• Removing the last sender says what happens next. The confirmation tells you whether the empty list will accept every sender or drop every message. Log Explorer explains an empty table when the collector drops every message, and gives administrators a link to the allowlist.
• Docker skips your host firewall for syslog. Ports that Docker publishes, syslog port 514 included, are not filtered by ufw or firewalld. INSTALL.md §4 now shows the firewall rules that limit port 514 to your own network.

• More Syslog Settings messages are translated. The error messages of the Syslog Alerts, AI Log Analysis, Custom Watch Patterns and Weekly Security Report cards, and the messages when you add or remove a sender or a source time zone, appeared in English whatever your language; they now use your language. In Arabic, those four cards are translated too, and Help names their controls as the page shows them.

• Your install always keeps one Full Access admin. The last active Full Access admin can no longer be moved to another role, disabled or deleted from the Users page or the API. If a single sign-on group change would demote that account, the sign-in is refused instead. The Users page no longer lets you change your own role, and it says why when it refuses a change. If no Full Access admin can sign in at all, for example after a lockout, a forgotten password or a lost authenticator, whoever runs the server can now unlock or reset the account from the host, starting with docker exec atlaseye-api python -m app.scripts.admin_recovery status (see Help, Server runbook, and INSTALL.md §7). A reset prints a one-time password once and is recorded in the audit log.

• Passwords are at least 12 characters everywhere. Every form that sets a password lists the rules the server applies and checks them before it sends the password. A minimum length below 12 saved in Settings, Security now counts as 12. Passwords you already have keep working until you change them. The forms no longer insist on one of a few special characters when your policy does not ask for a symbol.
• Two-factor sign-in is available from day one. A new install starts at the Optional policy, so every user can set up 2FA on their Profile page straight away, even before the licence is activated. On an existing install that never saved a 2FA policy, users now see Start 2FA Setup on their Profile page; nobody has to enrol. A policy you saved in Settings, Security stays as it is.
• After a password reset from the server, sign-in asks only for your new password. The organisation name step appears only while the install has no name.
• Unlocking an account starts its failed sign-in count again. After an admin unlocks an account on the Users page, or the host recovery tool unlocks or resets it, sign-in attempts that failed before no longer count toward the next lockout, so one mistyped password straight after an unlock no longer locks the account again. The same applies when a lockout ends by itself. If you set AUTH_LOCKOUT_DURATION_SECONDS in .env, keep it at least as long as AUTH_LOCKOUT_WINDOW_SECONDS; the defaults (900 and 600 seconds) already are, and a change takes effect when the api container is recreated. The server now warns when it starts if the lockout is shorter.

• Refused single sign-on attempts appear in the sign-in history. When single sign-on refuses a sign-in, for example because it would demote the last Full Access admin or the local account could not be created, the attempt is listed on the Access Events page with its reason. Failed single sign-on attempts no longer count toward the password lockout.

• You now get a warning before your licence ends. Admins with the full role see a notice at the top of every page from 30 days before a paid licence ends, which turns into a warning in the last 7 days; you can close it for the rest of the browser session. Monthly subscriptions renew themselves and get no advance notice, and a subscription gets one day after its end date to renew before any warning shows. Once a licence has ended, the banner says until when everything keeps working (three days by default) and turns red when paid features switch off. Air-gapped installations renew only with a file from the vendor, so they get the notice even on a monthly subscription and the warning as soon as the licence ends, and are told to request that file. Trials keep their own countdown. If your licence ends within the next 30 days and is not a monthly subscription, or has already ended (more than a day ago, for a subscription that renews itself), the banner appears as soon as this update is installed.

• An installation without a licence says it is read-only. Until a licence is activated, settings cannot be saved and no device can be added. The banner, and the message shown when a change is refused, now say so instead of suggesting that a single feature needs a licence.
• The licence end date also shows while the licence server cannot be reached. The banner that reports the unreachable server cannot be closed and takes the place of the notice before a licence ends, so it now also gives the end date and the number of days left, even after the notice was closed. The day counts in the licence-end banners are whole calendar days in the time zone the dates are shown in, so the number always matches the date, and on the last day they say the licence ends today. The trial countdown counts calendar days the same way and, on the trial's last day, says the trial ends today.
• Users without the full role are sent to an administrator. When a change is refused because no licence is activated, only admins with the full role are told to open Settings → Licensing; everyone else is asked to contact an administrator.
• Air-gapped licences can be renewed in the browser. Once an air-gapped licence is active, Settings → Licensing keeps the offline steps as the Offline (air-gap) renewal card: generate a request, send it to the vendor and apply the signed file they return. The notice before the licence ends now says where to apply it. Until now a renewal file could only be applied with a command on the server.
• The trial countdown counts correctly. The trial banner now says "1 day left in trial" instead of "1 days left in trial", in every language.
• The Licensing help matches the screen in every language. In German, Spanish, French, Portuguese, Persian and Arabic, the Licensing guide now names each card, field and button exactly as the Licensing tab shows it, instead of in English or in other words.

• Every Licensing card explains itself. The License Status, Request a License, Activate License and offline cards now have a ⓘ in the header. It says what the card's buttons do. For the 14-day demo, it says that while the vendor approves trials by hand, which is the default, the licence server refuses the request and points to the customer portal, the name the Licensing help and the payment reminder now use for it as well. For offline activation and renewal, it names every field the request contains, says that neither step contacts the licence server, lists what is checked before the licence changes, and says that a renewal replaces the active licence completely, its key included.

• Every sidebar entry has its own icon. Devices and Topology under Monitoring now have icons like the rest of the menu, and no icon appears twice: pages that shared one, such as the five that showed a globe, now each have their own. Icons that looked almost the same, such as two shields with a tick, were replaced as well.

• Syslog from devices that use the older message format is no longer lost for the rest of a day. When a device using the newer syslog format sent the first message of a day, messages from devices using the older format could be rejected until the next day, and they were not kept. Both formats are now stored. The change applies from the next day's log index after this update. The day changes at midnight UTC. Log indices from before the update, including ones restored from a backup taken before it, can still refuse older-format messages dated on their day until retention removes them. The syslog collector no longer waits for the search database before it starts receiving messages. If the search database is not reachable at startup, the collector waits about a minute, plus the time its last attempt takes, for the database to take the new settings before it stores anything; messages received meanwhile wait in its buffer, in memory and then on disk, as during any database outage. After that it stores messages anyway and applies the new settings within about a minute of the database answering. If the search database is not reachable for more than about a minute when the syslog collector starts, the messages of the day it comes back can be stored without the new settings; on a new install the World Map and the IP filters then miss that day's messages. Later days are not affected.

• Sizing guidance for your AtlasEye host. INSTALL.md and the air-gapped install guide now describe four host profiles, lab, small, medium and large, for 50 to 2,500 devices, each with the CPU, memory and disk it needs and the settings it uses. Pick the smallest profile that covers both your device count and your average syslog rate. Medium is provisional until a load test measures it, and large is planned. The older capacity figures in the guides, which were never measured, are gone. The security monitoring guide no longer mentions a TLS syslog listener: AtlasEye receives syslog over plain UDP and TCP only.

• New installations need a larger host. The installer and scripts/preflight_host.sh now refuse a host with less than 5.5 GB of memory, 2 vCPU or 30 GB of free disk for Docker, and warn below 8 GB of memory, 4 vCPU or 136 GB of free disk. Before, they refused a host below 3.5 GB of memory or 15 GB of disk. An installation you already run is not checked again when it updates.
• Air-gapped updates check the free disk first. Like an online update, an air-gapped update now stops before it loads the new images when less than 10 GB is free on the disk that holds Docker's data, so a disk that fills up halfway through cannot leave you without a working version. Set UPDATE_MIN_FREE_GB in .env to change the limit, or UPDATE_DISK_MOUNT to check another mount point.

• Your settings stay as they are. The profiles come with new .env settings for the search engine's memory, the database, metrics retention, the API workers and the syslog queue. Each one defaults to the value AtlasEye used before, so the values in effect stay the same. The first update restarts the database container once to apply its new start-up settings. If you tuned the database's shared_buffers or max_connections inside PostgreSQL itself (in postgresql.conf or with ALTER SYSTEM), move the value to POSTGRES_SHARED_BUFFERS or POSTGRES_MAX_CONNECTIONS in .env before you update: AtlasEye now sets both when the database starts, and that setting wins. To size an installation for a profile, follow "Sizing" in INSTALL.md.

• Syslog can no longer stop after about a year on a single-node install. OpenSearch writes a security audit-log index every day: its own record of access to the search engine, not the AtlasEye audit trail under Administration → Activity Log. On a single-node install it asked for an extra copy of each of these indices, which one node can never hold, and it never deleted them. After about a year the node would reach its limit of 1,000 shards and stop creating the daily syslog index, and new logs would have nowhere to go. From this release AtlasEye removes the extra copies and deletes OpenSearch audit-log indices older than 30 days. This happens automatically after the update, and the OpenSearch cluster status turns green. Installs that use an external OpenSearch cluster with several nodes are not changed.

• Old alerts, incidents, notification history and DNS snapshots are now deleted automatically. These four kinds of history used to be kept forever, so the database kept growing. A daily sweep now deletes resolved alerts older than 730 days, resolved or closed incidents older than 730 days, notification history older than 180 days and DNS snapshots older than 90 days. A DNS snapshot's age counts from the moment a newer snapshot of the same zone replaced it, so every state a zone had in the last 90 days (or the number of days you set) stays restorable. A deleted snapshot takes with it its restore point, the "Diff vs previous" comparison against it and its DNS marker on the Web Analytics traffic chart, which always lies before the period you keep. On an installation you update, nothing is deleted straight away: the first sweep runs about an hour after AtlasEye starts and only opens a 7-day grace period. When the grace period ends, the next sweep deletes everything older than these limits, which on a long-running installation can be years of history, and it cannot be undone. On a large installation that clean-up runs in short steps once an hour until it is done, so it never holds up AtlasEye's other scheduled work for long. Never deleted, whatever their age: open and acknowledged alerts, alerts linked to an incident, incidents still in progress, NIS2-reportable incidents, incidents with a NIS2 report already filed and the newest snapshot of each DNS zone. The audit log is not affected. To keep more, change the days in Settings → System → History Retention, or turn Auto-delete off on a row to keep it forever. Do it before the grace period ends; the card shows the date.

• The syslog Retention Policy now says what each mode does. The texts under Syslog & Security → Security Settings promised automatic archiving, which AtlasEye does not do. "Archive" never deletes or archives anything by itself, so the disk keeps growing until you export old logs in Administration → Backup & Archive and purge them, or choose "Delete". "Archive + Delete" deletes logs after the retention period exactly like "Delete", without keeping a copy first. Nothing about how retention works has changed: only the texts are new.

• Syslog retention no longer reports a false sync failure. On a fresh install the API could log "Failed to sync ISM policy" while it set up the retention policy, and saving the Retention Policy while another change was being stored could say the OpenSearch sync failed. In both cases the policy is now stored and applied to the syslog indices at once. The description of that policy in OpenSearch (syslog-retention) now also says what the selected mode does. Retention itself works exactly as before. If the sync does fail, Save stays enabled, so you can retry it at once without changing a field first.

• Metric history takes less disk space. The update removes database indexes on the metrics table that duplicated other indexes. On long-running installations this frees disk space (about half a gigabyte on our test installation). No data is removed, and charts and reports show the same history as before. The first start after the update can take a little longer while the indexes are dropped. If one of the other metrics indexes is missing or was left unfinished by an interrupted earlier update, the update keeps the index that per-device charts fall back on and says so in the server log, naming the index and how to repair or recreate it.

• Web Analytics now logs every retention pass and raises an alert when old data is not being removed. Nothing about what is kept or deleted has changed. Each daily pass writes one summary line starting with [retention] sweep to the log of the Web Analytics ingest service (docker logs atlaseye-weblytics-ingest), also when it has nothing to delete or skips because no site is synced. That line replaces the two old ones, [retention] sweep done: {...} and [retention] no synced sites — sweep skipped: if you search your logs for those, search for [retention] sweep instead. Each deleted daily index is still named, now on its own [retention] dropped index line. The new alert, Web Analytics is not deleting old data, reaches your alert channels when an old daily index is still there after a pass, or when no pass has succeeded for two days. A pass in which deleting a site's old visits failed does not count as a success. That delete may now take up to an hour before it counts as failed; before, a large one was logged as failed after 10 seconds. Restarting the ingest service neither restarts the two days nor clears the alert, unless it keeps restarting within about five minutes of each start, before its first pass. A restart after which Web Analytics cannot load its site list for 10 minutes or more can start the two days again. It stays quiet while no site is set up, and the two-day check starts two days after this update. The ingest service no longer writes a log line for every visit it receives, so its log no longer records the page address and browser details of each visit, and those lines no longer push the daily summary out of the log. Errors are still logged. The gateway no longer writes an access-log line for these visits, or for each load of the tracking snippet, either, so the visitor's IP address, page address and browser details are no longer written to its access log. Its error log no longer records the IP address and page address of a visit it turns away, or of one that arrives while the analytics service restarts. If you edited the Prometheus alert rules on your server, the update keeps your file and puts the new rules in a copy beside it whose name ends in .release; the alert arrives once you take that copy.

• Security updates for three bundled libraries. AtlasEye now ships urllib3 2.8.0, the HTTP library its Python services use; axios 1.20.0, the library the web interface uses to talk to the server; and React Router 6.30.6, which moves the web interface from page to page. Each of these releases fixes published security advisories. Nothing changes in how AtlasEye works.

• New installs back themselves up every day. A new install now takes one full backup a day, at the first backup check after 03:00 UTC, without anyone editing a file. The check runs about hourly on an idle server and less often on a busy one. The first backup comes at the first check after the install, or after turning the daily backup on; if that check falls between midnight and 03:00 UTC, it comes at the first check after 03:00 UTC instead. An install you update keeps its current setting.

• See and switch the daily backup in Settings. Settings, System, Scheduled Backup Retention shows whether the daily backup is on, when it runs, and whether the switch or the install's .env file decided. A user with Full Access can turn it on or off there; turning it off asks first. The Backups card on Backup & Archive warns while it is off. If you updated from an older release, check it: it is off unless someone turned it on.
• Keep a copy of your backups somewhere else. Backups are stored on the same host as AtlasEye, so a disk or host failure takes them too, and the Scheduled Backup Retention card now says so. Download a backup from Backup & Archive now and then and keep it elsewhere. Downloading needs the backup licence feature, which Plus does not include; without it, copy the backup folder, /app/backups, out of the api container.
• Daily backups no longer fill the disk over time. Each backup used to carry every syslog snapshot AtlasEye had ever taken, so backups grew every day. The daily backup now holds the database and the uploaded files but no syslog history, and AtlasEye keeps no syslog snapshot between backups: the first daily backup after the update deletes the snapshots earlier versions left and frees their space. The disk holds one daily backup for each day the retention keeps, plus the backups you create or upload. Older backups still restore.
• A backup that does not fit on the disk is skipped, and you are told. A daily backup needs about twice its size free while it runs, plus enough to keep the disk below 95 % full, the point where AtlasEye refuses Apply Update. When that space is not free, the backup is skipped, the audit log records it once a day, and the Backups card on Backup & Archive shows how much space was free and how much was needed. The next backup check takes the backup once there is room. Five skipped checks in a row also raise the SchedulerTaskFailing alert.
• Monitoring keeps running during the daily backup. Device checks no longer pause while the daily backup is written.
• Syslog history goes into a backup only when you ask for it. It is usually much larger than everything else, so the daily backup leaves it out. To take it along, for example to move AtlasEye to a new server, tick Include syslog history before you press Create Backup on Backup & Archive. The Syslog history column shows which backups hold it. Restoring a backup without it keeps your current syslog data. For long-term keeping, use Create Syslog Archive under Syslog Archive & Export.
• A manual backup that does not fit on the disk is refused at once. It checks the free space before it copies anything, and the Full backup card shows how much space it needs and how much is free. A backup without syslog history needs less.
• Scheduled checks keep running during the daily backup. Syslog alert rules, syslog threat alerts, status page uptime and the other scheduled checks paused while it was written, so syslog events from early in a long backup were never checked against the alert rules.
• A daily backup cut short by a restart no longer holds up the next one. After an Apply Update or a host reboot in the middle of a daily backup, AtlasEye waited 12 hours before it tried again, so that day's backup came late or not at all. Now the next backup check sees that the backup stopped, removes what it left and takes the backup.
• A daily backup that hangs now raises an alert. A daily backup still running after 6 hours counts as failed at every check that follows, and so does one kept waiting more than 6 hours by another backup, for example a manual backup that hangs. The SchedulerTaskFailing alert fires after five failed checks: at the earliest about 10 hours after the backup started, later on a busy server, where the checks come less often than hourly. A wait on another backup counts only at the checks from the backup hour to midnight UTC, the only ones that try to take the backup, so with a late backup hour that alert can take one to two days. A database dump still running after 12 hours is stopped, so the next backup can start. The alert clears when the next daily backup completes, including the cleanup of old backups, at the first check that finds the daily backup switched off, or when the monitoring worker restarts: each of these clears the count of failed checks. A failed or hung backup, a wait on another backup, a skip for lack of space and a cleanup that fails with an error stay counted until one of those three things happens. While a daily backup is still running, no check looks at the switch, so switching the daily backup off clears the alert of a backup that hangs only after that backup has ended; a restart of the monitoring worker clears it at any time. Any other failure, for example a check that could not reach the database, is also cleared by the next check before the backup hour or after the day's backup, as long as none of those four kinds is counted.

• The disk warning names the one thing it blocks. At 95 % disk use AtlasEye refuses Apply Update until you free space. The warning banner and the Help said restores and resets were blocked too. They are not, so you can still restore a backup or reset the system to recover.

• Plain http now redirects to HTTPS. When AtlasEye serves HTTPS itself, which a new installation does from the first start, opening an http:// address now takes you to the same https:// address, so nobody signs in over an unencrypted connection by accident. With the self-signed certificate a new installation starts with, the browser warns about the certificate until you install a trusted one (INSTALL.md section 3). Uptime monitors that check /health, website tracking and Service Manager agents keep working over http. Service Manager agents you add while the self-signed certificate is in use talk to AtlasEye over http on port 80; after you install a certificate from a public certificate authority, enroll them again to move them to https. With a certificate from your own certificate authority, set AGENT_CALLBACK_BASE_URL in .env to the https:// address agents should use (INSTALL.md section 5). If the certificate cannot be used, AtlasEye keeps serving http as before instead of locking anyone out.

• Behind a load balancer that handles HTTPS, change three settings before you update. If a load balancer in front of AtlasEye holds the certificate and forwards plain http to it, set TLS_ENABLED=false in .env, and set BASE_URL to the https:// address your users open, before you install this update. Otherwise browsers are sent back and forth in a loop. Also list the load balancer in GATEWAY_TRUSTED_PROXIES (next item). That setting takes effect only with this release's compose files: after the update, check that they are in place. The update warns when they are not. INSTALL.md section 5 has the steps and the check.
• Behind a reverse proxy, name it before you update, so each user is seen at their own address. AtlasEye now accepts the client address a proxy passes on only from the proxies you list in GATEWAY_TRUSTED_PROXIES. Before, any machine on your network could make its requests look as if they came from another address. Until you set it, the audit log and active sessions show the proxy's address, all users behind the proxy share one sign-in limit and one API request limit, brute-force alerts name the proxy's address instead of the attacker's, and website tracking cannot tell which country a visitor is in. AtlasEye also learns from those proxies whether the visitor used https, so behind a load balancer that handles HTTPS, sign-in cookies are marked secure. Behind a reverse proxy that has its own certificate, Service Manager agents you add are given its https:// address once the proxy is listed there; until then they are given an http:// address on port 80 of the proxy. INSTALL.md section 5 has the steps.
• The installer now fails loudly when HTTPS does not come up. It checks that HTTPS really answers. If it does not, the installer shows a red warning with where to look and how to fix it, prints an http:// address instead of an https:// one, and ends with exit code 2. The NIS2 Compliance page likewise counts HTTPS only when it can confirm it, and otherwise says that HTTPS is not proven and where to fix it. An air-gapped update now runs the installer's HTTPS check too and shows the same red warning, but the update still completes. So does an update you run with scripts/update.sh from a shell on the server. Apply Update cannot reach HTTPS from its own container, so its log says "HTTPS not checked": open AtlasEye at its https:// address once it has finished.

• Tighter HTTPS settings. The private key of the HTTPS certificate can be read only by its owner, on new installations and after every update. Without Docker user namespace remapping, an update gives the key to the web server's user with that owner-only mode, whoever owned it. With remapping, a key that a user other than root owns and only that user can read stays exactly as it is, and the update warns that HTTPS works only if that user is the web server's user on this server; any other key is changed only from inside a container, where the web server's user is the right one. That container cannot change a key that root owns: the update then warns and gives the commands, with the owner the key needs when Docker uses its default remapping user, or how to work that owner out. When the update cannot ask Docker whether remapping is on, a key that a user other than root owns and only that user can read also stays as it is, and a warning gives the commands to fix it unless the web server's usual user owns it. Apply Update is not supported with remapping, because its updater container is remapped too and cannot use the Docker socket: update such a server with scripts/update.sh from a shell on the server, which does all of the above; installing does the same with a key already in place. The certificate itself is changed only when the web server could not read it; with remapping, when the web server's user cannot be told, a certificate that not every user can read is made readable to all, which is safe for a certificate. When the certificate is in a folder outside the installation folder, Apply Update cannot see it: its log says so and gives the command that checks the files from a shell on the server. Browsers are told to use HTTPS for AtlasEye itself, no longer for every other name under your domain. The outdated X-XSS-Protection header is gone, a Permissions-Policy header blocks camera, microphone and location access, and responses no longer show the web server version.

• See whether your AtlasEye host still fits its size. Full admins get a Capacity card on the About page: the sizing profile the installation runs and whether the host meets its minimum, how many devices and syslog events per second it handles, how full the data disk is, how fast it grows and how many days are left before it reaches 75%, the planned fill limit, and 95%, where OpenSearch stops storing new messages, how close OpenSearch is to its shard limit, how long a round of device checks takes, and one recommendation. When one of these needs attention, the System Overview on the dashboard shows one line with a link to the card.

• New alerts for the AtlasEye host itself. AtlasEye now alerts when a disk of its own host is more than 75% full for 15 minutes (more than 85% for 5 minutes is critical), when OpenSearch uses more than 80% of its shard limit for 30 minutes, when syslog senders keep going over the per-sender rate limit for 15 minutes, and when a round of device checks takes longer than the shortest check interval for 15 minutes. Rate-limit drops used to raise SyslogMessagesDropped after 5 minutes; now they raise SyslogSourcesRateLimited once some sender has been over the limit in every 5-minute window for 15 minutes. A flood shorter than about 10 minutes raises no alert, and a 5-minute pause starts the 15 minutes again. The drops of a short flood still show on the Capacity card of the About page (full admins), under Dropped events (24 h) as "Over the per-sender rate limit", and the syslog collector log names each sender once per rate-limit window. In enforce mode the messages over the limit are dropped; in monitor mode (RATE_LIMIT_MODE=monitor) nothing is dropped and the alert only reports the senders. Apply Update installs the new alert rules. If you edited the alert rules file on the host, your copy stays as it is and the new version is placed beside it with a .release suffix.

• The licence server and your customer account have new addresses. AtlasEye now reaches the licence server at license.atlaseye.eu, and your customer account (downloads, licences and billing) is at https://portal.atlaseye.eu/portal/. The old address, license.cdnglobal.eu, keeps working, and account links to it open the new address. The first time you open your account there, sign in again. If you mirror your status page to us, its public link moves to the new address too; links you already shared keep working. If your firewall allows outbound traffic by name, add license.atlaseye.eu before you install this update, and keep license.cdnglobal.eu: an update from an earlier release, and a rollback to one, still use the old name. Images still come from registry.cdnglobal.eu.

• A slow human-verification check no longer slows down the whole app. With Cloudflare Turnstile switched on, each sign-in kept a database connection busy while Cloudflare checked the challenge. When Cloudflare was slow to answer, a burst of sign-in attempts could use up every connection, and other pages had to wait as well. Sign-in now frees the connection before it asks Cloudflare.
• About shows the real date your HTTPS certificate expires. The TLS expires row now reads the certificate AtlasEye serves, and says Unknown only when HTTPS is handled outside AtlasEye, for example by a proxy in front of it. The Cosign signature and Last security scan rows are removed: nothing in the product filled them, so they always said Unknown.
• Version numbers read like the release you install. The About, Licensing, Updates and Compliance pages show the version as 1.2.340, with the exact build (for example Build a01b4460) on a small line under it. The copy button still copies both, which is what support asks for.
• The Kubernetes (Helm) guide now says the chart cannot be installed yet. The Helm chart is a preview, and with its default settings it cannot download the AtlasEye images. Install with Docker Compose, online or with the signed air-gapped bundle; both are unchanged.

• Notification emails have a new layout. Emails from a notification channel now show the AtlasEye logo and a coloured bar for how urgent the message is. When Public App URL is set under Settings → General, they also have an "Open in AtlasEye" button. They carry a plain-text version and the Date and Message-ID headers that mail servers expect, and they come from "AtlasEye Alerts".
• Telegram notifications are easier to read. The first line starts with an emoji for the level, and links no longer expand into previews. Recovery messages and AI capacity forecasts arrive without a notification sound.
• Webhook notifications carry a language field. The other fields keep their names; the level of some alerts changes, as listed below.
• The Test button sends a complete sample message. Testing a notification channel now sends a message with every part a real alert has: details, a step with a command, and the link to AtlasEye. It is written in the channel's Message Language.

• Apply Update now also keeps the alert rules and the monitoring configuration up to date. An update used to leave the built-in alert rules and the configuration of the metrics and alerting services exactly as they were installed, so new and corrected alerts reached new installations only. Starting with the update after the one that installs this version, Apply Update brings these files up to date as well, just before it restarts the services. Each new version is checked by the running service first; if the check rejects it, the current file stays in use. A file you changed on the server is left as it is: the new version is placed next to it, and the update log names the file and the one command that takes the new version when you are ready.

• Reinstalling no longer stops later updates from refreshing the configuration. After the installer was run again over an existing installation, every later update took the freshly installed service definitions and monitoring configuration for files you had changed: it left them as they were, placed its own copies next to them and warned about changes you never made. The installer now resets that record once it has verified the files, so the next update brings them up to date as usual.

• Air-gap updates now bring the new alert rules and monitoring configuration. Prometheus and Alertmanager kept reading their configuration from the directory they were first started from, because update_airgap.sh never restarted them from the new bundle directory. So an offline server never got a release's new alert rules or Prometheus configuration, and monitoring targets added after an update, for example by Auto Setup (SSH) on a device's Containers tab, were never collected. Deleting that old directory also stopped both from starting. The update now moves both to the new bundle directory. A file that is still as installed takes the new release's copy, once Prometheus or Alertmanager accepts it. A file you edited keeps your edits: the release's copy is saved next to it with .release added to its name, and the update prints the command that puts it in place. Make monitoring edits in the newest bundle directory from now on. A rollback leaves both on the new bundle directory, so keep that directory.

• Alert Thresholds now tells the truth about a failed Prometheus reload. When Regenerate & reload Prometheus wrote the alert rules but Prometheus did not reload, the warning said the rules would be picked up on the next scan, and Help said the same. Prometheus never rescans them on its own: the new thresholds wait for a successful reload or a Prometheus restart. The warning and Help now say so, and tell you to press the button again.

• An alert override edit sent to the wrong alert's address is now refused before anything changes. Through the API, editing an override under an alert it does not belong to answered "not found", but the change had already been saved and applied to the other alert. The request is now rejected first, as deleting one already was.

• Signing in no longer makes the rest of the interface pause. Signing in, entering a recovery code, changing a password, setting up or turning off two-factor authentication and creating new recovery codes no longer make the rest of the interface pause for a moment on small servers, for you or for anyone else using it at the time. The same goes for an administrator creating a user or setting a user's password. Nothing changes in how these work.

• The interface no longer pauses for everyone while one slow page loads. Checking a port on a host that does not answer, loading a router's firewall block list, signing in through single sign-on or opening a user's activity history could make the whole interface pause, for you and for anyone else using it at the time, until that one request finished. These now run alongside everything else. Nothing changes in how they work.

• A factory reset now completes, whoever starts it. System Reset (Factory Defaults) now deletes the data, restores the default administrator and adds an entry to the audit log that names the administrator who started it. If a step fails, nothing is deleted. Before, the reset stopped with an error: usually before deleting anything, but on some older installations only after the data was already deleted, when an administrator other than the first account started it.

• Actions recorded without a user account now say who did them. The Activity Log, its page exports and its details panel, and the dashboard's Recent Activity showed "User null", "User n/a" or a bare "User" for them. They now show "system", and the factory reset entry shows the administrator who started it. An action by a user who has since been deleted shows "User" and that user's ID, also in the history of an IP address or range, where it showed "system".

• In the Activity Log, row numbers continue across pages. On the second page and later they started again at 1. Each entry also shows the name of the item it is about next to its ID again, as its details panel already did.

• The factory-reset dialog shows its title correctly, and the Arabic interface shows it in Arabic. The dialog that System Reset (Factory Defaults) opens under Settings → System showed garbled characters before "DANGER" in its title, in English and in Arabic. It now shows a warning sign there. In Arabic, the card and its dialog were in English; they are now in Arabic, and the word you type to confirm is still RESET. In Portuguese, the Âmbito/Zona label of the IP address form also showed garbled characters; it now reads correctly.

• Disable in the Users list shows a stop icon. The Disable action in the Users list, and in the panel that opens when you click a user, showed a trash can. Disabling keeps the account: it signs the user out and blocks sign-in until you enable the account again. The action now shows a stop icon instead.

• An update now restores the OpenSearch Dashboards service account when it is missing. If the kibanaserver account had been deleted from OpenSearch, an update reported success while OpenSearch Dashboards could not sign in. The update now creates the account again with the Dashboards password from your .env file and restarts Dashboards so that it signs in. When it cannot, for example because you changed the Dashboards login yourself, the update now shows a warning instead of success; the update itself still stands.
• The organisation name from the first sign-in wizard is now saved on a new install. Until now it was lost whenever no licence had been activated yet, which is the case on every new install: the wizard reported that the save failed and moved on to the password. The name is now saved before a licence is activated too, so it no longer has to be set again in Settings > General.

• Your own address opens the sign-in page. Opening AtlasEye at your own address showed the vendor's marketing page first. The sign-in page now opens at every address except the vendor's own marketing site.

• About says who to contact. About used to show every user the vendor's support address in one Support card. It now has four cards. Get help shows your organisation's help desk. Report a vulnerability shows the manufacturer's security contact. Manufacturer shows who makes the product. Vendor contacts, which only full admins see, lists the vendor's support, sales and legal contacts and its privacy policy, and now holds the Download diagnostic bundle and Config snapshot buttons.

• Support Email is your help desk. The Support Email field under Settings → General is your organisation's own help desk, for your users. About → Get help, the sign-in page, the app footer and the public status page show it. When it is empty, About tells users to ask an administrator and gives full admins a link to set it. It never falls back to a vendor address, and the diagnostic bundle that you send to the vendor leaves it out.

• Your public pages stop linking the vendor's privacy policy. With no Privacy Policy URL set, the sign-in page linked the vendor's Privacy page instead, and the public status page always linked the vendor's EULA and Privacy pages. Those pages cover the vendor's licence service, not your users or your visitors. The sign-in page and the status page now link your own Privacy Policy URL and help desk, each only when it is set.

• Notices where data goes to the vendor. The demo licence form under Settings → Licensing now names who receives your details, why, the licence service's privacy policy and where to send privacy questions. The Public Status Mirror card warns you not to put personal data in the banner or in a maintenance message: both go to the vendor and appear at the public mirror link.

• The trial-expired dialog and the lock screen give real addresses. Contact sales in the trial-expired dialog now opens an email to your vendor's sales address, or to your reseller's when it has set one. The button is hidden when no address is available. The integrity lock screen now shows the support address to send the support code to.

• The SSH pop-out warning names your address. When the browser blocks the SSH terminal's pop-out window, the warning now tells you to allow pop-ups for your own address instead of the vendor's.

• Your address no longer serves the vendor's security.txt. Every installation published a security.txt that told security researchers to send reports about your domain to the vendor, and promised a response time that no policy backs. It is gone. To report a security flaw in AtlasEye itself, use the contact under About → Report a vulnerability.

• The compliance documents no longer promise response times. The evidence pack and the SOC 2 and NIS2 documents promised to acknowledge vulnerability reports within 3 or 10 business days, or 24 and 72 hours. No policy backed those times. The coordinated vulnerability disclosure policy, which is still pending, will set them. The evidence pack also offered a data processing agreement. It now says, as EULA v1.3 section 7.3 and Privacy Policy v1.2 section 2.1 do, that ordinary operation needs none.

• Getting help, in Help and in the install guide. Help → Shortcuts & support has a Who to contact card: your help desk first, security flaws to the manufacturer's security contact, and for full admins the vendor's contacts under About → Vendor contacts. INSTALL.md has a new Getting help section with the support and security contacts. Resellers can set their own support, support portal and sales contacts; .env.example describes the settings.

• Help now has a server runbook. Administrators who can open Settings → System see a new Help tab, Server runbook. It lists the commands to run on the server that hosts AtlasEye: health checks, logs, the switches to use when a setting cannot be reached in the web interface, restarts, updates, the data services, the TLS certificate, disk space, and what to send with a support request. Every command has a copy button and reads left to right in every language. Steps that interrupt service or can lose data are marked, and the least disruptive option comes first. The Maintenance, Updates, System, Backup & Archive and About guides, the troubleshooting answers that need the server, and the offline update card under Settings → Updates link to the matching section.

• Report a problem from inside AtlasEye. Choose Report a problem in the menu behind your name, on Help → Shortcuts & support, on About → Get help, or on the screen shown when a page crashes. Describe what went wrong and review exactly what the report contains before anything leaves your installation. Technical details are optional; your licence key, sign-in tokens and values written as password=… are masked. Full admins send the report to AtlasEye support and get a reference starting with PR- to quote. Everyone can download the report. Email report appears when there is an address to write to: AtlasEye support's for full admins, otherwise your help desk's once your organisation has set a support email. An air-gapped installation, or one without an activated licence, downloads or emails the report instead.

• Chat and Recent Diagnostics keep their history on every installation. The database of an installation first set up by version 1.1.0 or later had no tables for chat conversations or for the diagnostics history of the Tools page. Opening AI Agent → Chat showed "Failed to load chat history." and its list of past conversations stayed empty, and Recent Diagnostics on the Tools page did not keep a run past a page reload. Updating creates the missing tables. An installation that already has them keeps its conversations and diagnostics history as they are.

• Only the admin who opened a web terminal session can close it. Through the API, any admin with terminal access could end another admin's open SSH session by its id. Each session now remembers who opened it, and a close request from anyone else leaves it running.

• An incident only accepts alerts you are allowed to work on. Through the API, a user limited to some devices could link any alert to an incident they could reach, including alerts on devices outside their access and alerts that do not exist. Each linked alert now needs the same access as acknowledging it.

• Alert Thresholds now warns when a saved change did not reach Prometheus. Saving a threshold card, or adding, editing or deleting a per-target override, stores the change and asks Prometheus to reload its alert rules. When that reload failed, the panel still said the change was saved, while Prometheus kept alerting on the previous values. You now see a warning instead: the change is saved, the previous values stay active until a reload succeeds, and Regenerate & reload Prometheus tries the reload again.

• New AtlasEye logo. The sidebar, the sign-in page and the public status page show the new AtlasEye logo. The browser tab icon, the home-screen icon on phones and tablets, and desktop alert notifications use the new AtlasEye mark.

• Your organisation's name is shown instead of an uploaded logo. Settings → General no longer offers uploading an organisation logo, brand mark or favicon: every installation shows the AtlasEye logo. The organisation name you set there appears as text beside it: in the sidebar (hover the logo while the sidebar is collapsed), on the sign-in page, on the public status page and in the browser tab title. The two header colour settings go with the upload; the name now takes the sidebar's own colours. Logos uploaded under earlier releases stay on the server and in backups, but are no longer shown.

• Notification History shows forecast and resolved messages. Both have their own colour and name in the Level column, and the level filter can select them.

• Status page emails have the new layout. The email that confirms a subscription to the status page, and the emails subscribers get when the status banner changes, now look like the other notification emails: the AtlasEye logo, a coloured bar for the state, and a button that confirms the subscription or opens the status page (for banner updates this needs Public App URL under Settings → General). They are written in the Default Language set under Settings → General, and their times use the system time zone and name it. When an incident is resolved, the email says when it started, when it ended and how long it lasted, instead of repeating the problem.

• NIS2 reports emailed to a CSIRT have the new layout. The email shows the AtlasEye logo and has a plain-text version. The report text and the signed attachment are exactly as before.

• Each notification channel has a Message Language. Emails, Telegram messages and webhook texts from a channel, including the Test Connection sample, are written in the language chosen for it. The default, System language, follows the Default Language under Settings → General. Device, container and site names, IP addresses, commands and the text of your own Prometheus alert rules are never translated. Times use the system time zone and name it.
• Device, threshold, disk space and SLA notifications are clearer and in your language. The messages that a device is down, degraded or back up, that a metric threshold or the disk space limit was crossed or is back to normal, and the monthly SLA report now use the new layout and the language of each notification channel. They list the facts: the device and its address, the measured value against the threshold, the failing services, and what to check next. A "back to normal" message says when the problem started, when it ended and how long it lasted, and it arrives in the same email thread, or as a Telegram reply, as the alert it closes. A device that goes from degraded to down and then recovers is one thread, and the duration covers the whole problem. Webhooks now receive the level critical for a device that is down and for a critical threshold or disk space alert (it was error), warning for a degraded device (it was error), and resolved for recoveries (it was info). The first successful check of a new device and the SLA report arrive in Telegram without a notification sound.
• Four more alerts arrive in each channel's language. Brute-force sign-in alerts, syslog alert rules, AI log analysis alerts and AI capacity forecasts now use the new message layout and the language of the notification channel, or the Default Language set under Settings → General. Rule names, queries and log lines are shown exactly as written. A brute-force alert now says whether the targeted account is locked, and for how long. The two AI alerts contain only numbers that AtlasEye counted or calculated; the AI's own explanation stays on the Syslog Analytics page and in AI Predictions on the Dashboard. An AI capacity forecast is now sent only when CPU, memory or disk usage is on course to reach 100% in less than 7 days. Webhooks receive it with the level forecast (it was warning). The weekly syslog report is still sent in English.
• Expiry, DNS change, domain change and traffic notifications are easier to act on. They now arrive in the language of the notification channel, which is the Default Language set under Settings → General unless the channel has its own, and list the facts one per line. An expiring domain shows its registrar, the expiry date in the System Timezone and the days left. An expiring certificate shows the host name, the origin IP and the DNS zone. A DNS zone changed outside AtlasEye shows each changed, added or removed record with its old and new value. A change in your GoDaddy account shows what changed on each domain, with nameserver, lock and transfer-protection changes first. A traffic drop or spike shows the hour checked, its page views and the usual figure, and for a drop, the time of a linked device outage or of a recent change to the linked DNS zone. Long lists show the first ten changes and the number of the others. Each notification ends with the steps to take. When they are sent is unchanged, but their subjects are worded differently, so update any mail or webhook filter that matched the old subjects.
• Alerts from the built-in monitoring rules say what to do. When one of AtlasEye's own alert rules fires, for example the API not responding, device monitoring stalling or the syslog collector dropping messages, the notification now says in plain words what is wrong, what it means and what to do, with the command to run, in the channel's language. FIRING banners and lists of internal labels are gone, and the alert for dropped syslog messages names the cause. When an alert ends, the message gives its start, its end and how long it lasted, and email and Telegram show it as a reply to the alert. Alerts from Settings → Alert Thresholds show the current value next to the threshold, for example "Currently 92.4%, above the threshold of 80%.", and the host or container that crossed it. Alert rules you added yourself keep their own title and description. For webhook channels, the level of an ended alert is now "resolved". On a server updated with Apply Update, the built-in alerts show their reading, and the dropped-messages alert its cause, from the following update on, which brings the new alert rules. Alerts from Alert Thresholds show their value right away.
• A new server installed from another channel takes its updates from that channel. A server installed with sudo bash atlaseye-install.sh --channel edge got its first build from that channel but then looked for updates on the stable channel. The installer now records the channel, so Settings → Updates offers the builds of the channel you installed from. A server installed that way earlier still looks on stable until you set UPDATE_CHANNEL=edge in its .env and recreate the api and updater containers.

• Help no longer points you at a repository. The Documentation card under Help → Support now says where things are in your installation: the feature catalog on the Help page itself, the notes of the release on offer under Settings → Updates, and the install and air-gap guides as INSTALL.md and docs/airgap-install.md in the install directory.

• The NOTICE file now includes the attribution notices of bundled components. It now reproduces, word for word, the attribution notices that bundled Apache-2.0 components ship, as their licence requires. It also names the copyright holders of 14 more components, found in those notices and in the other licence files the components carry.

• The NOTICE file's MIT section now shows the MIT licence. Up to and including 1.2.338, the MIT section of the NOTICE file showed the Python Software Foundation licence text instead of the MIT licence. It now shows the MIT text. Three entries also no longer show a copyright line that is not the component's own. No component and no licence changed.

• The NOTICE file now reproduces licence texts it was missing. Up to and including 1.2.338, it did not include the GNU LGPL version 3 text that covers the PostgreSQL driver psycopg2, or the GNU GPL version 3 text that the LGPL builds on, and it showed no licence text for victory-vendor, a charting component. It now reproduces both GNU texts, and the licence texts of the libraries victory-vendor bundles. No component and no licence changed.

• Web analytics keeps the page views it is holding when AtlasEye restarts or updates. Page views and events wait in memory for a few seconds before they are stored. A restart or an update used to wait ten seconds for the web analytics service to stop, then force it off, and everything it held was lost. It now stores what it holds first and then stops, as long as OpenSearch is reachable at that moment. Page views that arrive while it is stopping can still be lost.

• The syslog collector stops promptly. On a restart or an update it was forced off after ten seconds instead of stopping when asked; it now stops as soon as it is asked. Log lines it has received but not yet stored at that moment are still not kept.

• The discovery wizard no longer keeps device passwords. Each Discover & Onboard run stored the SSH password, SNMP community and SNMPv3 passwords you entered, encrypted, and never erased them. They are now erased once a run is a day old, the next time the wizard runs or AtlasEye restarts. The first start after this update erases those from earlier runs that are more than a day old. Devices the wizard added keep their SNMP settings. A run more than a day old stops with a message to start the wizard again. Backups made before this update still hold the old entries. The wizard's session list and details in the API no longer include the SNMP community, even encrypted.

• The licence banner's links work from the keyboard. Open Settings, Upgrade and Subscribe now on the licence banner could not be reached with the Tab key or opened in a new tab. Now they can, and so can Manage in Settings on the Syslog page's excluded IPs notice.

• The syslog analytics IP and process links work from the keyboard. The IP addresses in the Brute Force, Port Scan and Coordinated attackers tables and the process names in the Process × Severity Matrix could not be reached with the Tab key, and screen readers did not announce them as controls. Now they can be reached and used with the keyboard, and screen readers say what each one does. The device names in the dashboard's Recent outages and Uptime SLA sections can now be reached with the keyboard too, and opened in a new tab.

• More IP addresses, names and icons work from the keyboard. The IP addresses under Top Active Threats on the Syslog Security tab, the IP addresses, hosts and processes in the world map's country details panel and the IP addresses in its Live Feed, the exclude icons and Clear all in the Log Explorer, and the copy icons on the API & Integration page could not be reached with the Tab key, and screen readers did not announce them as controls. Now they can be reached and used with the keyboard, and screen readers say what each one does. The same now goes for the AI Assistant's suggested prompts, the suggested questions under Ask your network on the dashboard, the recent targets on the Network Tools page and the MITRE ATT&CK technique IDs under the syslog Pattern Categories. Open full map on the dashboard's live globe can now be opened in a new tab.

• The Compliance page counts missed NIS2 deadlines correctly. An Article 23 report still unfiled past its deadline now counts as a missed deadline, not only one filed late, and the final report is timed from the incident notification, as on the incident page. Deleted IP records no longer count toward asset criticality coverage, and deleted or disabled admin accounts no longer count toward admin MFA enrollment. The Help page no longer says the posture cards show backup recency.

• NIS2 measure names and notes now follow your language. The Article 21(2) table on the Compliance page showed them in English whatever language was selected; they now appear in the selected language. Each note also says in plain terms what was checked on your installation, or that a result is a fixed property of the product.

• Backup download and delete accept backup files only. Before, an API request from an administrator, or from an administrator's API token, could download or delete any other file kept in the backup folder, such as the SSH host keys AtlasEye has saved for your devices. The Backups page never listed those files. Restore refuses them as well.

• Files unpacked from an offline bundle now belong to root. Before, unpacking the bundle as root left every file, the install scripts included, owned by the numeric user id of our build account. On your host that id is either no account at all or an unrelated one.

• Running the installer again after a failed host check works. When the installer stopped at its host check, for example on too little memory or a port already in use, running the same command again after fixing the host was refused with a message about updating from Settings, unless you added --force. It now simply starts again. A directory that holds a finished install still needs --force.

• The install guide's first-run checklist and host move are corrected. The checklist now activates the licence before the two-factor step, because an install is read-only until it is activated, and it says where two-factor is switched on (Settings → Security) before each user enrols on the Profile page. Moving to a new host now follows an order that keeps your data and your activation: back up, stop the old host, release its activation, install with the copied .env, activate, then restore the backup.

• The air-gap runbook no longer deletes your database to reset search. Its troubleshooting table offered a command that removes every data volume, the database included, when only OpenSearch had to be reset. It now gives the fixes that keep your data first, and a reset that removes only the search data. The removal instructions in the air-gap installer and the installer's message when Docker is not running are corrected too, and the first-run checklist says where mail is set up (Monitoring → Alerts, Channels tab).

• The installer refuses hosts that are not x86_64. AtlasEye images are published for x86_64 only, but the host check also accepted 64-bit ARM (aarch64) hosts, so an install there passed the check and failed later. The host check (scripts/preflight_host.sh) and the installer now stop on any other architecture and say why, and the install guides list x86_64 as the only supported architecture. When the host and an air-gap bundle do not match, the installer now tells you to use an x86_64 host with an x86_64 bundle or to ask your vendor, instead of telling you to rebuild the bundle.

• The air-gap runbook and the install guide are corrected. The runbook's file list names every file in the bundle once, including the update and rollback scripts. The offline activation steps use the names on the Offline (air-gap) activation card in Settings → Licensing. The troubleshooting rows quote the installer's real message about placeholder values and give the complete command to stop the stack without deleting data. The install guide says where your own certificate goes on an air-gapped host.

• Signing out or revoking a session no longer relies on the cache service alone. Before, if the cache service had restarted without its data or was briefly unreachable, whoever held a session that had been signed out, revoked or ended by a password change could renew it and start a new session. That renewal is now refused, and so is a repeat of the sign-in or renewal that had created the session moments before. In those cases some limits remain: the session itself stays usable for up to 15 minutes by default, and a copy of it taken before one of its automatic renewals can still be renewed after a sign-out or after that one session is revoked (a password change or reset stops it). Live updates are not tied to the session: someone holding a copy of it can still connect to them for about 2 hours after the session is revoked or the password changed, and after a sign-out in those cases. A live-update connection that is already open stays open after a sign-out, a session revoke, a password change or disabling the account, until it closes.

• Two gaps around password changes and sign-outs are closed. After a password change, or an administrator's password or two-factor reset, a copy of a session taken shortly before one of its automatic renewals stayed usable for up to 15 minutes by default; it now stops at once, unless the cache service has lost its data or cannot be reached. A sign-out, a session revoke or a password change made while one of the session's renewals was in progress could be undone by that renewal, which started a new session. The renewal now checks again first and is refused, which closes most of that window. A sign-out or a single session revoke still leaves a copy taken shortly before the session's latest renewal usable until it expires, up to 15 minutes by default.

• A time zone set in .env no longer weakens sign-out or shifts backup dates. On a server whose .env sets a time zone west of UTC (for example TZ=America/New_York), signing out, changing a password, an administrator's password or two-factor reset, or revoking a session did not end the access tokens already issued: they kept working until they expired, up to 15 minutes by default. They now stop at once, as they already did on servers on UTC or east of it. With any time zone other than UTC in .env, the date shown for a backup or syslog archive whose metadata file is missing is no longer shifted by the zone's offset, and new backup file names use UTC like the rest of the platform. A backup made before this update that has lost its metadata file can still show its date shifted.

• Enabling a disabled account again no longer brings back its old sign-ins. Before, when a user was disabled on the Users page and later enabled again, the sign-ins the account had before it was disabled came back and kept working. Now disabling the account revokes them, and once it is enabled again the user signs in again. Live updates are not tied to the sign-in: for up to about 2 hours after the account was disabled, a copy of one of its old sessions can still connect to them once it is enabled again. Personal access tokens are not sign-ins and are not revoked: they stop working while the account is disabled and work again once it is enabled. An account disabled before this update keeps its old sign-ins until they expire, 7 days by default: revoke them on Active Sessions before you enable it again.

• You can no longer disable your own account from Edit User. The Disable button already refused your own account, but setting Status to Disabled in Edit User, or making the same change through the API, went through. Since disabling an account now ends its sessions, that signed you out at once, and if yours was the only Full Access account nobody could enable it again. Saving your own account with Status set to Disabled is now refused with "Cannot disable your own account", and nothing in that save is applied. Other changes to your own account, such as your display name or email, save as before.

• The Users page no longer offers to disable your own account. The Disable User button no longer appears on your own row, nor the Disable button in the panel that opens when you click it, and Edit User no longer lists Disabled as a status when you edit yourself. Disabling your own account is refused either way; the page now stops offering it.

• Disable and Enable now say why they failed. When the server refused to disable or enable a user, the Users page showed only "Delete failed" or "Failed to enable user". It now shows the reason the server gave, and a general message only when it gave none.

• A timezone set for a user through the API is now saved. Updating a user through the API with a timezone answered with success but did not save the timezone. It is now saved, and checked the same way as the timezone you set in your own profile.

• A timezone must now be a real time zone. Setting a timezone through the API, your own or another user's, accepted any name, including ones the browser cannot use to show times. Such a name is now refused, and nothing in that request is saved. Every time zone the Profile page lists is accepted, older spellings such as Asia/Calcutta included, and clearing it in your profile still returns to the system default.

• Disabling a user no longer says it was deleted. After you disabled a user, the Users page said "Item deleted successfully", or "Delete failed" when it did not work, although disabling keeps the account and you can enable it again. It now says "User disabled", or "Failed to disable user" when the server gives no reason, in every language.

• The first sign-in wizard now finishes cleanly. It asks for your organisation name first and your new password last, then asks you to sign in again. Before, the password came first and ended the session, so the organisation name could not be saved: you were sent back to the sign-in page, or, on a new install, left on the organisation step until you reloaded the page. On a new install the name still cannot be saved before a licence is activated: the wizard reports that the save failed and moves on to the password. Set the name in Settings > General once the licence is active.

• Relative times, dates and numbers now follow your language. "5 minutes ago", month names, and the grouping of large numbers (1,000 / 1.000 / 1 000) now follow the language chosen in AtlasEye, instead of staying in English or following the browser's language. The Users and Active Sessions pages and the topology map's tooltips show their ages in your language too, instead of short English forms such as "5m ago". In Persian and Arabic, digits are Latin and dates Gregorian, as in the rest of AtlasEye. On the Users page, the time since a user's last login or creation was off by your time zone's offset from UTC, and a login in the last few hours showed "-" in time zones behind UTC, such as the Americas. Both now show the right age.

• Portuguese: more texts are now European Portuguese. In the Portuguese interface, the texts of table filters, empty tables, date pickers and similar controls came from the Brazilian Portuguese translation. A table filter's reset button, for example, read "Resetar" instead of "Repor".

• Web Analytics: outage and change markers now sit on the right hour. In a browser outside UTC, the traffic chart drew outage bands and incident and DNS-change markers shifted by the browser's offset from UTC, or left them out. They now sit on the hour they happened. On the syslog world map, an IP's first and last seen times now follow the time zone set in AtlasEye instead of the browser's.

• Portuguese: the year buttons of date pickers are read out in Portuguese. Screen readers named their keyboard shortcuts in English ("Control + left"); they now say "Control + esquerda" and "Control + direita". In Arabic, the picture on a pricing page with no plans on offer is now labelled in Arabic too.

• Short durations use your language's unit letters. Uptimes, outage lengths and the age of the latest data on the dashboard, the device and container pages, the SLA report, the About page and the syslog views now read "2j 3h" in French rather than "2d 3h", as the live counters already did. The French help tip about the diagnostic bundle now names the Support section instead of "Assistance".

• OpenSearch no longer has accounts with published passwords. Every installation carried five demo accounts from the OpenSearch image (anomalyadmin, kibanaro, logstash, readall, snapshotrestore), and the account OpenSearch Dashboards signs in with used its published default password. Any program on the server, and any container of the installation, could sign in to OpenSearch with them, and one of them reads everything stored there. New installations never get these accounts, and the Dashboards account gets a password generated for your installation. Offline updates remove the five accounts and change the Dashboards password during the update. Online installations do it from the update after the one that installs this version. If you used any of the five accounts yourself, create an account of your own to replace it.

• The OpenSearch administrator password no longer shows in the server's process list. The health check of the OpenSearch container put it on a command line every 20 seconds, where any user signed in to the server could read it.

• A restore now brings back the hosts AtlasEye collects metrics from. The hosts whose container and host metrics AtlasEye collects (the cAdvisor and node_exporter hosts added by onboarding or Auto Setup) were not part of the full backup, so a restore onto a new server left them out of metric collection. The full backup now includes this list, and a restore merges it: a host the server already collects from keeps its current port, and only missing hosts are added. The collected metrics themselves are still not part of the backup. Backups made before this change restore as before.

• Onboarding checks the hostname the way Add Device does. The Discover & Onboard wizard now refuses a hostname that is not a valid IPv4 address, IPv6 address or DNS name, for example one with a space, a ; or an underscore, with the message Add Device shows. Before, such a name was looked up in DNS and accepted if it resolved. A host added by its IPv6 address is now listed for metric collection in the standard [address]:port form. Collecting from it still needs IPv6 on the Docker network, which the default installation does not enable. The online update does not install this release's Prometheus configuration, so after an online update a host added by its IPv6 address shows no metrics on its device page until that configuration is in place.

• Devices added by their IPv6 address are now handled correctly. AtlasEye wrote such an address and its port together without the square brackets IPv6 needs. The node_exporter, Postfix and nginx exporter installs then failed to start, the wizard and container Auto Setup reported every exporter unreachable, the Containers tab never picked up a running cAdvisor on its own, and Proxmox collection could not connect. The address is now written in the standard [address]:port form in the install commands, reachability checks, scrape targets and Proxmox requests, and HTTP checks and webhooks sent to an IPv6 address carry a valid Host header. The check that the chosen address belongs to the device now accepts an IPv6 address in capitals or written out in full, and no longer mistakes a longer address for it. AtlasEye can also be pointed at a PostgreSQL server by its IPv6 address; before, it could not start. All of this needs AtlasEye's own container network to carry IPv6, which the default Docker installation does not set up.

• The Infrastructure page loads for users limited to some devices. For such a user the page failed to load whenever one of their devices was added by an IPv4 address or by a host name with a dot or a hyphen. It now loads and shows those devices.

• A factory reset keeps your licence activation. System Reset (Factory Defaults) used to remove the activation along with everything else, and until AtlasEye was restarted it could behave as licensed on some requests and as unlicensed on others. The reset still deletes users, network data, settings and logs, but the licence stays active, so there is nothing to activate again.
• The AtlasEye images no longer contain certificate keys from our build machine. The api and monitoring images included the private keys of the OpenSearch certificates on the machine that builds AtlasEye. Your installation never used them: it creates its own certificates when it is installed and uses only those. The files are no longer in the images.

• The Conflicts page opens quickly on a large inventory. With a thousand ranges and 60,000 addresses it took about 14 seconds to open; it now takes under half a second. Each check lists up to 200 findings, while its count still shows the full number. When ranges nest, an address is now judged by the most specific range that holds it, so an active address in an active subnet inside a deprecated one is no longer reported. Addresses outside every range now show their hostname.

• The IP Ranges page loads faster on a large inventory. Each range's utilization, next free address, map and discovery now read only the addresses inside that range, instead of every address in the inventory.

• The maintenance page now follows your language. The page your users see while maintenance mode is on, including during every update, was always in English. It now uses the language chosen in AtlasEye, laid out right to left for Persian and Arabic.

• Two alerts on the same server at the same time now both reach you. When two alert rules on one server fired within five minutes of each other, for example CPU and memory together, only the first was sent to your notification channels; the second was recorded as suppressed. Each rule now has its own five-minute window, so a rule that keeps flapping is still sent only once.

• Disk-space alerts now reach your notification channels. When a monitored server's disk alert opens at 80 % or 90 % full, it is sent to that server's email, Telegram or webhook channels, and again when the disk drops back below 77 %, like CPU and memory alerts. Until now these alerts appeared only in the app. A disk warning that keeps filling past 90 % now turns critical and is sent again; before, it stayed a warning until the disk recovered.

• The security and compliance documents now describe monitoring as it actually works. Audit-log integrity is checked when you press Verify Chain or open the Compliance page; there is no scheduled check and no alert. Nothing alerts on backup age or on database or search-cluster health; the documents now say so. They also state that scheduled backups stay off until you enable them. Security reports go to security@atlaseye.eu and are acknowledged within three business days.

• The AI assistant no longer discards answers that mention an AI vendor. An answer that happened to contain an AI company or model name, for example traffic to an AI service's domain, a user account with that name, or a log format that shares it, was replaced by a generic "I can't share details" reply. Those answers now come through. The assistant still won't say which AI model powers it.

• The Compliance page opens faster on a large audit log. Its audit trail integrity result is now reused for up to five minutes instead of being recomputed on every visit. Verify Chain on the Audit Log page still checks every entry each time.

• The alerts page stays quick as alert history grows. Each page of alerts no longer sorts every alert ever recorded.

• The installation and disaster-recovery guides now check the right addresses. The version check after an install or a restore pointed at an address that does not exist, and the health check could pass while the application was down. Both checks now work as described.

• The high-availability reference is corrected. As published, the two-host reference setup could not start, and its failover steps named files and settings that do not exist. It now uses one database, one Redis and one search cluster that you run for both hosts, and keeps a single monitoring scheduler. The guide explains how to bring the hosts up, how to move the scheduler when a host fails, and what the load balancer's health check reacts to. It also lists what the setup does not do yet, such as in-place updates and automatic failover, and includes a failover drill to run on your own hosts.

• Form errors now name the field that needs fixing. When a form was rejected because a value was not valid, the message often said only "Operation failed". It now says which field was wrong and why.

• Your plan's device limit now applies to every way of adding a device. The onboarding wizard, and finishing a device that was saved as a draft, could add devices beyond the limit. At the limit, the wizard now tells you on its first step, before it connects to the host. Onboarding a host that is already one of your devices still works.

• Users with access to only some devices no longer see other devices' alerts in the alert bell. New and changed alerts reached the bell for every device, with their messages, even for a user granted only some devices. The bell now shows such a user only alerts on their own devices, the same list they get when the page reloads.
• Offline (air-gapped) servers no longer show "Needs attention" all the time. The system status counted the licence server as part of your server, and an offline server can never reach it. When everything on your server works, the status now says so, and an outside monitor that checks /api/v1/health no longer alarms for this reason. If a connected server cannot reach the licence server, the licence banner still tells you.
• CSV exports from Syslog Analytics and the Access Matrix are safe to open in a spreadsheet. Log text can come from any device that sends syslog, and an SSO user's name comes from your identity provider. A cell that started with =, +, - or @ opened in Excel or LibreOffice as a formula. These cells are now saved as plain text. Numbers stay numbers.
• The "Syslog collector dropping messages" alert now covers log lines the search database refuses. When the search database rejects a single log line, for example because a field does not match the type it has stored, that line is lost. It was only written to the collector's own log, so the alert never fired. It now counts like any other dropped message.
• Restoring a backup from an older version now leaves a working server. The restored database kept the older version's structure until the server was restarted, so some pages could fail right after a restore. The restore now upgrades it to the running version straight away, and says so if that upgrade fails. A backup taken on a newer version than the server runs is now refused before anything changes, instead of being restored into a server that could not start again afterwards.
• Offline (air-gapped) updates can now be rolled back. Before an offline update changes anything, it saves a copy of the database. To go back to the previous version, run sudo bash scripts/rollback.sh from the new bundle folder: it restores that copy and starts the previous version again. Changes made after the update are lost, so decide soon after updating. The steps are in docs/airgap-install.md, section 6.
• Icon-only buttons now tell screen readers what they do. Buttons that show only an icon, such as edit, delete, refresh or Ask AI, were read out by the icon's English name, for example "robot" or "eye", whatever language you use. They now announce the action instead. The AI chat's button that folds the conversation list also says whether the list is open.
• Privacy and Terms links accept only web addresses. The Privacy Policy URL, Terms of Service URL and Public App URL settings now take only an address that starts with http:// or https://. If a link saved earlier is not such an address, the sign-in page leaves it out, and for Privacy it links the built-in privacy page instead. Saving the General settings asks you to correct such a link first.
• The installer warns when another syslog service holds port 514. The host check before installing already warned when port 514 was taken over TCP. It now also notices a syslog service, such as rsyslog, that receives on UDP port 514 only, so you can stop it before the install starts rather than after.
• The installer no longer asks for a licence key you already gave it. After an online install with a licence key, the final summary now tells you to sign in and paste that key under Settings -> Licensing, instead of asking you to request a key from your vendor. The online and offline summaries now also say that no device can be added until a licence key is activated.
• Setting up monitoring on two devices at the same moment no longer drops one of them. Container and host metrics are collected from a list of monitored hosts. Two devices added to that list at the same moment could leave one of them out, so it showed no container or host metrics. An interrupted update of the list can also no longer leave it empty or cut short.
• The incident list uses less memory for users who see only some devices. To show one page, it read every incident in full, descriptions included. It now reads only what it needs to decide which incidents the user may see, and loads the page itself.
• The notice for an install without a licence now says what it blocks. Until a licence is activated, no device can be added. The notice administrators see at the top of every page, and the one on the About page, said only that a licence unlocks paid features, and the About page named the Settings and Licensing menus in English whatever your language. Both now say it plainly, with the menu names your language shows, and so does the confirmation shown before you deactivate a licence.
• The NIS2 compliance page now says which of its inputs it measures. Incident deadlines, the integrity of the audit trail, administrator MFA, asset criticality and TLS are measured on your install. Other inputs, such as signed updates and hardened images, are properties of the product and score the same on every install. The page and its help used to call all of them live signals. The scores themselves have not changed. The help now lists all six rows that do not respond to anything you do, not three.
• Incident lists fetch timelines in one go. The incident page and the AI's incident matching fetched each incident's timeline with a separate database query. They now fetch all of a list's timelines with one.
• Status emails use the Public App URL. Settings > General says this address is used in outbound notification links, but nothing read it. Status page confirmation emails now build their links from it, and banner update emails link the status page when it is set. Without it, the confirmation link follows the address the admin was using, and now keeps https when the console is served over https.
• About page support links work. The Docs and Status page links pointed at addresses that do not exist, and Release notes opened a page customers cannot see. Docs now opens the built-in Help centre, Release notes opens the release history, the same page as "All releases" under Settings > Updates, and the Status page link is shown only when one is configured.
• The licence key no longer shows in the host's process list. The installer and Apply Update passed the licence key on a command line while they contacted the licence server, where any user of the host could see it. Both now pass it in a way other users cannot read, including when you install with the ATLASEYE_LICENSE_KEY environment variable. Apply Update works this way from the update after this one. The installer change is in the installer you download from the licence portal.
• Special characters in database and Redis passwords work. A password you set yourself, for example for an external database or a managed Redis service, broke the connection when it contained characters such as @, /, #, ? or %. A % in the database password also stopped AtlasEye from starting and wrote the password into its log. If your installation ever failed to start this way, change that password. Passwords the installer generates were never affected.
• The AI chat header follows the interface language. A new, unsaved chat was titled "New Chat (v4.5)" in English whatever the interface language. It now shows the same text as the button that starts a new chat.
• The installer can ask for your licence key. Leave --license-key off the install command and the installer asks for the key without showing it on screen. A key on the command line can be read by other users of the host while the installation runs, and it stays in your shell history.
• The OpenSearch admin password no longer shows in the process list. Installation and offline updates check that the search service is ready by signing in as its administrator, and Apply Update does the same when it finds the service unhealthy. The password was part of that check's command line, so for a moment any user of the host could read it in the process list. It is now passed privately. Apply Update works this way from the update after this one.

• Online updates no longer leave old images taking up disk space. On a host whose Docker uses the containerd image store, the default for new installations of Docker 29 and later, each online update left some images on disk where Docker's own cleanup could not reach them. Updates now remove them, starting with the update after the one that installs this version. Images left behind earlier stay until removed with docker rmi, which refuses to remove an image that is still in use.
• Offline (air-gapped) updates keep your own HTTPS certificate. An offline update could replace the certificate you installed for the web interface with a self-signed one, so browsers could refuse to open it after the update. It now carries your certificate over to the new version.
• An offline update can be run again, and rolled back. Once an exporter had been registered, running an offline update script a second time in the same directory, which is how a rollback to the previous version works, stopped with "file-hash check FAILED". Rolling back to this version or a later one works again. Rolling back to an older version needs one extra step, described in section 6 of the air-gap guide, which also explains that a rollback cannot undo database changes: take a full backup before every update.
• Apply Update now keeps the service configuration up to date too. An update used to replace the program and its update scripts but leave the compose files, which define how each service starts, exactly as they were installed, so an improvement made there reached new installations only. Starting with the update after this one, Apply Update refreshes those files as well, just before it restarts the services, and a rollback puts the previous ones back. A service the update does not restart picks up its new configuration the next time it restarts. A file you changed yourself is never overwritten: the update log names it, and the one command that takes the new version when you are ready.
• Full backups now include the SSH host keys AtlasEye has learned for your devices. By default AtlasEye remembers the key each device presents the first time it connects over SSH, and refuses the device if that key later changes. Full backups did not include those keys, so a server restored onto new hardware recognised no device and, by default, trusted whatever key each one presented next. Restoring a full backup now brings the keys back without replacing any key the server already knows. An entry that cannot be read is skipped, and a problem while putting the keys back never stops the rest of the restore. A backup whose key list is implausibly large (over 16 MiB), or that claims keys it does not contain, is refused before anything is changed. Backups taken before this update contain no keys, so take a new full backup once the update is installed.
• The AI assistant no longer overlooks full backups. When it looked up the backups itself instead of reading them off the page, it counted only database-only backups, so it could say that no backups exist, and it described backups as leaving out syslog data and uploaded files. It now counts full backups too and lists what they contain. Asked about a backup you selected, it says what a full backup restores, and no longer names a database or a format that the backup does not record.
• A backup file that cannot be opened is now refused with a clear message. Restoring a damaged file, or one that is not an AtlasEye backup, failed with a server error saying that uploaded files, SSH host keys and syslog data might be partially restored, although nothing had been touched. The restore now says that the file cannot be read and that nothing was changed.
• New installations and offline updates no longer keep old AtlasEye images out of reach of the image cleanup. They kept an extra name on the AtlasEye images they set up, and the regular image cleanup cannot remove an image that still has a name, so some of those images stayed on disk for good, and every offline (air-gapped) update left the previous version's complete set. The extra name is now removed as soon as the image is in place, so the image cleanup can reclaim the old images. A new installation made with the online installer still keeps the installer's own image, about 65 MB, until that installer is updated. Installations made before this release keep the images already there.
• The security documentation now describes backup protection accurately. It said backups could optionally be encrypted, and that only the AtlasEye service could read backup files. AtlasEye does not encrypt backups, and the files are stored with standard file permissions. If your policy requires encrypted backups, encrypt the storage that holds them, or encrypt each copy before it leaves the server.

• Restoring a full backup now works on servers updated with Apply Update. On a server updated to 1.2.335 in place, a full restore was refused with "the bundle's search snapshot cannot be staged" -- safely, nothing was changed. The server now prepares the folder the restore needs every time it starts. If the message ever appears again, restarting the api container (docker restart atlaseye-api) clears it.
• The database copy saved before each update is now private to root. Before every update, AtlasEye saves a copy of its database on the server's disk so it can roll back. Any user account on the server could read that copy. It now sits in a folder only root can open, together with the copies earlier updates left behind. This takes effect from the update after this one; to close the existing copies right away, run sudo chmod 700 /opt/atlaseye/backups/pre-update (default install folder).

• A 0 in the syslog rate-limit settings no longer silently turns ingestion off -- or the limit off. Setting the messages-per-window to 0 used to drop every incoming syslog message, and setting the window to 0 used to let everything through unlimited. Values that cannot work are now ignored the same way as a typo: the built-in default is used instead, a warning names the variable, and the Settings page reports the number actually in force.
• A backup that was interrupted no longer blocks every later one. If the server was restarted or the container killed while a backup or a restore was running, the next attempt was refused with "a backup job is already running" -- for up to six hours, with nothing actually running. The lock now clears within seconds of the interruption, and a long healthy backup still holds it for as long as it needs.
• A restore now refuses an incomplete backup file before it touches your data. A bundle missing part of its contents used to be detected only after the database had already been replaced, leaving the message "restore failed" over data that was gone. The file is now checked first: if it cannot be restored completely, nothing is changed at all.
• Restoring a full backup now brings back your syslog search data. Since full backups were introduced in version 1.1.49, a full restore replaced the database and then stopped with an error before any syslog search data came back. The restore now checks that the backup's search data can be read before it changes anything, waits until every search index has been rebuilt, reports a clear error if the rebuild stops making progress, and leaves every syslog index open for new messages afterwards.
• The scheduled nightly backup no longer collides with one you started yourself. The two ran in separate processes and could both dump the database at the same time. The scheduled run now stands aside and reports that a backup was already in progress.
• The application stays responsive while a backup runs. A backup of a large database used to stall every other request for its whole duration, which also made the system look unhealthy to the monitoring checks.
• A half-written backup file is never listed as a usable backup. If a backup was interrupted, the partial file could appear in the list as if it were complete. Backups are now only listed once they are fully written, and leftovers from an interrupted run are cleaned up.
• Uploading a backup is more reliable. A large upload no longer makes the application unresponsive while it arrives, and an interrupted upload no longer leaves a broken backup in the list. A full backup uploaded under a name that is already in the list used to be saved under a name the list did not recognise, so it never appeared; it now appears as <name>_upload_<date>_<time>.tar.gz.
• The audit trail no longer reports tampering that never happened. If a request reached the system from an IPv6 address written in an unusual but perfectly valid way, the address was written to the audit log in one form and recorded in another, and the integrity check compares the two. A single such request made the check fail -- and kept it failing, because the log is append-only and the entry cannot be rewritten. The compliance page then showed the audit chain as broken with no way to clear it. Addresses are now recorded in the one form the database itself uses, verified against the database, so the check only fires when something really is wrong.
• A bad address in an IPAM form now tells you which field is wrong. Pasting a prefix where an address belongs, a network with host bits still set (the 10.0.0.5/24 you get from an interface listing), or an address with an interface suffix (fe80::1%eth0, the form Windows and Linux print for a link-local address) used to return a server error with nothing to act on. You now get the field name and, for a network, the address range that was probably meant. This covers IP records, ranges, gateways, DNS servers and every address field on a NAT rule.
• A CSV import no longer stops halfway on an error page. A row the database could not accept used to end the whole import -- with the rows before it already saved and no report of which ones. Every row is now reported individually, and re-importing the same file skips what is already there.
• A mistyped number in the syslog collector's .env no longer stops log collection. Writing 60s where a number of seconds belongs, 200x in a rate-limit setting, or leaving a value blank used to stop the collector from starting at all -- and because the allow-list, rate-limit and timezone sync share one setting as their fallback, a single typo there stopped all three. Meanwhile the Settings page went on showing the built-in default as though it were in use. Each value now falls back to its built-in default and says so in the log.
• The syslog rate limit now shows the setting that is actually in force. Syslog -> Settings -> Ingestion Rate Limit could display Enforce while nothing was being dropped, or Monitor while the limit was live -- and in that second case, saving an unrelated change on the same panel quietly turned enforcement off. Both sides now read the setting the same way, and the poll interval documented in .env.example finally takes effect.

• The syslog ingestion rate limit moved into the app. How many messages a single source may send per window — and whether the excess is dropped or only logged — used to live in the collector's environment file and needed a restart to change. It is now a panel under Syslog → Settings, takes effect within about a minute without restarting anything, and has a "Reset to env default" button that hands control back to the file. Monitor mode accepts every message and only records the breaches, so you can size the limit on real traffic before enforcing it.

• Correction: do not rotate MONITORING_CREDENTIALS_KEY. Earlier documentation said rotating this key re-encrypts your stored secrets. It does not. There is no previous-key fallback, so every SNMP/SSH device credential, TOTP secret, OIDC client secret and alerting channel password saved under the old key stops being readable, and the affected features fail quietly as though no credential were set. If you must change the key, plan to re-enter every stored secret by hand afterwards. The admin guide now says this.

• If an update fails, the automatic rollback now either works completely or changes nothing at all. Until now the rollback replayed your pre-update database snapshot statement by statement. If anything went wrong halfway — most often because the failed update had already added a new table — it stopped in the middle, leaving a database that was part old, part new and missing some of the constraints that keep your data consistent, while telling you to recover it by hand. A damaged backup file was worse still: it could be applied silently up to the point where it ran out, and you would be told the restore had failed without being told that most of your data had already been replaced. The rollback now checks the snapshot is readable before touching anything, and applies it as a single all-or-nothing step. If it cannot finish, your database is exactly as it was and the message says so.

• Restoring a backup now tells you what it will take away. The confirmation box used to say only that existing data would be overwritten. It now says there is no undo, that the database is put back to the backup — everything recorded since it was taken is deleted, not merged — that a full bundle also writes its uploaded files over the current ones (files you added since are kept) and replaces the syslog indices from the backup's snapshot, and that a backup older than your running version leaves the database schema behind the software until the pending updates are applied. If a restore fails, the message now says what is actually true: the database was not changed, while files and syslog indices from a full bundle may be partly restored. The same facts are in the in-app help and the FAQ, in all seven languages — several of these warnings were still English-only in Arabic and Portuguese.

• Restoring a backup is now all-or-nothing, and it really puts the database back to the backup. A restore used to replay the backup over your current database one statement at a time. Anything created since the backup was taken — a table a later update added, for example — stayed behind, so the result was a mixture rather than the database you backed up; and if the replay stopped half way, that half stayed too, while the screen told you nothing had changed. A restore now resets the database to exactly what the backup holds and applies it as one step: either all of it lands, or none of it does and your data is untouched. It also refuses, with an explanation and before changing anything, a file that is not a full backup of this product, and a database it cannot safely reset — one with extra schemas, or with database extensions installed. Two things to plan for: the restore holds the database to itself while it runs (seconds to a few minutes here), and a backup older than your running version still leaves the database structure behind the software until the pending updates are applied.

• An audit or sign-in record is no longer at risk when the API cannot determine who the request came from. In that case the address field is now left blank instead of being filled with a placeholder the database rejects. Everything else in the record — the account, the action, the time, the browser — is stored as before, tamper-evidence included, and a request whose address is known still records it. Nothing changes for a normal deployment behind the bundled web server, where the address is always known; this closes the case where it is not.

• A server missing its database tools no longer tells you your backup is gone. If postgresql-client was not installed, the Backups page answered a restore with "Backup not found" while the file was sitting in the backup folder. It now says the restore failed and the database was not changed, which is what happened, and the server log names the missing tool.

• The Audit Log shows names again. A page of audit entries that happened to include an alert came back empty of names — not just for that entry, for every entry on the page. Fixed.

• The About page reports how many log messages arrived in the last 24 hours. It had been showing a dash on every install. A dash now means only what it should: the search backend could not be reached. A real zero shows as zero.

• Locked out by human verification? There is a door. If Cloudflare Turnstile cannot be reached, nobody can sign in — including the administrator who would switch it off, because that setting is behind the sign-in page. An administrator with server access can now run docker compose exec -T api python -m app.scripts.turnstile off, sign in, and switch it back on from Settings afterwards; the keys stay stored, so nothing has to be re-entered. See the admin guide.

• Maintenance mode from the server console works. The commands the admin guide gives for "when the interface is unavailable" stopped before doing anything. They run now.

• Human verification no longer blocks sign-in when it is not actually on. With verification switched on but no site key saved, the sign-in page showed an empty box, no message, and refused the button — even though the server was not checking at all. The page now follows what the server enforces.

• Human verification can no longer be switched off by whoever is signing in. Verification used to be skipped for visitors whose address was localhost, which sounds local but was taken from the request itself — so anyone on the internet could claim it and face no check at all. Account lockout still applied, so this was never a way into a specific account, but it did let automated sign-in attempts run unchallenged across many accounts. The skip is gone, along with its switch in Settings → Security. Locked out with no way to reach Settings? The way back in is the server command in the admin guide, not a browser on localhost.

• The Turnstile break-glass tells you the truth on an environment-configured install. If verification was configured through environment variables rather than the Settings page, …python -m app.scripts.turnstile status reported it as switched off with no keys — while it was live and refusing every sign-in. It now reports what the server actually applies, and says whether that came from the environment or from a change saved in Settings. Switching it off always worked.

• Incidents and Alerts open even when one record is odd. A single record carrying a status or severity the system no longer recognises — the sort of thing a restored backup leaves behind — used to blank the whole list with a server error. The list now opens, that record still appears with its original value shown as-is, and you can add notes to it. Nothing is silently rewritten.

• An odd record cannot be filed with a national CSIRT. Keeping those lists open means the system has to show the record using a stand-in value. That is fine on screen, where you can see the original beside it — it is not fine on an NIS2 Article 23 report, which is signed and sent to a regulator. Exporting or emailing a report for such a record now stops with a message naming the field and the value it holds, so you repair the record first instead of filing a substitute under your signature.

• The Alerts list loads in one request instead of one per row. Opening a page of alerts asked the AI service separately about every row to find out which ones already had a triage. It now asks once for the whole page, so the list settles faster and the browser console stays clean.

• Status words appear in your language, not in English capitals. Tags such as ACTIVE, RESOLVED or UNKNOWN were shown exactly as the server sends them, uppercased — which does nothing in Persian or Arabic and mangles German. About twenty places across Inventory, Alerts, Incidents, Identity, Monitoring and Services now show the translated word, and where a value has to stay verbatim it no longer flips direction inside a right-to-left sentence.

• Missing translations show real text. The disk-pressure banner's "Free up space" link, the AI assistant's welcome line and around forty other labels were showing English — or, in one case, an internal error string — in every language. They are translated now, and a new check refuses to let a label ship with no translation behind it.

• Long addresses stay inside their own column. In Syslog -> Analytics an IPv6 address in Source IPs used to spill across Last Seen, and narrowing the column made it worse. Addresses now wrap onto another line and the row grows to fit. Every table whose columns you can drag behaves this way, not only that one.

• Column layout and page size now work on every table, not just some. Drag a column wider, reorder columns, choose how many rows to show — on DNS, Services, Settings, Identity, Web Analytics, Inventory, Operations and AI, the same way the monitoring and syslog tables already worked. Your choices are remembered per table.

• The rows-per-page control does what it says. On several pages it moved but the table kept its old size, and on others it was missing from lists that grow. Both are fixed, and a short list simply shows no pager.
• The alert bell no longer blanks the page, and no longer misses an alert. Two independent requests feed the bell — the count and the list — and whichever arrives first used to decide the outcome. A partial reply could take the whole page to white, and a critical alert whose row arrived after its count was counted but never announced. Both are fixed.
• Lists no longer strand you past the last page. Acknowledge or resolve the last alert or incident on the last page and the list now steps back a page instead of showing an empty table with no way out.
• The incidents badge and the list behind it now agree. A device's incident badge counts everything that is not closed, but clicking through showed only the ones still marked open — so a badge of 7 could open onto "No incidents". The list now opens on Active (not closed).
• Brute-force counts say when there are more. The detector looks at a fixed number of source addresses per run. When that limit is actually reached, the count is marked as a floor — and when it is not, it no longer claims to be. An attack that a louder one pushes out of the list for a single run keeps its alert open instead of being marked resolved while it is still running.
• The Analytics export says how many source addresses a pattern really had. The table shows five and "+N more"; the CSV now carries that total too, instead of reading as though five was the whole story.
• More of the interface speaks your language. Threat severity, the severity matrix headers, the coordinated-attackers table, the dashboard uptime status, the IP-ranges column header and the Port Forwards empty state stayed in English whichever language you picked. So did the Delete Selected button and the "Order updated" message on the IP ranges, port forwards and NAT rules pages. They are translated now, in all seven.

• Every syslog table now resizes and reorders its columns, not just Pattern Detection. Brute Force, Port Scan, Privilege Escalation, the coordinated attackers list, the four Settings lists (allowlist, source timezones, alert rules, watch patterns) and the index browser all behave the same way: drag a header edge to set a width (or focus it and use the arrow keys, double-click to reset), drag a header to move the column, and find it that way next time you open the page. The lists that can grow past a screenful also let you pick how many rows to show at a time.
• A table too wide for its panel can now be made to fit. On the threat tables the Action column falls off the right edge when the window is narrow; drag the other headers narrower and all seven columns fit, and it stays that way next time.

• The activity heatmap stays inside its panel. On narrower screens the day-by-hour grid used to spill out over the Top Countries list, with the part that escaped impossible to scroll back to. It now sizes itself to the panel at any window width.
• Pattern Detection columns can be resized and reordered. Drag the edge of a column header to set its width (or focus it and use the arrow keys; double-click resets it), drag a header to move the column, and the layout is remembered the next time you open the page. The table also gained the rows-per-page selector, and the Last Seen column no longer overlaps the source IP tags.

• The closed "IPs excluded" bar is easy to bring back. Closing it now leaves a small orange number where the bar was — click it and the bar is back. Before this, closing it and then removing and re-adding the same IP left you with no way to reopen it.

• One filter bar on the Analytics page, not two. The bar used to break into a second row on anything but a very wide screen, and that second row looked like a toolbar of its own. Time range and search now stay in view, the rest of the filters live behind a More filters button that shows how many are active, and share link and the two exports moved into the ⋯ menu next to them.

• One scrollbar on the syslog pages, not two. On a short window the Explorer, Analytics, Security and Settings pages could show two scrollbars at once, and dragging the wrong one moved nothing you were looking at. Those pages now scroll as one page. The World Map still fills the window as before, and the Analytics filter bar still stays pinned to the top while you scroll.

• The Security page now offers the same time ranges as Analytics. It was limited to 24H, 7D and 30D; 1H and 6H are there now, so you can narrow a security review to the last hour the same way you already could on Analytics. Security still opens on 7D and Analytics on 24H.

• Syslog pages stay usable on a short screen. With a licence warning and a disk warning open on a 1280x620 window, the Analytics and Security panels were squeezed to a strip and the cards inside them were cut off mid-row. The panels now stop shrinking at a readable height and the page scrolls instead, so the warnings move out of the way rather than crushing the content. The stray horizontal scrollbar under those panels is gone.
• The World Map looks the same on every monitor. The "top countries" list, the hover card and the live feed could lose their top edge on a shorter screen — they were sized to a fixed height regardless of how tall the map was. They now fit the map and scroll when there is more to show.
• The "IPs excluded from all views" bar can be closed. Click the x and it stays closed; it comes back on its own whenever the excluded list changes. The full list is always in Syslog & Security → Security Settings.

• Syslog and Topology now fill their frame properly. Every page under Syslog & Security — Explorer, Analytics, Security — and the Topology map sized their panel against a fixed guess at how much space the header, footer and banners take. The guess was a little wrong normally and badly wrong when the "IPs excluded from all views" notice wrapped onto several lines or the window was short: the panel ran past the white card it sits on, part of it was cut off, and a second scrollbar appeared inside the page. The panels now take whatever height is actually left, so they fit at any window size and with any number of excluded IPs.
• The Topology map no longer starts pushed out of view when it is empty. On a map with no nodes yet, the "no nodes yet" message and the map canvas were stacked one below the other instead of the message sitting on top of the canvas.

• Wildcard certificates now read correctly, in your language. The DNS-01 wildcard feature has worked since 1.2.252, but the certificate panel still told you wildcards "need DNS-01 (a later phase)" and the whole DNS-01 dialog appeared in English no matter which language you had chosen. The panel now points you at the DNS-01 wildcard button next to it, and the dialog is translated into all seven languages.
• DNS-01 wildcards are in the Help centre. The feature list under Service Manager now includes wildcard / multi-domain certificates over Cloudflare DNS-01, and the dialog itself carries a help icon explaining that the certificate is issued centrally in AtlasEye -- your Cloudflare token never reaches the managed server -- and renewed centrally too.
• Both certificate tables gained the column picker. The certbot certificate list and the centrally-managed wildcard list now let you choose, reorder and resize columns like every other table in the product, and remember your choice.

• Save your own set-up as a template and reuse it on the next site. If your servers follow more than one convention, the built-in standard only covers one of them. Fill the New vhost form the way you want it, press "Save as template" and give it a name; next time, pick it from "Use a saved template" and the form fills itself in. Server names are never part of a template, and the log file paths follow the site you are creating rather than the one you saved from. Templates are shared across your whole install and are administrator-only, both to use and to manage -- they can hold internal addresses. Saving under a name you have already used replaces that template.

• Logs from each site now arrive under their own name. Until now every virtual host forwarded its logs under the same two names, so Syslog Explorer showed one pile for the whole server. Each site now gets its own tag, built from its first server name -- shop.example.com becomes shop_example_com_access and shop_example_com_error -- so you can filter to a single site. A catch-all server keeps the old names, so filters you already have keep working.

• One click sets a new site up the way your servers are meant to look. The New vhost wizard has an "Apply standard settings" button: it fills in the log format and the per-domain log files, the upload size limit, WebSocket support and proxy timeouts, compression, security headers and log forwarding. Add your collector address and the site is ready to preview. A new "Log format" field lets you name a format your server already defines.

• Disable now works on Red Hat-style servers too. Hosts that keep their virtual hosts in conf.d have no symlink to switch off, so Disable used to report that the action was not available there. It now parks the site's file instead, and Enable brings it back exactly as before -- the site stays in the list the whole time. On the rare server that loads every file in the directory, AtlasEye says so up front instead of reporting a site as off while it is still being served.

• The "disabled" list in Service Manager now only lists real, disabled sites. Backup copies, include fragments, and sites whose enabled link is named differently from the file were all being shown as parked servers, and a site that was live could also appear a second time in the disabled list. The list now shows exactly the sites that exist and are switched off.
• The host refreshes itself after every change. After AtlasEye applied a config change the panel kept showing the configuration the host had before the change, and the only cure was the Rescan button. A host is now re-read automatically right after any change AtlasEye applies to it, and the background scan runs hourly instead of every six hours, so a hand-edit made outside AtlasEye shows up within the hour instead of up to half a day later. An open host panel picks up the newer scan on its own. Rescan still works -- it is now only for forcing an immediate refresh.

• Component versions in the machine-readable inventory were wrong for five packages. Each AtlasEye service publishes the list of open-source components it ships, which auditors and vulnerability scanners read directly. Where two services shipped different versions of the same component, the inventory reported one version for both -- so a scanner was pointed at a version that service does not run. The list now reports each service's own versions, and a check compares it against the pinned dependency files on every build. No component changed; what changed is that the document now says what is actually installed.

• Two shipped components were held back from security updates by our own version limits. The updater — the component that installs every other update — was held to a web framework old enough to have seven published advisories against it, and the optional on-host Service Manager agent to a cryptography library with seven of its own. Neither was waiting on anything upstream; both fixes had been available for some time. Both now install current versions, and the dependency scan that should have surfaced this covers every component we ship rather than three of the six.

If you run the on-host agent, note that it now needs Python 3.9 or newer on the managed host. The installer checks and stops with a clear message before it changes anything, so an older host fails safely rather than half-way through. Ubuntu 20.04's default Python 3.8 is below that line.

• Every service image is now built from a verified dependency set. The images were previously assembled from version ranges, so the exact third-party code inside one depended on what the public package index served the day it was built — and a compromised or typosquatted release would have been accepted silently. Each service now builds from a locked list that names an exact version and a cryptographic checksum for every package it pulls in, directly or indirectly, and the build refuses anything that does not match. This does not change how AtlasEye behaves; it closes the last step in the chain from our source to your host that could not be checked. The update manifest was already signed and the images already pinned by digest, so what you receive can now be verified end to end.

No customer-facing changes in this release.

• A brand-new install no longer stalls with "opensearch is unhealthy". The installer started the whole stack before it prepared the search node's security configuration, so the services that wait for search to be ready never came up and the install stopped partway — with no way back except starting it again. The search node is now prepared — and given time to report itself ready — before the rest of the stack starts. Updates repair it the same way, air-gap and online alike: a host installed while this was broken is fixed by its next update instead of having that update rolled back.

• Installs and updates survive a dropped image download. A single truncated layer used to end a connected install outright, and the only way back was to download the installer again and start over. Image pulls now retry before giving up, on both the install and the Apply Update path.

• A failed download now tells you which registry to look at. Any pull failure used to blame your licence credential, even when the image came from a public registry that needs no credential at all — sending you to the portal when the real problem was your host's outbound network.

Changed

• The last two layers that were re-downloading on every update now stay put. The previous release stopped the large dependency layer from being fetched again each time. Two smaller layers inside the component that performs the update were still doing it — about 49 MB between them — because an unrelated step was giving them a new identity on every build. They now keep the same identity until their contents actually change. As before, your next update fetches them once and the ones after that skip them.

Changed

• Updates download less. The product ships as container images built in layers, and the layer that holds the Python dependencies — roughly 58 MB of every update — was being given a new identity on every release even when not a single dependency had changed. Your server therefore downloaded it again each time. That layer now keeps the same identity until the dependencies themselves change, so the copy already on your server is reused instead of re-fetched. The next update still fetches it once; the ones after that skip it.

Fixed

• An update no longer reports failure when it could not replace the maintenance scripts on your server. Refreshing those scripts is the last step of an update, and it is meant to warn and move on — by that point the new version is already running and has passed its health check. On a server where the install directory is not writable by the account the product runs as, that step stopped the update instead, so the log ended in an error even though the upgrade itself had succeeded. It now names how many files it could not replace and what to change, and finishes normally.

Fixed

• Applying an update now really does refresh the maintenance scripts on your server. That is meant to be the last step of every update, so each update leaves your server ready to run the next one. It has been failing since it was introduced: a cleanup step earlier in the same update removed the files it needed, and the step ended with a warning in the log. Your updates were never affected — but the scripts on disk stayed as they were, so improvements to the update process itself never reached you. They will from now on.

• An update now tells you if the maintenance scripts on your server could not be replaced. Applying an update refreshes those scripts as its last step. When the install directory is not writable — which happens when it was put in place by a different account than the one that installed the product — the update log now names how many files were left untouched and what to change, instead of finishing quietly. The update itself was never affected either way.

Changed

• A housekeeping release. Nothing changes in how the product runs. The notes shown under Settings → Updates have been tidied so that every release describes what changed for you, in the words you would use for it.

• Pinned the licence-server private registry to an image digest. The tag was floating, so a docker compose up could have swapped registry 2.8.x for a major on top of ~61G of published release blobs.
• Older installations now catch up on their own. An installation running a version from before 1.2.314 could not receive improvements to the update process itself — the part that needed fixing was the part that does the delivering. Applying an update now repairs that automatically: the first update brings the installation back in step, and every update after it behaves normally. Nothing to run by hand, and nothing to configure. The Help note on the Updates page has been corrected to match, in all seven languages. Only an installation older than 1.2.295 still needs the one manual step.

Added

• The Updates guide now explains how an update refreshes its own scripts. Help → Updates describes what happens at the end of a successful update: AtlasEye refreshes the maintenance scripts on your server from the signed installer it downloaded with that release, so the next Apply update runs the update and rollback scripts belonging to the version you just installed, and the job log reports how many files were replaced. It also explains the line saying the scripts on the server were left as they were — that is a warning, not a failed update — and that a server installed before this behaviour existed needs those scripts delivered by hand once, after which it keeps them current on its own.

Added

• Running a slow AI model? Give it more time. Settings → AI has a new Response Timeout field — 10 to 600 seconds, 90 by default. Raise it when you point AtlasEye at a large self-hosted model that takes minutes to answer; Test Connection and every AI feature honour the same budget, so a slow model no longer looks like a provider that is down.

Fixed

• Updates download a lot less. The api image was carrying a few hundred megabytes of build-time leftovers that were never needed to run anything. They are gone, so Apply Update pulls a substantially smaller image and finishes sooner — particularly noticeable on a slow or metered link. Nothing about how the product runs changes.

• Apply Update now keeps its own machinery current. Until now an update refreshed the product but not the update script itself, which lives on your host — so improvements to the updater (including the checks that verify a release is genuinely ours before installing it) only reached a machine if someone copied a file onto it by hand. From this release forward Apply Update brings its own scripts along, verified against the same signature as the rest of the release, and only after the new version has proven healthy. Nothing to do on your side, and nothing changes if a release ever arrives without them — the update proceeds exactly as before.

• Devices kept being checked late, and the alert mail blamed the wrong thing. A single slow maintenance task inside the monitoring worker — most often the Syslog AI scan waiting on an unreachable AI provider — held up device checks behind it and made the worker look dead to every health check at once. Mail kept arriving every few minutes for as long as the provider stayed down. Maintenance tasks now run alongside device checks instead of in front of them, so a slow external service no longer delays monitoring at all, and one that is genuinely stuck raises a single accurate alert instead of a flood about a scheduler that was never down.
• A broken integration now names itself in the alert. When a maintenance task keeps failing — the AI provider, Cloudflare, GoDaddy, mail or log search — you get one warning naming that task, rather than having to work back from a scheduler alert. For the AI tasks, Settings → AI → Test Connection reports exactly why the provider is refusing.
• A broken AI provider no longer retries in a loop. Requests to the AI provider now honour the timeout as a total, rather than quietly trying three times, and a failed scan waits before trying again instead of retrying on every tick.

Fixed

• Licence problems now say what they are. When the licence server turned down a check-in, the red banner pointed you at Settings → Licensing, and that page showed a bare error code — the same code whether the licence had expired, had been revoked, or was simply registered to a different machine. The reason is now printed under Last Heartbeat, in the licence server's own words, so you can act on it without opening a support ticket. Visible to administrators only.
• Offline (air-gapped) installation now completes. On a server with no internet access, the installer loaded the shipped images but failed to label them, then reported success and moved on — and the stack could not start because it was looking for labels that were never applied. It also did not carry one small helper image that OpenSearch waits for, and asked for several images in a form an offline server cannot match. All three are fixed, and a labelling failure now stops the install with the real reason instead of continuing quietly.
• Apply Update no longer risks an unnecessary database restore on offline installs. The update ran the stack with a different configuration than the installer had used, so it looked for storage volumes that do not exist on a customer server. The update then failed and rolled the database back to the pre-update snapshot — losing anything written since — for an update that had changed nothing. The update now uses exactly the configuration the server was installed with.
• Automatic recovery after a failed update actually runs now. If an update did not come up healthy, the recovery step could not find the server's configuration and stopped with a misleading message about the database being down. It now finds it, so a failed update puts the previous version back as intended.
• Settings → Storage → Prune works. The cleanup helper was missing from the installed folder, so the button failed immediately.
• Apply Update now works on a freshly installed server. On installations created from the downloadable installer, the update script was missing from the installed folder, so Settings → Updates failed immediately when you clicked Apply Update. The installer now includes it — along with the recovery script that puts the previous version back if an update does not come up healthy. This lands in the installer, so it fixes new installations; a server installed earlier still needs that one file placed in its install folder — contact support and we will send the exact command.
• Offline installer downloads ship with their signature again. The checksum file inside the offline bundle could be published unsigned even when the release itself was fully signed. It is now signed on every build, so an air-gapped installation can prove the bundle it received is the one we produced.
• Updating an offline (air-gapped) server works, and can no longer wipe it. The update script stopped and asked for a settings file that a new update package can never contain, and the manual it pointed to suggested re-running the installer instead — which generates brand-new passwords and keys over your live data. That combination cost you the database password, the stored device credentials and the licence link, with no way back. The update now finds your previous installation by itself and carries your own settings, certificates and monitoring targets across, so you unpack the new package and run the update. Re-running the installer over an existing installation is refused outright, and the web certificate is re-issued during the update so the interface always comes back on https.
• Automatic recovery after a failed update no longer risks your data. The recovery step restored the database snapshot before checking that the previous version's software was still on the server — so it could leave you with old data and nothing to run it. It now verifies everything it needs first and stops with a clear message if anything is missing, and a restore that hits an error stops there instead of reporting success half-finished. A healthy update is also no longer rolled back because of a harmless timing overlap while the database was being upgraded.
• Full backups on production servers now include the log archive. The backup was quietly written without its syslog section. Existing backups are still valid for everything else they contain; new ones are complete.
• Settings → Storage → Prune protects the recovery images. The safety check that stops a cleanup while an update is running could never trigger, and the cleanup could remove exactly the images needed to undo a failed update. Both are fixed.

Fixed

• The alert bell's panel now matches your theme. In the light theme it kept a dark background while the rest of the page was white, leaving its text almost invisible. It now takes its background, border and dividers from whichever theme you have selected.
• The live event stream stays readable when you narrow it. Dragging the event rail smaller used to squeeze its address, process and host columns down to nothing. It now hands back one column at a time as it narrows — host first, then process — so what is left is always wide enough to read. Hovering a row still shows every field and the log line itself.
• Status tags and the alert count are readable in both themes. The pale green, cyan, orange and gold tags used a text colour barely darker than their own background — the "success" tag was the worst of them — and the red count badge on the bell was too light for the white number on it. Every one of them now steps to the next tone in the same colour family, far enough to be read without changing which colour it is. The network intelligence score and the daily briefing headline take the same treatment.
• The sidebar no longer squeezes the product name next to its own logo. The name was printed a second time beside a logo that already spells it out, with no room left for it — a sliver of unreadable text against the logo plate. The logo now stands alone, as the preview in Settings always showed it, and screen readers announce your organisation's name (or the product name) from the logo itself.
• The option you already picked is now the easiest to read, not the hardest. In any menu that marks your current choice — the sidebar appearance picker, for one — the ticked line was painted a pale blue on a pale blue highlight, and it got worse when you pointed at it. It now uses a tone deep enough to read in either theme, hovered or not. The sidebar appearance swatches are also bigger and each shows its highlight colour, so the six themes are no longer six almost identical dark squares.
• Search results stay inside the search box. Pressing Ctrl-K and typing used to drop a list that hung below the search panel and covered the line telling you which keys to press. The results are part of the panel now: it grows as matches appear, scrolls when there are many, and the keyboard hint stays visible. Arrow keys, Enter and Esc work as before, and a search that finds nothing now says so.
• The dashboard fits on a phone again. The System Overview panels were wider than the screen and dragged the whole page sideways with them. They now stay within the screen and the container table scrolls inside its own panel. The AI Predictions buttons, which sat off the right edge, drop onto their own line.
• The security score read backwards in Persian and Arabic. 65 /100 came out as 100/ 65, and the devices-online count had the same problem. Numbers now read left-to-right in every language, as numbers do.
• Switching language left the globe's tooltips in the old one. The hints on the globe's arcs kept the language they were first drawn in until new events arrived. They now change with the switcher.
• The page you are on is now readable in the pager. The highlighted page number under every table sat just above a third of the required contrast in the dark theme and below it in the light one. Both themes now clear WCAG AA.
• Counts read as sentences again. The alert bell announced "2 active alert" and the licence banner warned about "0 day(s)". Both now use the right plural form in all seven languages.
• A screen reader can name the AI button. The floating assistant button on every page had no name of its own and was read out as just "button". It now announces as "AI Assistant".
• The Quick Insights card no longer has a hole in it. It was being stretched to match the taller Recent Activity card next to it, leaving a large empty gap between the counters and the links at the bottom. It is now as tall as what it contains.

Fixed

• Typing the plain address now opens the Dashboard. Visiting the site root showed a "Page not found" page instead of the app, so a bookmark to the bare domain was a dead end. It goes straight to the Dashboard now, and the Back button does not bounce you into it.
• The "Page not found" page's two buttons work again. On a short window the artwork pushed "Return to Dashboard" and "Go back" half off the bottom of the page area, where clicking them did nothing. The page is more compact now, so both buttons are fully on screen.
• Recent Activity on the Dashboard reads as English again. Some entries — a discovery run, an agent enrolment — showed an internal code such as audit.actions.discover where the action should be. Every entry now shows a readable action, including ones added by future updates.
• The Threat badge in the header can be read again. Its "THREAT" label was almost black on the dark header, and in the light theme the score, the status word and the ring around them were all too pale to make out. All of them now follow the theme.
• Network Intelligence stops disagreeing with itself. When the AI model is unavailable the panel writes its own summary, and that summary could say "0 warnings" directly above three warning cards — it was counting devices in a warning state while the cards below listed metric alerts. The summary now says which of the two it means, and tells you when it is showing only the first few of many alerts.
• The Command Center tiles look like one set again. The uptime tiles were drawn in a different card style from the gauge tiles sitting next to them in the same row. They all share one style now.
• Percent gauges no longer show the same number twice. Every CPU, memory and storage gauge repeated its value under the dial, sometimes with a different number of decimals — 0% above 0.0%. The dial keeps the reading and the duplicate line is gone, on the Dashboard and on a device's Metrics tab. Bandwidth tiles are unchanged: their second line is a different figure, not a repeat.
• You can see which device a pinned tile belongs to. Titles such as CPU Usage (NextCloud-White… were cut off exactly where the device name starts. The device name now sits on its own line under the metric name, and hovering the title still shows the whole thing.
• Faint text and links are readable again in the dark theme. The small grey lines under card figures, the blue links, the alert count badge and the keyboard "Skip to main content" link were all too low-contrast to meet the accessibility standard the rest of the product is built to — links even faded almost to the background when you pointed at them. All four are corrected, and the light theme's faint text, which had the same problem on a white card, is darkened with them.
• The light theme's faint text and links were checked too. They had the same fault — grey labels, timestamps and table headers that were tuned for a dark card but painted on a white one, and links that faded rather than darkened on hover. Both are corrected to the same standard.
• On a phone, card titles no longer collide with their action links. On a 390px screen "Live network activity" and "Open full map" ran together into one unreadable line. Card headers now keep a gap, and on narrow screens the action moves to its own line.
• A dashboard headline number no longer splits across two lines. On a narrow phone "19 / 19" broke apart, leaving the second half next to the label where it read as a different figure. The number and its total now stay together.
• The AI feedback panel now says when there is nothing to show. Before anyone had rated an AI insight it displayed a row of empty score cards, which read as a fault. It now explains that no insight has been rated yet and how to change that.
• "Syslog & Security" now fits in the sidebar. The menu was a few pixels too narrow and cut the last word short. The sidebar is slightly wider.
• Screen readers can navigate the dashboard by heading. The page had no main heading and its sections were marked up at inconsistent levels. It now starts with a proper page title and every section sits at the same level beneath it. Nothing looks different.
• The alert bell now has a name, and the help ⓘ is easier to hit. The bell and its acknowledge button read as just "button" to a screen reader, and the help icon was only as big as the glyph itself. Both are fixed without moving anything on screen.
• Jump straight to a Dashboard section instead of scrolling. The page is about eighteen screens long, and reaching the bottom half meant scrolling past everything above it. The toolbar now stays with you as you scroll and has a Jump to section menu listing your sections, in your order, minus the ones you have hidden.

Changed

• Pausing the Dashboard event stream now says what it pauses. The button holds the event list still and nothing else — the globe, the counters and the freshness dot keep running, which is deliberate but looked like a pause that had not worked. A paused list now shows a small "list only" marker next to the button, and hovering it spells the scope out.

Fixed

• The AI Health panel on the dashboard could fail to load. On a system where the AI features had been idle for the whole reporting window, the panel errored instead of showing "no data yet". It now shows the placeholder.
• The dashboard's live event stream is readable. In the fullscreen view the stream sat in a rail too narrow for its own columns, so addresses and hostnames were cut to 2001… and clou…. The rail is wider now, hovering any shortened cell shows the whole value, and the narrow marker column that only exists for AI-flagged addresses disappears when there is nothing to flag — which also closes the odd gap between the flag and the IP.
• Dragging the stream taller shows more events. It used to keep showing twelve and add empty space below them.
• Better for screen readers, and quieter if you asked for less motion. Each row is now announced with its time, severity, address, country, process and host instead of twelve identical "Open Syslog viewer" rows, and the rows stop sliding in when your system is set to reduce motion.
• The severity tag now says which level, not which colour group. Syslog has eight severity levels and the tag only has five colours, so an emergency and a merely critical event both read crit, and a debug line read info just like a real notice. Each level now has its own short word, and hovering the tag spells the level out in full.
• "No ASN data" no longer covers for a lookup that never happened. On the World Map, an address whose owner lookup failed or was rate-limited was shown as having no network data at all — telling you an ordinary address belongs to nobody. It now says the lookup is unavailable, and tries again next time you hover.

Added

• You can pause the dashboard event stream to read a row. Pause holds the list still — and only the list. Events keep arriving, the globe and the counters keep moving, and the live dot beside the heading keeps telling you the truth about your feed, so a pause can never be mistaken for a network that went quiet. A badge shows how many events came in while you were reading; if more than the stream keeps in memory arrived, it says 200+ rather than a number we cannot stand behind. Press play to catch up.
• Hover an address in the dashboard stream to see whose network it is. The same owner lookup the World Map has always had, now on the event rows: hold the cursor over a source address and it names the network and its number, with the full address spelled out above — useful when the column is too narrow to show all of it. Clicking still opens the Syslog viewer filtered to that address.
• A stream row now tells you what happened. It could say which machine, which program and how serious — but not what the log actually said, which usually meant opening the Explorer to find out. Hover a row and you get the line itself, shortened to fit; screen readers hear it as part of the row. The full message still lives in the Syslog Explorer. On plans without Syslog the line is not sent at all — the rows read exactly as they did before.
• One noisy machine no longer takes over the stream. A host repeating the same line hundreds of times used to fill the whole panel, hiding everything else that happened. Identical events that arrive back to back are now shown as a single row with a ×N count; hover it to see when the run started. They are only merged when they match completely — same source, same machine, same program, same severity and the same log line — so two different events from one address are never presented as a repeat, and on plans where the line is not sent nothing is merged at all. Your events-per-minute figure, the globe and the pause counter still count every event individually.

Security

• Updates now prove where they came from before installing. AtlasEye already signed every release; the updater on your server now checks that signature itself, before it reads anything else from the update — including which version to install and which registry to fetch it from. It then downloads each image by its exact content fingerprint rather than by name, so what lands on your server is byte-for-byte what we published. If any of that fails, nothing is installed and your running system is left untouched.

Alongside it: updates are refused over an unencrypted connection to the licence server, and an update that is older than what you already run is rejected — that is what a replayed update looks like. Going back a version deliberately still works through the documented rollback procedure.

You do not need to do anything. If your server sits behind a proxy that rewrites the licence-server address to http://, point it at https:// before your next update.

Added

• AtlasEye now checks its own code before it starts. Every release is signed, and on start-up the application verifies that the code on disk is exactly the code we shipped. If anything has been modified — by faulty storage, a partial update, or someone tampering with the installation — AtlasEye stops serving instead of running altered code, and shows a clear page explaining why, with a support code to quote when you contact us. It keeps its health and metrics endpoints answering so your monitoring can see the state, and it never silently "half works".

There is no bypass code, by design — a code that unlocks a modified installation would be a back door. Recovery is reinstalling a clean copy or re-applying the update. If you ever need to bring a locked installation back up while we investigate, support will walk you through the documented recovery setting. - Installing and updating now fail loudly on a bad copy. The offline installer and the in-app updater both detect this state and stop with the support code, instead of finishing with "AtlasEye is up" on an installation that will refuse every request.

Changed

• The core licensing and alerting logic now ships compiled rather than as readable source. No behaviour or configuration changes for you — the product runs exactly as before.

Fixed

• A failed update no longer rolls itself back because a backing service was briefly slow. The post-update check now asks "is AtlasEye up?" rather than "is every component perfectly healthy?", which is what caused several updates to install and then undo themselves.
• Updates apply the correct configuration on standard installations. On some installs the updater used a fallback configuration that could leave the application running from the wrong files.

Fixed

• Notification channel passwords were staying unencrypted in the database. The routine that encrypts saved SMTP passwords and Telegram bot tokens failed on its first record on every start-up, and it failed quietly, so nothing told you it had happened. It now runs to completion; your existing channels are encrypted on the next restart, no action needed.
• A start-up step that failed could leave half-finished changes behind. Each start-up step is now undone cleanly if it fails, instead of its partial work being saved by the next one.
• A malformed licence response could switch every paid feature off. If the licence server sent the feature list in the wrong format, the system read it as "no features" and denied DNS, Registrar, Service Manager and Web Analytics with no warning — possibly hours after a successful activation. It now ignores the bad value and falls back to what your plan includes.
• "Service degraded" on the login page, and maintenance-mode redirects that never restored themselves. A missing database column made the scheduled task that lifts an expired temporary redirect fail on every run, which in turn held the whole system at "degraded". The update now repairs the database automatically; installs that were never affected are untouched.
• Single sign-on could fail with a server error, and an incident could be visible to the wrong people. Two stored settings were read without checking their shape first: one made every SSO login fail with a server error — as well as the settings page you would use to fix it — and the other could show an incident for device 12 to someone allowed to see only devices 1 or 2. Both are now validated before use.

Security

• The AI assistant could reveal a webhook's credentials. Asking the assistant to list your notification channels sent the webhook URL and any custom headers — both of which act as passwords — to the AI provider in full. They are now hidden there, hidden in the admin screens, and stored encrypted like the other channel secrets. Existing webhook URLs are encrypted automatically on the next restart.

Fixed

• Updates would install and then undo themselves. Since 1.2.301 the post-update health check reported a problem that wasn't there, so the updater concluded the new version had failed and restored the previous one — including the database snapshot it takes before starting. The result was an update that appeared to run, then left you on the old version with the Updates page still offering it. Fixed at the source, and the check itself now asks a narrower question: can the application serve requests? Things like the search engine or the license server still being warmed up no longer count as a failed update — they are reported as a note instead, and you can see which one in the System Health panel in the top bar.
• Search, the syslog World Map and Web Analytics were affected by the same fault on 1.2.301 and later, and work again.
• Installing an update no longer signs you out. If the reply to a session renewal was lost while the web front door restarted, your browser was left holding a session the server had already retired and you landed back on the login page. A short grace window now hands the browser the session it was supposed to receive.
• Two-factor codes are accepted first time. Entering a correct code and seeing Invalid verification code — then having to wait for a new one — happened when the first attempt actually succeeded but its reply never arrived; re-sending the same code looked like a replay. A repeat of a code that was just accepted now signs you in, and no longer counts against the lockout threshold. Pressing Verify twice while the server is slow is now handled too, and signing out always wins over a repeat — a code re-sent after you have logged out will not let anyone back in.
• "Login failed" no longer appears for a login that worked. If the reply to the sign-in never reached the browser, you were shown a failure and then found yourself already signed in on the next page load. The sign-in page now checks once whether the session was created and continues instead of showing the error. A wrong username or password is still reported as before.
• Pinning an update to a specific version now does what it says. Asking to install a particular version installed whatever the channel offered instead, while the update record still named the version you asked for. Mismatches now stop the update rather than quietly substituting.

Fixed

• Installing an update no longer shows a gateway error page. The web front door was being restarted at the same moment as the application behind it, so for a few seconds nothing answered at all and — if AtlasEye sits behind a CDN or reverse proxy — visitors saw that system's error page instead of ours. The front door is now restarted last, once the new application is already up, so the interruption is a couple of seconds rather than the length of the whole update. Applies to both in-app updates and offline bundle updates.

Fixed

• Installing an update no longer signs you out. If your session happened to renew itself during the few seconds the update restarts the server, the renewal was lost but the old session had already been retired — so the next click dropped you at the login page. The renewal is now retired only once the new one has actually reached your browser, so you stay signed in through an update.
• Pages stop getting stuck on the error screen after an update. A tab left open across an update was still asking for the previous build's files, and when they were gone the page showed "Something went wrong" until you refreshed by hand — the World Map was the usual victim. The page now notices and reloads itself once onto the new version.
• "Reload page" on the error screen actually reloads. It used to try to redraw the broken page in place, which for the most common cause changed nothing.
• The dashboard status pill no longer softens during a real outage. When the server stayed unreachable for more than one check, the pill dropped from red "Unavailable" to amber "Needs Attention" — the longer the outage, the calmer it looked. It now only ever gets more severe, never less.

Security

• Security threats now reach you when nobody is looking at the screen. A source that stays above the detection minimums in two consecutive background checks opens a normal alert — it appears in the bell, you can acknowledge and resolve it, and it is recorded in the audit log — and it closes itself when the source goes quiet. Until now a threat existed only while someone had the Analytics page open. Kept deliberately calm: only a handful of new alerts per check, never a critical one (these are keyword detectors, not verdicts), and privilege-escalation matches stay out of it. Switch it off in Analytics → Thresholds.
• The threat list stops calling ordinary admin work an attack. A single sudo and a single refused connection each counted as a security threat, so the Security Threats card was mostly routine operations. The minimums are higher now, and the "high"/"critical" labels move with them instead of being fixed below the minimum, where everything was high.
• One threat list for the whole team. The detection minimums used to be saved in each operator's browser, so two people comparing the same time window could see two different threat lists with no way to tell why. They are now a server setting: full admins change it, the change is recorded in the audit log, and everyone reads the same list. The panel saves when you close it.

Added

• The dashboard now shows you which IPs the AI wrote about. The AI scan has always named specific source IPs in its findings, but the dashboard dropped them on the way to the screen, so you had to read a finding and then hunt for that IP in the live stream yourself. Now a small robot mark appears next to those IPs in the event stream and their line on the globe is drawn heavier; hover either one and it tells you which finding named it. It is labelled as the model's opinion rather than a detector verdict, because that is what it is — a lead worth a look, not a confirmed attack. Nothing extra is fetched to do this.
• The World Map can point at the attackers. Until now the map coloured purely by how severe the log line was, and an attack rarely announces itself that way — a port scan usually logs "connection refused", which is a routine green dot. A new shield button in the toolbar marks the source IPs the brute-force and port-scan detectors already flagged: their map cells get a ring, the live feed and the country drawer say which kind next to the IP, and flagged IPs are shown first in those lists instead of being pushed out by a chatty but harmless host. The colours you already know stay exactly as they are. It is off until you turn it on, and the badge on the button tells you how many IPs were flagged in the window you are looking at.
• The World Map without a mouse. Every bubble is now a real control: Tab moves between them, Enter or Space opens the one in focus, and each one tells a screen reader its country, its event count and its worst severity. The zoom buttons, which used to be announced as just "button", are labelled.
• The globe responds to touch. On a phone, a tablet or a touch-screen wallboard the globe now rotates by dragging and zooms by pinching. Until now it answered only to a mouse, so on those screens it could not be turned at all.
• Send someone the map you are looking at. The whole view — time window, severity, host and process filters, IP and CIDR lists, colour mode, flat or globe, where it is centred and how far it is zoomed, and which panels are open — now lives in the address bar. Copy the link from the toolbar and the person who opens it sees your picture, not the default one. The same view can be saved under a name and reopened from the toolbar whenever you want it back.
• The map's IP panel now shows the risk profile too. Opening an address on the map used to stop at WHOIS, while the same address in Log Analytics showed its risk score, when it was first and last seen, how long it has been active, what it was seen doing and its activity by day and hour. Both panels now show the same thing.
• Click an arc on the dashboard globe to investigate it. It opens the World Map already filtered to that source address — or to its country, when the event does not carry an address — so a spike on the wallboard is one click from the logs behind it. The pop-up says so before you click.
• The map says what it is showing. The toolbar has a help icon covering every control, and the legend now explains bubble size: it is a square-root scale, so a bubble that looks twice as wide carries about four times the events, and the biggest ones are capped so a single loud region cannot swallow the map.
• You can now be paged when syslog goes quiet. Every metric the collector published counted a failure — drops, spool pressure, queue depth — so an input that simply stopped left the whole board green and there was no way to write an alert for it. The collector now also publishes how many messages it accepted, how GeoIP enrichment is going (resolved, cached, not in the database, no public address, or off entirely), and whether a GeoIP database is loaded and how old it is — until now nothing checked that, so the map could have been attributing traffic with a two-year-old database and never said so. Three alerts ship with it: nothing received for 30 minutes, no GeoIP database loaded, and a database older than 30 days. Packets refused by the source allowlist are counted separately, so "senders are being turned away" is distinguishable from "nobody is sending" — and a hardened deployment no longer pages about routine rejections.

Fixed

• WHOIS results now explain themselves in your language. When a WHOIS lookup returned nothing — because the address is private or reserved, or because the registry did not answer — some screens showed an English sentence regardless of the language you use, and one showed the registry's own raw error text. Every surface that reports a WHOIS result (World Map, Log Explorer, Tools, Login Events) now says the same thing in your language.
• The location shown for an IP now says it is approximate. The coordinate in the IP drawer is the average of every place that address was seen, read from a city-level database. It was printed to eleven metres, which read like a street address; it is now shown to about a kilometre with a "≈" and a short explanation on hover. "Show on World Map" is unchanged.
• An AI finding that could not be sent no longer silences the next check. If something went wrong while building or sending the alert for a critical AI finding, the finding still appeared on screen — but the notification was never attempted and the next analysis was skipped for the full interval, so the problem looked handled. The scan now counts as done only once the alert has actually gone out; if it could not, the next analysis runs sooner and the reason is written to the log in full.
• An odd value in one field no longer loses the whole log line. A device reporting an unusually long hostname or process name, or a nonsense process id, could make the log store refuse the entire message — and because that refusal is not an error the collector can retry, the line was simply gone. Those values are now trimmed or left out on their own, and the log line is kept and stays searchable. Existing logs get the same protection, not just the ones arriving from tomorrow.
• When part of the log store cannot answer, the map says so instead of showing you a smaller number. A search whose storage is partly unavailable still comes back marked "success", just with fewer events in it — so a quiet hour on the map, a drop in the counts, or a threat that seemed to stop could all be storage trouble rather than reality. The map now shows an Incomplete results chip whenever that happens, and the background checks that open, close or silence alerts skip that round and try again on the next one. An attack can no longer be marked resolved because the part of the log store holding its events was down.
• Hiding an IP now hides it on every screen, including the ones already open. The excluded-IP list was read once per page load, so an address you suppressed today was still on the map, the globe and the risk gauge of any browser that had been left open — a wallboard never saw the change at all. Every surface now shares one list that refreshes every five minutes while the tab is on screen.
• Two people editing the excluded-IP list no longer erase each other. Saving used to send the whole list as the page last saw it, so a save from a page opened an hour earlier quietly deleted every address added since. Entries are added and removed one at a time now, and a mistyped address is rejected instead of being stored forever as an exclusion that matches nothing.
• The dashboard globe no longer freezes as a black square. If the browser dropped the globe's 3D graphics — waking from sleep, a graphics driver reset, too many 3D tabs — it stayed black until you reloaded the page. It now tells you what happened, notes that the data behind it is unaffected, and offers a "Redraw the globe" button. Opening the fullscreen globe also stops the one behind it from drawing, which it used to keep doing invisibly.
• Clicking two countries quickly shows the one you clicked last. A slow reply could arrive after you had moved on and overwrite the drawer you were reading. The IP registration panel also states which address it describes, and the "could not load map data" message now disappears with the map instead of following you to the next page.
• The dashboard's severity chart was missing the two worst severities. It listed six of the eight severity levels by name, so Emergency and Alert never appeared — an hour of nothing but emergencies drew an empty chart. Every severity present is shown now, worst first, and the bars no longer reshuffle under your cursor as traffic shifts between refreshes.
• Severity names are translated everywhere they appear. The Log Explorer's badge, filter and CSV export, the World Map's bars, and the analytics tables each carried their own English list; they all read from one table now, so a Portuguese or Persian install sees Portuguese or Persian severity names on every screen — and the colour of a bar can no longer disagree with the map marker it explains.
• A cluster of places with no severity data no longer looks healthy. When none of the events behind a merged map bubble reported a severity, the bubble was drawn green as if everything were fine. It is grey now — "no severity data", which is what the legend always said grey meant.
• A device sitting in the wrong timezone is finally named — and the dashboard now says which way each clock is wrong. The clock-skew warning only knew about devices whose timestamps were so far off that they had to be corrected on arrival, so the everyday case — a router set to the wrong timezone, out by a few hours — never appeared at all. Those devices are now listed, each row says whether the clock runs ahead or behind, and the wording no longer claims a slow clock is sending timestamps from the future. The Dashboard help explains which timestamps get replaced with their arrival time and which are kept exactly as sent. New devices show up from the next daily log rollover on.
• The World Map's event count is now the real one. The headline total, the countries panel, the CSV export and the AI summary were adding up only the top 50 places on the map, so everything past that simply did not exist in the numbers. The total is now the true one, and anything outside the top 50 is shown as its own "elsewhere" line rather than quietly dropped.
• "All" and an unconfirmed custom range no longer sweep your whole log history. Both used to search every day the system has ever stored, which on a busy install is slow enough to look broken. They are capped at the last 30 days, the two presets are marked ⚠, and the tooltip says so.
• A device with a badly wrong clock can no longer take the log store down. Because a log's own date decides which daily bucket it is filed under, one sender stamping 1970 could create thousands of buckets and eventually stop the system from creating any more — for every feature, not just syslog. Anything older than 90 days is now filed at arrival time and flagged, so it still shows up in the clock-skew panel that tells you which device to fix. Operators importing an old archive on purpose can raise the limit.
• You can find a quiet host in the map's filters again. The host and process pickers only ever listed the busiest few, with nothing to say so — a device sending ten lines a day was unreachable. Type in either box and it now searches every host or process, IP prefixes included ("10.20." finds the whole range), and the list says "Top 30 of 214 by volume". If the list fails to load it now says so instead of looking empty.
• A zoomed-in flat map stays smooth. It was drawing every marker in the world even when only a corner of it was on screen.
• Dragging the timeline no longer pulls in events from outside the range you picked. The first and last steps could reach up to a day either side of the window — noticeable on a custom range, where they showed data you had deliberately excluded.
• The World Map costs the same whether one person or a whole NOC is watching it. Every open live feed used to run its own search against the log store every 1.5 seconds, so a wallboard plus four operators multiplied the load by five for the same data. Views that ask for the same thing now share one search, and the map is no more work for the log store than a single viewer ever was. Nothing gets any staler than before.
• A very fine timeline step no longer fails the whole chart. Asking for one-second detail over a month meant millions of steps and an error instead of a graph; the step now widens to fit the window so the chart always draws.
• A green "Live" no longer sits on top of a dead pipeline. The live badge on the dashboard header and on the World Map was reporting the connection, not the data — a stream that was connected but receiving nothing looked exactly like a healthy one, which is precisely what kept people from noticing that logging had stopped. Both now turn amber and say how long it has been: "No data · 12m". The age is measured from the newest event you are actually holding, so the background refresh re-sending the same window cannot make a blackout look fresh.
• The GeoIP database status and the clock-skew warning no longer vanish when things go wrong. Both were tucked inside the host-metrics block of the dashboard's System Overview, so if host metrics were unavailable they disappeared — at exactly the moment you want to know whether country attribution is running on a stale database or a device clock has drifted. They now show next to the "No host metrics" notice instead of behind it.
• The threat summary no longer claims the wrong time window. Scanning 90 days could still report "24 hours analysed", because the figure echoed a parameter that a custom date range overrides — which is what the World Map and the Analytics tab send every time you change the range. It now reports the window that was actually searched.
• A World Map left in a background tab stops working the search cluster. Its refresh kept firing three heavy queries every 30 seconds, and the live stream stayed open, behind another window or a locked screen all night. Both now pause when the tab is hidden and resume when you come back.
• The World Map can be read without colour vision. Its two scales — traffic volume and worst severity — used colour alone to say which of four levels a bubble was, and several of those levels are indistinguishable to a colour-blind operator. Each level now also has its own shape (circle, triangle, square, diamond) on the bubble and on the matching swatch in the legend, so the two can be matched by eye. The colours were re-picked at the same time: on the light theme several markers were nearly invisible against the map itself, worst of all "warning", and every colour now meets the contrast standard in both themes. Purely decorative pulsing was removed to keep the animation that carries meaning smooth, and a single noisy source can no longer fill every ping slot on the globe.
• The map now tells you what it cannot draw. Some addresses are known to belong to a country but have no coordinates, so no dot can exist for them. Until now those events simply disappeared from the map with nothing to say so. The map states the count next to the live indicator — hover it for the countries — and the events remain searchable in the log explorer as before.
• The security score no longer implies an AI verdict it never got. AI log analysis ships switched off, yet the score card showed a confident green 100 as if something had examined your logs. The card now says the score comes from the keyword detectors alone and where to switch AI analysis on, the scan-trend chart explains why it is empty, and the "no threats" banner names the three counters it ran and admits they only match log keywords. The score also uses the same detection minimums as the threat table underneath it, which could previously disagree with it after you raised a threshold.
• One severity colour, everywhere. The same log event could show up red on the World Map, amber on the dashboard globe and cyan in the live event list — three different answers to "how bad is this". Every surface now uses one scale: Critical red, Error orange, Warning amber, Normal green. An event whose sender never set a severity is grey "Unknown" instead of being painted as Normal green, which read as "all clear" for something nobody had judged.
• Country names follow your language. Country names were English almost everywhere in the product even with the interface set to another language. They now use the language you selected, and "Unknown" is translated too.
• The World Map's live feed speaks your language. The feed title, its sound and pause buttons, the event ages and the AI analysis error were English regardless of your setting; the pause button was untranslated in five of the seven languages.
• The activity sparkline no longer says "Now" when it means six hours ago. Its right edge is the last hour that actually contained logs, and it now shows that timestamp — a sender that went quiet no longer looks current.
• Reduce motion is respected. If your operating system asks for reduced motion, the globes stop rotating on their own, and the map's pings, expanding rings, flowing traffic lines and pulsing rows hold still. Every marker, arc and colour stays exactly where it was — only the movement stops.
• A severity filter now means the same thing everywhere. On the World Map, picking "Warning" always meant "Warning and worse". In the Syslog Explorer it meant "Warning exactly" — so clicking a red spot on the map to see its logs hid the critical events the map had just counted. Both now mean "this level and everything more severe", the way journalctl -p does, and the Explorer's picker says so.
• The World Map no longer traps you in history. Scrubbing the timeline to a quiet minute with no events removed the bar with the "Back to live" button, and the only way out was to reload the page.
• Zooming the World Map behaves. Deep zoom used to inflate the dots and their labels until they covered the map, and clicking a cluster threw away your zoom level and snapped back to 2×. Dots, labels and lines now keep their size, and a cluster click zooms in from where you actually are.
• The hover panel's status chip is readable. In its cyan, amber and green states the label was white on a light background and effectively invisible.
• A burst of events from one sender is no longer counted as one event. Syslog timestamps have no fractions of a second, and the live feed treated "same sender, same second" as the same line. So exactly when a source got loud — a password-guessing run, a port scan — the feed showed one line instead of ten, the dashboard's events-per-minute under-reported it, and the critical-event sound played once and then went quiet because everything after it looked like a repeat. Every line now arrives with its own identity.
• The GeoIP backfill tool works, and against the right database. The command in its own instructions could not run, because the script was left out of the container image. It also always used the database bundled with the product, even where automatic GeoIP updates keep a newer one — so re-processed history could be located with out-of-date data. Both fixed, and a re-processed line whose IP was found in the message text (rather than in a proper field) is now marked as the lower-confidence guess it is, the same way live traffic is.

Fixed

• A wrong SSH key passphrase now says so. Roughly one attempt in fifty reported "unsupported or invalid private key" instead of a passphrase error, sending you off to check the key format when the key was fine.
• Turning syslog retention off now really turns it off. The Auto-lifecycle switch on Syslog → Security Settings → Retention Policy saved your choice but never told OpenSearch: with the switch showing Off, indices were still being deleted on the last window you had saved. Logs you meant to keep were being thrown away by the control you used to stop it. Switching off now detaches the policy — nothing is deleted automatically, today's indices included — and switching it back on re-applies your window to the indices you already have, which it previously only did for indices created afterwards.
• A restart no longer resets your retention window. The log collector kept its own copy of the retention setting and re-applied it every time it started, so a deploy or a container restart could quietly overwrite the number of days you had saved. Retention now lives in one place, and AtlasEye re-applies your saved policy to the cluster on startup.
• "Off" no longer looks like "on". With retention off, the card used to still read "indices older than the retention period will be automatically deleted". It now says plainly that logs are kept forever and storage grows until the disk fills, so an unbounded install is a deliberate choice rather than a surprise. Saving with retention off also reports success instead of the old "ISM sync failed — will retry on next save" warning, which was never true.
• Turning AI off now turns all of it off. With Settings → AI set to disabled, the scheduled syslog security scan kept running: it was still sending log snippets to your provider and still spending tokens, because the off-switch was only checked by the pages you click. The switch is now enforced where the provider key is handed out, so every AI feature — scheduled ones included — stops. The same applies to licensing: an edition without the AI feature no longer reaches the syslog AI endpoints.
• Hiding a noisy IP no longer hides the attacks from it. Excluded IPs is a display filter for chatty or trusted hosts — but the scheduled AI security scan was also skipping those addresses, so the one thing an operator does to clean up a flooded log also switched off detection for the flooder. The scheduled scan now ignores the exclusion list entirely. To keep specific content away from the AI, use Syslog → AI Input Filter, which is the control meant for it.
• "Block" is now called "Mute", because it never blocked anything. The button in the log viewer and in AI findings added the address to the syslog display filter: its logs stopped appearing, and the traffic kept arriving exactly as before. Under a live attack that read as "the attacker is stopped". The buttons now say Mute and spell out what they do; the one in Analytics, which copies a firewall command to your clipboard for you to run on your own device, now says "Copy block rule". Blocking on a MikroTik device from the Security dashboard is unchanged.
• You can now see when a source IP was taken from the message text. Some senders write an address inside the log line, and anyone can write anything there. Open a log and SOURCE IP carries a "sender-asserted" or "guessed" chip when the address did not come from the connection itself — worth a look before you mute or block it.
• Maps no longer invent locations for an internal-only network. If all your senders use private (10.x, 192.168.x, 172.16.x) addresses there is no public location to plot — but the dashboard globe was stacking those events in the Gulf of Guinea as if they were real, and when it had nothing left to draw it reported "Quiet — no recent syslog activity" over a fully busy network. Both the globe and the World Map now say plainly that your traffic is internal and offer Top Talkers, which ranks senders by volume. The World Map also keeps its live event feed in that case instead of hiding it with the map, and the events/60s counter still counts internal traffic.
• Event totals above 10,000 are now real numbers. "Total Events", the severity percentages, Top Talkers shares and the per-IP drawer all stopped counting at 10,000 and showed that as the answer — so a busy day always read exactly 10,000, and shares computed from it could exceed 100 %.
• The World Map's attack lines recover on their own. A brief failure of the location lookup used to leave the lines missing for up to a day; it now retries within a minute.
• The AI "Analyze" button on the World Map is disabled when the map is empty, instead of paying for an analysis of no data.
• The AI data-sharing disclosure is more complete. Settings → AI now states that IP addresses (device and syslog sender) are part of what is sent to your configured provider. Nothing about what is sent changed — the description did.
• The dashboard globe no longer shows traffic that has stopped. Its "events / min" figure and its glowing arcs only updated when new events arrived, so on a quiet network both stayed frozen on the last busy minute — a wall-mounted dashboard could show a burst that had ended ten minutes earlier. Both now age on a clock: the count falls to zero and the arcs fade out when the traffic really stops.
• A log-store outage no longer looks like a calm network. If OpenSearch could not be queried, the World Map, the live feed, the country and IP drawers, Top Talkers, the clock-skew check and the anomaly list all answered as though there was simply nothing to report — an empty map is the same picture as a network at peace, and there was no way to tell which one you were looking at. They now report the failure, and the map says Could not load map data with a Try again button, keeping whatever it last drew on screen.
• The World Map now says where its traffic lines actually end. All the lines converge on one point, and that point is this AtlasEye collector — either the location you configured for it, or a geo-IP guess for its public address (your NAT or CDN edge), which the map now labels "approx.". It is never the device that logged the event, which is how a line landing on a city could be misread. If no location is known at all, the traffic-lines button is switched off and tells you what to set instead of turning on and drawing nothing.
• Two greyed-out buttons now explain themselves. Hovering the World Map's Analyze button while the map is empty (and the new traffic-lines button when it is unavailable) shows the reason; before, the explanation existed but never appeared.
• A typo in an IP filter is now rejected clearly. Entering something that is not an address in the World Map's include/exclude IP filters returns a plain "Invalid IP address" error naming the bad entry, instead of quietly showing you a map filtered on something other than what you typed.

Added

• You can now block an attacking source IP on a MikroTik router, from the Security page. Open Syslog → Security, find the address in Top Active Threats, click the red block icon, pick the router and how long the block should last (1 hour up to permanent). AtlasEye writes the blocklist entry and the firewall rules that actually drop the traffic.
• It tells you the truth about whether the traffic is really blocked. After writing the rules, AtlasEye reads the router back. If the address is on the blocklist but no active rule is dropping it, you get a warning saying exactly that instead of a green "blocked" — that state is the one where an address looks handled while its traffic keeps flowing.
• It will not lock you out. Blocking the router's own management address, or the address you are connected from, is refused before anything is sent to the device. Every block and unblock is recorded in the audit log, including the ones that fail, and the dialog lists what is currently blocked so you can lift a block one address at a time.
• Muting has not changed. Muting an IP still only hides its logs from the syslog views and blocks nothing; the new action is the one that touches your firewall. Available in all seven languages, with the Security guide in Help updated.
• Blocking is off until you switch it on. Because this is the one feature that drops real traffic on your router, updating AtlasEye does not arm it. A full admin turns it on under Syslog & Security → Security Settings → Block on device (firewall), ideally after trying a block on your own hardware first. While it is off the block button is disabled and says why, and the server refuses the request even if something else asks for it. Addresses you already blocked stay listed and can still be released, so switching it back off never leaves a block you cannot lift — and every time the switch is flipped it is recorded in the audit log.

Fixed

• The dates under a long metric chart no longer repeat. On a device's Metrics tab, picking a range of several days printed some dates twice ("07-22", "07-22") and put none of the marks on midnight, so a 14-day chart read as though a day had been duplicated or lost. The chart itself was always right — only the labels were. Dates now sit on midnight in your display timezone, one per day, and stay there across a daylight-saving change.

Fixed

• Metric thresholds now actually notify you. A crossed CPU, memory, disk or interface threshold raised an alert on the Alerts page and went no further — no email, no Telegram — even though the help text said your notification channels would be paged. They are now, through the same route device outages use, so your channel selection, the per-device alert switch, maintenance windows and the anti-spam cooldown all apply as expected. Recovery is announced too.
• A device with a failing service is no longer counted as offline. ⚠️ your availability figures will change — upward. A device that stayed reachable the whole time but had one failing connector or service was recorded as a full outage: its Availability dropped, its 24-hour bar went solid red, and the time appeared as billable downtime in the SLA report you hand to a customer. Those stretches are now marked degraded — amber on the bar, an amber tag in the Outages tab, still fully recorded — and only genuine unreachability counts against availability. Hover any tag to see whether that stretch was charged.
• Availability is no longer measured over time before the device was added. A device added two minutes ago showed "Availability (30d): 100%", and a device that had been offline for a week before you added it had that week credited as uptime. The window now starts at whichever is later: when you added the device, or when you last reset its baseline. When that is less than 30 days the tile says so ("measured over 6h") instead of implying a month of history, and the SLA report states the span it actually measured.
• The 24-hour status bar no longer claims uptime it can't prove. On a device that flaps a lot, the bar only received the most recent outages and painted every earlier hour solid green — the exact devices you open it for were the ones it lied about. Any stretch it has no record for is now drawn hatched and says "No data recorded", and an outage that began before the window but is still ongoing is shown instead of being dropped.
• The Outages tab shows your whole outage history. It used to receive only the newest 50 and page over those, so a device with hundreds of outages looked like it had two pages and its history just stopped. Paging now happens on the server, the total is the real total, and the table gained the same drag-to-reorder / resize column controls the rest of the product has.
• A failed interface scan now tells you why. "Failed to fetch interfaces" has been replaced by the actual reason (no connection configured, timeout, wrong community), cleaned of internal detail first.
• Finishing the discovery wizard on a hostname already in use now says so. It used to fail with an unexplained server error at the last step.
• Interface monitors are named in your language. A monitor added by an English session used to read "Interface ether1" for everyone, in every language, forever. Existing ones are relabelled too — and if you renamed one yourself, your name is kept.
• Outages that alerted but were never recorded. If a device had several services with long names, or an upstream error message was unusually long, the text no longer fit the field it was being saved into — and the database rejected the entire probe result. You got the notification, but the outage, the new status, the counters and the metrics for that round were all thrown away, every single round. Long text is now shortened with a trailing … instead of being rejected, so the record always lands.
• A healthy monitoring worker that reported itself dead. The worker only signalled "I'm alive" once per round, before it started probing. A single device with five service checks takes longer than the allowed silence, so Settings → Health showed the monitoring scheduler as stale on a system where nothing was actually wrong. The worker now signals while it works.
• Faster rounds on devices with many service checks. HTTP, HTTPS and TCP checks now run side by side instead of one after another. SNMP interface checks stay sequential — they log into the device, and network gear rejects many logins at once.
• A probe interval of 0 no longer switches monitoring off without telling you. It was accepted, and the device then sat in the list looking monitored while nothing ever probed it again. Probe interval, timeout and the up/down/warn counts now have enforced limits, in the wizard and in the API, and existing devices with an impossible value are repaired on update.
• Re-checking services by hand now uses the same connection the scheduler uses, so a manual re-check can no longer disagree with the automatic one. One failing check also no longer stops the remaining ones.
• Deactivated connections are no longer deleted behind your back. Simply opening a device — or any page that read one — could permanently remove its deactivated connections, credentials included, with no way to get them back. They now stay exactly where you left them, and remain hidden from the device view as before.
• Deactivating a connection now really stops it being used. Interface discovery and the live-interface list kept signing in to the device with a connection you had switched off. They no longer do.
• Editing a device no longer weakens its SNMPv3 security. Renaming a device or changing its port used to clear the authentication and privacy protocols, which either broke polling with no visible reason or continued polling unencrypted. Fields you don't touch are now left alone; clearing them on purpose still works.
• Un-ticking an interface no longer erases its link speed. The speed you entered (and the pin, and the custom polling interval) is kept, so ticking the interface again restores utilisation percentages and thresholds instead of starting from scratch.
• Abandoned half-finished devices are cleaned up again. The clean-up had silently done nothing for a long time; abandoned drafts piled up and kept their hostname reserved, so re-adding the same device failed with a duplicate error.
• Traffic figures are correct on gigabit links. The standard SNMP traffic counter overflows every ~34 seconds on a busy 1 Gb/s port, so between two polls it could have gone round more than once — throughput came out far too low, and occasionally absurdly high. AtlasEye now reads the device's 64-bit counters when it has them, which no realistic link can overflow. Devices whose SNMP agent is too old to offer them keep working exactly as before.
• A 30-day graph now covers 30 days. Wide time ranges returned only the most recent samples and drew a flat line for everything older, which reads as "this link carried no traffic". Long ranges are now averaged into intervals on the server so the whole period is shown; short ranges still use the raw measurements, so short spikes stay sharp.
• A break in monitoring is drawn as a break. The graph spaced every point evenly regardless of when it was taken, so a two-hour gap looked like the next normal reading and an outage could pass unnoticed. Time is now drawn to scale, and the graph always covers the range you asked for — if the device stopped reporting halfway through, you see the empty stretch.
• Zoom lands where you dragged it. Outside UTC, dragging across a traffic graph zoomed to the wrong window — 3.5 hours off in Tehran, so the spike you were pointing at disappeared. It now zooms to exactly the stretch you selected.
• Threshold rules can only be built on metrics the device actually collects. The metric list offered entries no device ever records, so a rule could be saved, shown as enabled, and never fire — with nothing to indicate it. The list now offers only the metrics that device samples, saving an unknown one tells you which key was rejected, and existing rules that can never fire are kept but tagged never fires so you can see and fix them.
• The web terminal works over HTTPS again. On a secure (TLS) deployment the terminal sat on "connecting" and never opened a session, because the front end was not passing the terminal's connection through. It is now.
• Old outages are cleaned up again. As soon as any outage had an AI analysis attached to it, the automatic clean-up of long-resolved outages stopped running entirely — and nothing said so.
• Pasting into the terminal no longer cuts text off. A long paste — a firewall rule, a config block — could arrive truncated mid-line on the remote shell.
• A wrong device password no longer signs you out. Entering credentials the device rejected logged you out of AtlasEye and sent you back to the login page. It now simply tells you the device refused them.
• The terminal still opens when the pop-out is blocked. With a pop-up blocker in the way, the inline fallback appeared but stayed blank.
• Many open terminals no longer slow down the rest of the system.
• Setting up container monitoring is recorded in the audit log. Installing cAdvisor on a device over SSH now shows who ran it, on which device and whether it worked. The SSH password is never recorded.
• SSH and diagnostics can no longer be reached through a device's name. A user restricted to specific devices could open a terminal on — or ping — a different machine whose address merely appeared inside a granted device's name. Access is now matched on the device itself, not on text in its name.
• The Containers tab can no longer be tricked into showing the AtlasEye server's own containers. A crafted request could make any device look like the machine AtlasEye runs on.
• The device page is fully translated. The big status word at the top — UP, DOWN, DEGRADED — stayed English in every language, right next to a legend that translated the same words correctly. That, the severity tags in Thresholds, the interface labels in Services and the "Never" / "5m ago" / "Retry" wording are now translated in all seven languages, and a test keeps them from drifting apart again.
• Links to a device tab now work both ways. Opening Outages and pressing refresh sent you back to Metrics, and a link you pasted into a ticket always opened the first tab. The address bar now follows the tab you are on (and Back leaves the page instead of walking through the tabs). A link pointing at a tab that no longer exists opens the first tab instead of an empty panel.
• The 24-hour status bar can be read by a screen reader, and no longer flips end-for-end in Persian and Arabic — where "−24h" was labelling the most recent end of the bar. It also stopped relying on colour alone: down stretches are striped as well as red, and a legend underneath finally says which colour is which.
• Every device tab now tells you when it could not load. Outages, Services, Containers and Thresholds each showed an empty table when the request failed, which reads as "nothing to see here" — the Containers tab went further and offered to install monitoring on a machine that already had it. Each shows an error with a Retry button instead. The Services tab also stopped stacking a new error pop-up every ten seconds.
• Services, Containers and Thresholds gained the standard table controls. Drag to reorder, resize, and choose the page size — remembered per table, the same as everywhere else in the product.
• The device page follows the dark/light theme everywhere, no longer double-indents on a phone, and prints as a clean report: the menu, header and buttons are left out and rows are not split across pages.
• A half-finished device from the wizard is no longer reachable by URL. It was hidden from the device list but still opened a full detail page — empty charts, no connector, and an availability figure it had no data for.
• Pinning a metric or setting a link's capacity is now recorded in the audit log, with who changed it and from what. It was the only device setting that changed silently, and it decides what every utilisation percentage means.
• The Outages tab loads faster. Marking which outages already have an AI analysis took one request per row — fifty for a full page. It now takes one.
• An outage explained while AI was switched off can be re-analysed. Those rows get a short rule-based explanation; once AI is configured, the Re-analyse button stays available on them instead of leaving that text in place forever.
• One slow device can no longer starve the others. A device with many failing service checks, or one still carrying a very large probe timeout from before the limits were added, could occupy a monitoring slot for hours. Each device probe now has a time limit (MONITORING_PROBE_DEADLINE_SECONDS, default 5 minutes); if it is hit, that cycle is dropped and retried.
• A device with only an SSH connector is no longer marked down. SSH connectors (added by container auto-setup, or by the syslog helper) cannot be probed, but monitoring judged the device on one anyway — it went to warning every cycle and then to DOWN, permanently, with the host perfectly reachable. Such devices are now judged on ping and their service checks. If a device also has an SNMP connector, that one is used for metrics again.
• An incomplete SNMPv3 setup now tells you what is wrong. Choosing an authentication or encryption protocol and leaving its password empty used to poll the device with neither — the connector card still showed SHA-256, and the device either looked unreachable for no stated reason or was monitored unencrypted without anyone knowing. Saving such a connector is now refused, and the connector test names the missing piece.
• Editing a connector no longer touches a different one. A device onboarded with a ping check plus SNMP has two connectors, and editing one could rewrite the other — the edit form could even open the ping connector for an SNMP-monitored device and save SNMP settings onto it. The edit now always lands on the connector you opened; changing the type adds a connector and retires the old one instead of overwriting it.
• Devices monitored over SNMPv1 probe faster. Every poll spent extra time asking for 64-bit interface counters that SNMPv1 cannot carry, and waited out the timeout before falling back. Those devices now go straight to the counters they do have.
• SNMP community strings are hidden while you type them. Both device wizards showed the community in plain text, unlike every other credential on the same form — it is the SNMP credential, and the server has always stored it encrypted. Browsers also no longer offer your saved website logins into device credential fields, or offer to remember device credentials.
• A failed TCP check tells you what went wrong. Every failure used to read "Port Closed (Err: 111)" — the same message whether the service was down, the host unreachable, the route missing, or a firewall silently rejecting you, each of which needs a different fix. The Services tab now names the cause: connection refused, host unreachable, network unreachable, timed out, reset by peer, or blocked by a firewall.
• The connector help now lists the connectors you can actually pick. It offered "HTTP" and "TCP" as connector types — those are service checks, set up on the Services tab — while leaving out Proxmox VE, Prometheus/node_exporter and ICMP, which the Add Device wizard does offer. The glossary also claimed a device has exactly one active connector; it can have several, and guided onboarding gives every host it creates an ICMP check next to SNMP. Corrected in all seven languages. The SNMP and MikroTik RouterOS API connectors also now appear in the feature list and the Help centre, where they were missing.
• A failed web-terminal connection no longer leaves anything behind. Each refused or timed-out attempt used to leak its connection thread, so repeated retries against an unreachable host slowly grew the server's footprint until the next restart.
• The Add Device wizard and the SSH terminal now work with a screen reader. Moving between the wizard's steps used to be announced as nothing at all — the panel simply changed on screen. It now reads "Step 3 of 7: Connector", and each step's fields are grouped under that step's name. The terminal box is named, and losing or regaining the connection is announced instead of being shown only by the colour of a small dot.
• The Services tab now says what it actually does. The "TLS not verified" warning appears whenever a check really does speak TLS without checking the certificate — including an HTTP check whose target is a full https:// URL, which used to show nothing. Changing a check's type no longer leaves the old target behind, so a TCP check stops displaying the web path it no longer uses. The list refreshes every ten seconds without flashing grey while you read it. And two tooltips were simply wrong: interface monitors also work over the MikroTik RouterOS API, the interface list is the one you already selected for metrics (down links included), and marking a check "critical" changes what the outage record says, not how fast the device is marked down — a failing check degrades and then downs the device on the same probe counts either way.
• A device page you are not looking at stops asking the server for updates. Leaving a device tab open in the background used to cost about 8,600 requests a day, per tab, per operator, to redraw a page nobody could see. It now pauses while the tab is hidden and refreshes the instant you come back, so you never return to stale numbers.
• The device page no longer redraws itself every second. Keeping the "last seen 5 minutes ago" line current used to re-render the whole page — charts included — once a second. Only that line ticks now, so the page is quieter and the charts stay put.
• The Outages and Containers lists stop flashing grey while you read them. Their background refresh (every 30 and 10 seconds) dimmed the rows and, for that moment, ignored clicks on them. The refresh is silent now — the rows stay readable and clickable.
• A device's status is now readable, not just coloured. The status word, the availability percentage and the CPU/memory/storage numbers on the device header were painted in the same bright green and amber used for chart fills, which on a white card is close to unreadable — the "up" or "degraded" word was the faintest text on the page. They now use darker, high-contrast tones in light mode and the bright ones in dark mode, and the colours themselves are unchanged on the rings, icons and 24-hour bar, so nothing looks different at a glance. A stale gauge tile is no longer faded either: the label and the "14m old" line that tell you the reading is dead stay at full strength, with the amber border and greyed ring carrying the warning.
• The device page fits a phone screen. The header block had a fixed minimum width wider than a 375px screen's content area, so the whole page — tab bar included — scrolled sideways.
• The device pages are now genuinely translated. 91 labels across the Add Device wizard, the discovery messages, the SNMP and Proxmox fields and the outage analysis were missing from the language files, so every language showed them in English — including Portuguese, Spanish, German, French, Persian and Arabic — and nothing looked broken enough to report. One tooltip showed a raw key (monitoring.wizard.help.virtualMachines) instead of text; it now explains why you pick individual VMs. A new check reads the pages themselves and fails the build if any label they use is missing from any of the seven languages.
• The Help guides now call each control by the name on your screen. In six languages the device guide told you to fill in "Device Name", switch on "Enable Alerts" and press "Save & Close" — English names that no longer appear in a translated wizard. Four languages showed a button half-translated ("Guardar & Close", "Speichern & Close", "Enregistrer & Close"), and the Portuguese guide pointed at the device list's "Active Alerts" filter when it meant the wizard's Enable Alerts switch. All corrected, and guarded against coming back.
• The device page has its own guide, and its ⓘ tooltips finally lead to it. Every tooltip on the device page linked on to the device list guide, because the page itself had no guide entry. There is now a Device details guide — what the header numbers mean, what each of the seven tabs answers, and the two things that surprise people (a metric older than one probe interval is marked stale, and Availability counts only the hours the device has actually been watched) — in all seven languages.
• The Containers tab no longer shows Docker's English words in your language. Status and Health printed whatever Docker reported — running, unhealthy — in every language. They are translated now, and a state we have not seen before still shows the raw word rather than an empty cell.
• Small English leftovers on the device pages are translated. The per-VM CPU and RAM gauge titles on Proxmox hosts, the tooltip on a topology link's drag handle, and the terminal's "Disconnected" line (which stayed English after you switched language mid-session).
• The terminal and the threshold form now explain themselves. New ⓘ help on the terminal's saved profiles, the Password / SSH Key choice and the credential row — including the plain statement that the password or key you type is used for that session only and is never stored — and on all six fields of Add Rule, where two rules used to be invisible: a rule can only fire on a metric this device actually collects, and Severity labels the alert without changing when it fires.
• Addresses and names read correctly in Persian and Arabic. Hostnames, host:port targets, container names and interface names on the device pages are now isolated from the surrounding right-to-left text, so an address like 10.0.0.1:8080 can no longer be displayed with its parts reordered.
• The AI assistant now follows your language on device pages. Opening a device — or asking about one from the device list or an outage analysis — used to hand the assistant an English page description and English prompt buttons whatever language you were in. It now uses your language, and switching language updates the panel immediately.
• A fix to "last seen" / "up for" timing. These durations were parsed through a date helper that was only correct if another part of the app happened to load first; outside UTC that could have shifted every duration by your timezone offset. Now guaranteed correct, with tests.
• Device status now reads in your language everywhere, and looks the same on every page. The status word stayed English on the device cards, the status group headers, the device list's Status column and the topology node panel. The two device pages had also drifted apart on colour and tint, with the list using a green and an amber that were hard to read on a light background. Both pages now share one definition, and a device you started adding but never finished shows as DRAFT instead of UNKNOWN — it was reading as a monitoring failure rather than an unfinished form.
• A threshold set to wait for several samples in a row now fires. If you asked a rule to confirm a breach over more than a few consecutive readings, it could never collect them — the history it looked at was shorter than the streak you asked for — so the rule sat there looking perfectly healthy and never alerted. It now looks back far enough for the streak it was given. A device whose metrics have stopped arriving is still not alerted on, as before.
• Deleting or changing a threshold rule now closes its alert. Changing a rule from "above 90" to "above 95", switching it off, or deleting it left the old alert on the bell with nothing able to clear it — and while it sat there, the same rule could not raise a new alert. Saving the Thresholds tab now closes any alert whose rule no longer exists. Alerts for rules you did not touch stay put.
• Editing a threshold rule no longer resets its confirmation settings. "Consecutive samples" and "clear margin" were not shown in the edit dialog and were quietly reset whenever you pressed Save — so a rule set to confirm over 3 samples went back to firing on the first one. Both settings are now shown in the dialog and listed next to the condition in the table.
• The switch and delete button on the second page of the Thresholds table now act on the right rule. With more than 25 rules, toggling one on page 2 flipped the rule at the same position on page 1 instead.
• The threshold value field now shows its unit and sensible limits. A percentage rule accepted 5000, and a plain number gave no hint whether it meant percent or bits per second. The unit is now shown next to the field, and percentages are limited to 0–100.
• An outage that is still running now counts up live. The duration used to update only when the page refreshed, roughly every 30 seconds.
• A failed service check says why in the list. The error message used to appear only if you hovered the "Last check" cell — impossible on a phone or tablet. It is now shown under the service name.
• Container auto-setup warns before replacing an existing cAdvisor. If the host already runs a container named cadvisor, the automatic install removes it. The dialog now says so before you start.
• Zooming into the Metrics chart has a Back button. Dragging a range on the chart used to overwrite the time picker with no way back except remembering which preset you had chosen.
• Device pages with many interfaces feel lighter. The small traffic sparklines on the interface cards are drawn directly instead of each one building its own chart engine.
• A warning when an exporter is published to a public address. Container auto-setup and the onboarding wizard now say so plainly — those endpoints have no password — and tell you to firewall the port. Loopback, private ranges and carrier-grade NAT no longer trip the warning by mistake.
• The Containers tab still lists containers when Prometheus half-answers. A single failing query used to blank the whole tab; now only the affected column (CPU, memory, uptime or the cAdvisor version) comes back empty. The tab also loads faster — those lookups run at the same time instead of one after another.
• Saving a device from the wizard no longer waits on an unreachable host. The first probe used to be able to hold Save for up to five minutes. It now gives up after 10 seconds and the scheduler probes on its next round.
• Metric history uses less disk. Raw interface byte counters are kept for 7 days instead of the full retention window — the traffic charts are drawn from the derived bits-per-second series, which keeps the whole window. Nothing you can chart or alert on changes. The Settings card explains it.
• Probing a switch with many ports is cheaper. Each cycle used to run two extra database lookups per port; it now runs one for the whole device.
• You can paste into the SSH terminal. Ctrl+Shift+V pastes and Ctrl+Shift+C (or Ctrl+Insert) copies the selection — plain Ctrl+C still interrupts the running command, as in any terminal. Over plain HTTP the browser blocks clipboard access, and the terminal now says so instead of doing nothing.
• Closing the terminal window asks first. Shutting a tab or pop-out with a live shell used to kill the session mid-command without a word.
• The Connectors tab has a Manage connectors button. Its help text told you to edit connectors there and there was nothing to press.
• The device page looks the same everywhere on it. Tiles that share a design had drifted onto three slightly different borders in the light theme, and the colours on the 24h status bar are now dark enough in light mode for the words beside them to be easy to read.
• The device page is no longer half English in your language. Arabic and Portuguese users saw whole sections of it — the Thresholds tab, the Services and Containers tabs, the add-device wizard, the bulk-edit form — in English, and German, Spanish, French and Farsi had scattered English labels. 256 strings are now translated, in the same wording the rest of your language already uses, and a new check fails the build if any device-page text is left in English again.
• Metrics you ticked now actually appear. Load average, cluster quorum and the VM/container counts were collected from your devices and stored, but the Metrics tab drew no card for them — the wizard ticks them by default, so most Proxmox and Prometheus devices were quietly throwing that data away. Each has its own card now, in its own unit: quorum reads Yes or No rather than 1, and a genuine zero — nought running guests, quorum lost — is printed as zero instead of the dash that means "nothing collected".
• A hand-picked time range follows your timezone. If your display timezone differs from your computer's, typing 09:00–10:00 into the custom range fetched a window shifted by the difference, so the chart came back empty or showed an hour you did not ask for. The picker now reads the times on the same clock as the chart axis and says which zone that is.
• An interface with a comma in its name is charted. Its traffic never appeared at all; the name broke the request in half.

Changed

• Picking which links a Metrics chart draws is now a row of chips, on the section it belongs to. The old picker lived in the toolbar and collapsed to "+2 …", so you had to open a dropdown to find out what was on screen. Each chip shows the link's colour, its name, and its current reading — the strip is worth reading even when you are not changing anything. The same chips now drive CPU / RAM / Storage, replacing a legend where switching a line off only faded its little colour square.
• Off looks off. A switched-off series gets a hollow ring, a dashed outline, a struck-through name, and an OFF tag — not just a paler colour, which this page also uses to mean "this reading is stale" and "this control is disabled".

Added

• Alt-click a chip to see that link on its own, and Alt-click it again to bring the others back. There is also All, None, a search box once there are more than eight links, and a count of how many are showing.
• Your choice is remembered per device. Switch two noisy links off, leave the tab, come back — they are still off. A link the system starts monitoring later is drawn by default rather than being quietly left out.

Fixed

• On a switch with more than six interfaces, every link past the sixth was drawn in the first colour, so they could not be told apart.
• Switching every link off used to hide the very control that switches them back on. The chips stay, and the empty chart now says which control to use.
• Switching CPU, RAM and Storage all off left an empty grid that looked like a device with no readings. It now says the series are switched off.

Changed

• The Metrics tab of a device has been rebuilt. Traffic is now one chart per reading of the link: inbound above the line, outbound mirrored below it, so you see the shape of a link at a glance instead of two curves crossing each other. A toolbar above the charts holds everything that used to be scattered or missing — the time range, which links to plot, the unit, the chart style, and how often the view refreshes itself, with the time of the last update written next to it. Up to three links share a chart; pick more and each one gets its own panel instead of a tangle. Colours are fixed per link, so hiding one no longer re-colours the others, and no series borrows red or green — those stay reserved for "this is a problem". Each link card also carries p95 for both directions — the level the link stays below 95 % of the time, which is the number you size a circuit against, not the peak — and the cards and panels can be ordered busiest-first when you need the loaded link at the top.

Fixed

• Traffic charts showed the wrong times. The chart applied your timezone twice, so it sat one offset away from the outage list and the logs for the same device. The times on the chart now agree with the rest of the page.
• Interfaces with a dot in the name drew nothing. A VLAN sub-interface such as ether1.100 appeared in the legend but never on the chart. It plots now.
• Percent readings on links with no configured speed were wrong. A 40 Mbps link could be shown at the top of the scale as if it were saturated. Percent is now offered only for links whose capacity you have set; the rest are shown in bit/s, and the control tells you what is missing.
• The tab forgot which interfaces you had chosen, every ten seconds, while you were looking at it. Your selection now stays until you change it.
• A chart that failed to load looked like a quiet device. When the data cannot be fetched you now get the reason and a retry, instead of an empty chart that reads as "nothing happened".
• A long time range silently showed only part of itself. If a range holds more samples than one view can carry, the tab says so.
• Clearing a link's capacity did not save, and a capacity of zero was accepted. Both are handled properly now.
• The zoom control was wiped every time the page refreshed itself, which made it useless at a 30-second refresh. It has been replaced: drag across the chart to zoom into that window, and the window stays put through a refresh. A drag shorter than a minute is treated as a mis-click and ignored.
• The line-rate marker never appeared. The line that shows a link's rated speed was dropped whenever it sat above the traffic — that is, whenever the link was healthy. It is drawn now, above and below the axis.
• Legend labels were hard to read, printed in the same colour as the line they name. The colour stays on the small swatch; the text is normal text.
• An empty chart looked like a quiet device. Traffic and System Resource History now say what is missing.
• Links with no configured speed vanished from the percent view with nothing to explain it. They are now named under the toolbar, with what to do about it.
• A bad capacity was reported as "device metric not found". Zero, a negative number or a non-number is now rejected with a message about the field you typed in.
• On a phone the headings ran into each other. The "in above, out below" hint covered the chart's own title. Headings now wrap, and the tab fits a 420-pixel screen with nothing pushed off the side.

Fixed

• On an HTTPS install, the browser is no longer sent back to plain HTTP. A handful of addresses answered with a redirect that named http:// instead of https://, so the next request — carrying the session token — went out unencrypted before coming back to the secure address. Redirects now keep the scheme the visitor arrived on.
• Features that shipped no longer read as unreleased. The feature list's "Since" column stayed on unreleased after the release that made those features live, because only the version file and the changelogs were stamped when a version was allocated. The release now stamps the feature list too.
• Apply Update now updates the update service itself. The component that applies your updates was the one component updates never reached: it cannot restart itself mid-update, and it was left waiting for a manual redeploy that never comes on an installation that updates from the panel. It stayed on the version it was installed with. It now schedules its own restart at the end of a successful update, a few seconds after the result reaches your screen. No action needed, nothing to configure, and installations without internet access are covered too — the new image is already on the machine by then.
• The API overview in Settings now reports the real endpoint counts. Six of the fourteen areas were under-counted — monitoring, logs, DNS, Service Manager, users and compliance had all grown since the numbers were typed in. They are corrected, and a test now checks them against the running API so they cannot drift again.
• The feature list now counts the Help centre correctly — it said 29 troubleshooting answers where 30 ship.

Documentation

• The release-note corrections announced in 1.2.294 are now actually in the notes. That release said it had corrected sentences in the notes for 1.2.282 to 1.2.291 that promised more than those releases delivered. A later commit, repairing a different problem in the same file, put eight of them back the way they were — so the correction was announced but not shipped. The eight sentences are corrected again here, and this time nothing follows them. No product behaviour changed with any of it.

Added

• The Software Bill of Materials now covers the whole product. It could only ever describe the API service — the one component able to look at itself — so anyone auditing AtlasEye had to take the rest on trust. The frontend, the monitoring worker, the syslog collector, web analytics, the updater and the host agent are now all downloadable, each component with its licence, and each document states whether it was read live from the running service or captured when the release was built.

Fixed

• Two components used by the built-in API documentation were missing from the attribution list. Their licences and copyright notices now ship with the product and appear in NOTICE.md alongside everything else.
• Offline installers carry the licence agreement you are actually asked to accept. The installer tree shipped an older revision of the EULA than the one activation validates against — which mattered most at an air-gapped site, where that copy is the only one available.

Fixed

• An install that ends with a broken container now says so, and fails. The installer already checked every container and named the broken one — then printed "AtlasEye is up." underneath and finished successfully anyway. Anything driving the install from a script read that as a clean install. The closing line now matches the check, and the run ends with a failure code — after the one-time admin password and the licence fingerprint are on screen, because an unattended install still needs both.

• Turning off the public status mirror now keeps trying until the copy is really gone. Switching the mirror off asks your status-page provider to delete the mirrored page and the history behind it. If they could not be reached at that exact moment, the switch still went off, AtlasEye forgot the address — and the copy stayed public, with nothing left to remove it with. The deletion is now retried every minute until it lands, and Settings → System shows a notice for as long as the copy is still out there. The retry stops on an answer that will not change — a provider that does not recognise your licence, or has revoked it, has nothing of yours left to delete — and an installation with no status-page provider configured never contacts one at all. Whatever the provider does, it can no longer hold up device monitoring while AtlasEye waits for it.

• A device whose SNMP replies stall now names itself in the log. Devices in this state show as reachable but report no system information; the log line explaining why said only "SNMP walk timeout", with no address, so on a site with several of them you could not tell which one it was about. It now names the device, the port and how long it waited.

• The Downloads page in the customer portal shows how many machines a licence is on, not only when it runs out. It warned when every activation slot was used, and said nothing at all below that — so "3 of 5 machines" was only visible from the Dashboard. Both states now read the same way.

• Corrections to earlier release notes. A review of the notes for 1.2.282 to 1.2.291 found sentences that promised more than the release delivered — a status incident said to disappear from the off-infrastructure mirror (which never carried incident history), an eight-minute figure that was an eight-item checklist, a translation sweep described as complete. Those entries have been corrected in place; no product behaviour changed with them. The offline-install and high-availability runbooks were corrected in the same pass: the preflight script needs its shared library alongside it to be sent ahead of the bundle, and the OpenSearch certificates must be regenerated before the first multi-node start — for the reason that runbook already gave elsewhere, a certificate subject left over from before the rebrand.

Added

• The full list of third-party components AtlasEye bundles, with their licences. Your licence agreement has always offered that list on request; it now ships with the product as NOTICE.md, generated from what is actually installed rather than maintained by hand, so it cannot quietly describe an older release. The Software Bill of Materials you can download from Settings now names each component's licence as well.
• That list includes the licence texts themselves. Alongside every component's name, version and licence, NOTICE.md records who holds the copyright and reproduces the licence terms in full — what the permissive licences require to be delivered with the software, rather than offered afterwards. It covers the frontend and the bundled service images too, and it is written into every installer, so an air-gapped site has it on disk without having to ask for it.
• A code provenance and licensing statement for supplier due diligence. Where AtlasEye's own code comes from, what third-party material it carries, the licence policy it is held to and the current position against it — available from us on request, for the security questionnaires that ask.

Changed

• No GPL-licensed code ships inside AtlasEye any more. One library carried a copyleft licence that does not belong in a commercial product. Nothing ever called it; it is now removed, and the release build fails outright if another one appears.
• Offline installers are built with a current geolocation database. The build now refuses a database older than 90 days, so a new install no longer starts life showing a "GeoIP data is stale" warning.

Fixed

• The HTTPS setup instructions now work first time. They left out the step that makes the private key readable by the gateway, so following them exactly could leave the system on plain HTTP with nothing obvious to explain it.

Fixed

• Health checks tell the truth about the path you asked for. Pointing an uptime monitor at /healthz (or any /health-… address) used to return a plain healthy even though no such endpoint exists — the monitor showed green whatever the system was doing. Only /health answers now.
• Every release ships with a matching installer. If the installer tree for a release fails to build, publishing now stops instead of continuing and leaving the Downloads page offering the previous release's installer.

Fixed

• An offline install no longer finishes by naming a file that isn't there. The last line pointed at docs/ops/airgap-install.md for the first-boot checklist, but the bundle carries that runbook at docs/airgap-install.md — so the one instruction printed at the end of a successful install could not be followed. It now points at INSTALL.md, in the directory you are already standing in.
• The installer no longer says "AtlasEye is up" when parts of it are down. It checked the web address and the API. The alerting service and the update service could both have failed to start, and you would only find out weeks later — the first time an alert should have fired, or the first time you pressed Apply Update. Every container is now checked before the installer reports success, and if something is wrong it tells you which one and how to read its log.

Added

• Installing AtlasEye is now two commands, copied from your account. Sign in to the customer portal and open Downloads: the page shows the exact command to run, with your own licence key already in it. Download the installer, run it with sudo, and the rest is unattended — it checks the machine first, fetches everything from our registry with credentials your licence provides, generates every password and key, turns on HTTPS, brings the platform up, waits until it is genuinely healthy and prints your one-time admin password. Nothing to transfer, no configuration file to edit, no credentials for us to email you. The page also shows how many machines each licence is currently installed on and tells you before you start if they are all in use, instead of letting the install fail at the end. Air-gapped sites keep the signed offline bundle, and it is the same installer either way — one step shorter, and still signature-verified before anything is loaded.
• The installer is now a download of its own, not a 3 GB transfer. If your server can reach the internet, you no longer need the full offline bundle to install AtlasEye. A single small download carries the compose files, the install script and everything else the install needs; the container images come from the registry with the credentials your licence already provides. The offline bundle stays exactly as it was for air-gapped sites, and both are built from the same tree — what you install is what we test.
• Installing AtlasEye no longer starts with editing a configuration file. The installer used to copy a template, list the passwords and keys you had to invent yourself, and stop until you had done it — and the list was missing two of them, so a careful operator could follow the instructions to the letter and still end up with a platform that refused to start. It now generates every secret for you, switches the platform into production mode, turns HTTPS on with a certificate it creates on the spot, and prints your one-time admin password at the end. There is nothing to fill in and nothing to prompt, so it also works unattended from a cloud-init or Ansible run.
• A step-by-step install guide, inside the install. INSTALL.md sits in the directory the installer creates and covers both paths — which install you need, what the machine has to have, the two commands, what happens while it runs, and a first-run checklist for the eight minutes after it finishes: log in, turn on two-factor, activate the licence, back up .env, point it at your mail server. It ends with a troubleshooting table written against the installer's actual messages, so whatever it printed is the row you look up. The install refuses to be built without the guide, so the file the installer tells you to read is always the one sitting next to you.
• A 2KB check you can run before downloading several gigabytes. bash scripts/preflight_host.sh tells you in seconds whether a machine can run AtlasEye — Docker version, memory, free disk space on the drive Docker actually uses, whether ports 80/443 are already taken, and the one kernel setting (vm.max_map_count) that otherwise stops the search engine from starting. Run as root it also fixes that setting permanently, so the platform survives the machine's first reboot.
• Your licence can now be tied to the machine in a way that survives updates. AtlasEye identified an installation partly from data that lived inside a container, so recreating containers — a routine part of any update — could change the machine's identity and make an activated licence stop matching. New installations get a stable identity stored in .env, printed at the end of the install for you to send when you activate. Existing installations are untouched and keep working exactly as before; nothing to do on upgrade.

Fixed

• Adding the AtlasEye server as a monitored device no longer opens a metrics port on your network. cAdvisor and the exporters have no login of their own — anything that can reach their port can read them, and cAdvisor's page lists every container on the machine. On a remote server that port has to be reachable, because AtlasEye collects it over the network. But AtlasEye already watches its own containers privately, so installing a second copy on its own host published that page to everyone on the network for nothing in return. Auto Setup and the onboarding wizard now stop with an explanation instead, and point you at Dashboard → System Overview where those containers already appear. If you really are pointing one AtlasEye at a different AtlasEye, tick Install anyway.
• Turning HTTPS on with a bad certificate can no longer take the whole site down. TLS_ENABLED=true with a certificate and key that don't belong together — or a key protected by a passphrase — used to make the gateway fail to start and keep restarting, so plain HTTP stopped working too and AtlasEye became unreachable. The gateway now checks the certificate before it starts serving: if it isn't usable, HTTPS is skipped, HTTP keeps working, and the exact reason (with the command to verify the pair) is written to the gateway log — docker compose logs gateway | grep docs-allowlist.
• You can take a status incident back off the public page. Every banner you post is also filed as an incident that visitors can read for 90 days — a test run and a mistyped headline included, and until now the only way to remove one was a database query. Settings → System → Status Page Banner now lists the published history and deletes one entry together with its whole timeline; it leaves the public page, the Atom feed and the off-infrastructure mirror at once, and the deletion is recorded in the audit log with the headline it removed.
• Clearing the banner now also clears its wording. A finished incident's title and message no longer travel in the public payload after you set the page back to Operational. The closing note you type on the way out still becomes the last line of that incident's public timeline.
• The Containers tab of the AtlasEye server itself lists its containers again. Because AtlasEye no longer installs a second collector on its own machine (see above), that device's tab had nothing to read and sat empty. It now reads the collector AtlasEye already runs — the same containers Dashboard → System Overview shows — and hides the setup buttons, since there is nothing to install there. This applies to that one device only; every other host still needs its own collector.
• A fresh install no longer starts out polling a stranger's server. The two files listing the hosts AtlasEye collects container and host metrics from shipped with a leftover address from a development machine, so a new install — an air-gapped one especially — began by contacting ports 8080 and 9100 on an address that, on your network, most likely belongs to one of your own machines. They now ship empty and fill in as you onboard hosts.

Security

• Hidden files are no longer reachable over the web. A request for a dotfile — /.env, a .env.bak left behind by an edit, /.git/config, an editor swap file — used to answer 200 with the app shell instead of refusing. Nothing was ever exposed, because the folder the web server publishes only contains the built app, but that was a property of what happened to be in the folder rather than a rule. It is a rule now: those paths return 404 at the edge, before any of them reach the app. /.well-known/ stays reachable, so certificate renewal and security.txt are unaffected.

Fixed

• Certificate expiry alerts now cover every managed host, linked to a device or not. If a host in Service Manager was not linked to a monitored device, its certificates could expire — and its automatic wildcard renewals could fail every six hours — without raising anything. The expiry countdown in the Certificate lifecycle panel was the only place it showed. Those hosts now raise alerts too, listed alongside registrar and domain-expiry alerts rather than under a device. Hosts that are linked to a device keep their alerts on that device, so who can see them does not change. Nothing to configure: if you added a device link only to get expiry alerts, you no longer need one.
• An offline install no longer reports a working platform when it never answered. The installer waits for the platform to come up before declaring success. That wait had a bug that made it give up on its very first check and continue with a warning, so an install that never came up could still finish looking almost fine. It now waits the full five minutes it was meant to and tells you plainly if the platform did not answer. The same bug made the first-run OpenSearch setup start configuring a node that had not finished booting, and the updater print "connection ok" in its diagnostics for connections that had in fact failed.
• The platform starts on a Linux host even if the database user is missing from your .env. It used to wait for the database silently and forever, with nothing in the log naming the missing setting. It now assumes the standard user, and if the database really is unreachable it gives up after a minute and says so instead of hanging.

Added

• Pick the language of the public status page. The page used to follow whatever language the visitor's browser advertised, with no way to disagree. A picker now sits in the header offering all seven languages, and the choice is remembered on that browser. Choosing Persian or Arabic also lays the page out right-to-left, even on a machine set to English.

Fixed

• The API card said "Operational" twice. The status word was repeated where the detail line belongs. It now tells you how long the page's own request to the platform took — and shows nothing at all when the page is displaying a last-known snapshot, rather than a response time that is no longer true.
• The uptime strip no longer pushes a phone screen sideways. On a narrow screen the 90 day-bars could not fit and dragged the whole page with them. The strip now scrolls inside its own card.
• Release tags point at the released commit. An internal publishing fix: the version tag is now pinned to the commit that was built, instead of to whatever the working tree had moved on to by the time the publish finished.

Added

• Uptime history on the public status page. Below the component cards, Uptime, past 90 days shows one bar per day for the monitoring engine and log ingestion, with the percentage for the window. Hover a bar to see that day's date, state and percentage.

The number is honest about what it does not know: a day where nothing was recorded stays blank instead of green and never counts as 100%, so does a day heard for less than half its minutes, a component with no history yet says so, and API & web app has no bar of its own because that sample would be taken inside the monitoring process and cannot speak for the API. A degraded sample lowers the percentage the same way an outage does.

The strip does not start empty. Prometheus has been recording the monitoring engine's heartbeat all along, so the first sample of each day replays up to fifteen days of it — that is how long Prometheus keeps data by default — and grades those minutes exactly as the live card grades them. The same happens after a restart for any days the app spent switched off. Days already on the strip are never rewritten, a day Prometheus only partly covers stays blank rather than turning green, and only the monitoring engine can be rebuilt this way: log ingestion and API & web app are measured from sources Prometheus does not hold, so those days stay gaps instead of guesses. - A status page that keeps answering when your instance does not. Your own /status page lives on the same stack it reports on, so the moment that stack is unreachable your customers get nothing. Settings → System → Public Status Mirror sends the roll-up to a status page hosted by your vendor once a minute, and you hand that link out instead. When your stack goes dark the page says so.

It is off until you turn it on, and the card lists both halves before you do: what is sent (the headline, the state of API & web app, Monitoring engine and Log ingestion, your maintenance window, your banner's title and message, your organisation name and the app version) and what is never sent (device names, addresses, logs, metrics, users, credentials). Report now sends the first one immediately; Public link appears once a report lands, Last reported names when, and a failure shows as The last report failed with the reason.

The mirrored page will not pass old news off as current: after three missed reports it states how long your instance has been silent and shows every component as unknown, not the last state it heard. With the mirror on, API & web app also gains its 90-day bars, graded from outside your network — minutes nobody heard count as No data and stay grey.

If the switch is on and nothing is arriving, the card says why — including the two cases that can never succeed on their own: an install that was never told where its vendor lives, and an air-gapped licence.

Two caveats worth knowing. The mirrored page is only ever as fresh as the last report, one minute behind at best. And turning the mirror back off deletes the mirrored copy including the uptime history behind it, after which the link answers exactly like a link that never existed. - Past incidents on the status page. Until now the banner showed only the latest thing you wrote; the update before it was gone. Someone arriving late could read what you are saying now and had no way to learn what happened an hour ago, or last month.

Nothing extra to do: the same Save on the banner card files the incident for you. Change the state and the page gains a new line with its timestamp; fix a typo in the title and it does not, because a repeated line is noise on a page strangers read. Set the state back to Operational and the incident closes as Resolved. /status shows the last 90 days under Past incidents, newest first, each with its own timeline.

Visitors see the title, the state and the messages with their times — never who wrote them. This is separate from the internal Incidents module on purpose: severities, sectors and reporting deadlines belong to your compliance record, not to a page anyone can open.

History starts with this version. Banners posted before the upgrade were overwritten as they went and cannot be brought back. - Follow the status page instead of reloading it. Two new links in the /status footer, no login for either.

Incident feed (Atom) works in any feed reader, and in the chat tools that accept a feed URL. It carries one item per update, not per incident, so a new line in a running incident actually reaches you — and each item keeps a permanent id, so nothing you have already read is announced a second time.

Maintenance calendar (iCal) is a subscription your calendar refreshes on its own. Windows you plan in Alerting → Maintenance appear with their reason and their times; a window you switch off turns into a cancelled event rather than quietly disappearing, so anyone who already had it in their calendar learns it was called off. Finished windows stay on the calendar for 90 days.

The calendar deliberately says what and when, never which devices — the page has no login, and your inventory is not part of it. - The status page now groups its components. Application access covers the API and the web app; Monitoring pipeline covers the scheduler and log ingestion. Each group shows its own state — the worst of the cards inside it — so a glance at the headings tells you whether people cannot use the console or whether collection is behind. A card with no data leaves the group's state alone, because "we cannot tell" is not an outage.

Fixed

• Turning on HTTPS now tells you when the certificate cannot be read. Setting TLS_ENABLED=true with a certificate the gateway had no permission to open left the site on plain HTTP and logged only "cert/key missing" — so the obvious next step was to go looking for a broken file path instead of the real cause, file ownership. The gateway now names the failing file and which of the two problems it is, and prints the exact command to fix ownership. It also logs a clear line when HTTPS does come up, so you can confirm it rather than assume it. The admin guide and .env.example now include the ownership step in the enable instructions.
• The Kubernetes install guide no longer overstates what the preview chart runs. It described the Helm chart as running the same services as the Docker Compose deploy. It does not: eight services have no chart equivalent, and two of those matter a lot — without Prometheus there is no metrics backend, so every device graph and dashboard metric tile is empty, and without the updater service Settings → Updates does nothing. A new section lists all eight with what each one costs you, so a reduced install is not mistaken for a broken one. Docker Compose remains the supported deployment.
• The HA reference now tells you to regenerate the OpenSearch certificates before the first multi-node start. A single-node install never checks node certificate subjects against each other, so a host can run for months on certificates whose subject no longer matches the cluster configuration. The first time a second node joins, the two reject each other, serve HTTP 503 and still report themselves healthy. The HA overlay and its runbook now open with the one command that regenerates the pair correctly.

Fixed

• Help guides in Arabic, Persian, German, French, Portuguese and Spanish now name each control the way your own screen shows it. Steps that said "open Recent outages" or "use Ask your network" pointed at English names the translated Dashboard never displays. 344 sentences were corrected across the six languages — buttons, tabs, table columns and menu entries, not just the Dashboard — so a step you read in your language names a control you can actually find. Terms your screen really does show in English (an untranslated provider field, a Cloudflare page name) stay as they are.

Fixed

• A pinned Dashboard tile can no longer show a dead device's last reading as live. The command-center tiles were the one place still doing this: a device that stopped reporting kept its gauge painted, and a metric that had never reported showed a confident 0 % — because the tile was being sent a zero timestamped "just now". Those tiles now grey out and print how old the sample is, exactly like the gauges on the device page, and show "—" when there is no sample at all.
• Interface bandwidth gauges follow the same rule. A link whose collector went quiet used to keep its last RX/TX numbers on screen, and a gauge with no data at all read 0 bps — indistinguishable from a genuinely idle link. Both cases are now labelled.
• The uptime card no longer hides its age. It was the only card on the Metrics tab that computed the "stale" label and then failed to draw it.
• AI predictions ignore devices that stopped reporting. A host that answers ping but whose metrics froze yesterday was still feeding the trend analysis, which produced capacity warnings about a situation that had already ended.
• The AI assistant is told when a reading is old. Asked about the Dashboard, it used to answer with a stale number as though it were current; it now sees the reading as unavailable, plus its age.
• A link on the topology map polled hourly no longer flickers dark. The bandwidth overlay applied a flat 15-minute freshness rule to every device, so a slow-polled link looked dead for most of every hour. The rule now follows each device's own probe interval.
• Offline (air-gapped) installs no longer stop on the Web Analytics service. The offline bundle listed every part of the platform except the web-analytics collector, so the installer reached that service, found nothing to start it from, and gave up. The collector is now part of the bundle, of the offline install, and of offline updates. Online installs and updates were never affected.
• A first-time offline install now actually finishes. Past that first stop, three further problems waited, and each one let the installer report success on a stack that was not working. Configuration files never reached the containers (the installer pointed compose at the wrong folder, so it created empty folders in place of every config file it could not find). The search engine had no certificates — they are deliberately never shipped, since they are unique to your installation, but nothing created them either; the installer now generates them on your host, so the keys exist only there. And a brand-new search engine starts with no security configuration at all, answering every request with an error until one is loaded; the installer now loads it and seeds the administrator account from your .env password. The installer's final check used to ask only the web front door, which answers "healthy" without consulting anything behind it; it now confirms the search engine and the application itself are really answering before it reports success. The offline bundle also carries the GeoIP database again, so the syslog world map has its countries. Existing installations are unaffected — and running the offline updater on one repairs any of these that apply.
• The API documentation pages now use your own icon and tab title. Opening the Swagger or ReDoc pages showed the default AtlasEye icon in the browser tab, even though every other page showed your uploaded one. Those two pages are generated by the server rather than by the app, so they never picked up your branding — they do now, including the tab title.

Security

• A two-factor code can no longer be used twice. To tolerate a phone whose clock drifts a little, AtlasEye accepted each 6-digit code for about a minute and a half — but it never remembered that a code had already been spent. Anyone who saw a code during that window (over your shoulder, on a shared screen, in a phishing prompt) could sign in with it again while you were still signing in yourself. Each code is now single-use, like the recovery codes always were: once spent it is refused for the rest of its life, and so is anything older. Nothing changes for you day to day — no re-enrolment, no signing out, and the next code from your authenticator works as usual. Applies to sign-in, re-confirming your identity for a sensitive change, and the code you enter when first setting 2FA up.

Fixed

• Uploaded logos and favicons are no longer shown squashed next to the file name. In Settings → General → Appearance the small thumbnail beside each uploaded file name forced a wide logo into a square, so it looked distorted even though the logo itself was fine. The file row now shows just the name and a delete button; the preview panels underneath — header bar, collapsed sidebar mark, browser tab — remain the place to check how the image actually looks.

Fixed

• A transparent favicon now stays transparent in the browser tab. Your uploaded file was always fine — the icon AtlasEye ships as its own default had a solid white square baked into it, and the tab kept falling back to that default instead of your upload. The bundled icon has been redrawn with a transparent background, and the browser is now told to reload it rather than keep the old cached copy.
• Your icon now appears on the sign-in page, the public status page and the maintenance page too. It used to be applied only after you logged in, so visitors and the login screen always showed the AtlasEye default. It is also used for the icon on iOS home-screen shortcuts and on desktop alert notifications, which previously always showed AtlasEye branding.
• The favicon preview in Settings now tells you the truth. It used to draw your icon on a white square, so a transparent file looked like it had a white background. It now shows the icon at both 32 and 16 pixels over a transparency checkerboard, a light tab and a dark tab — so you can see the real background and check that the icon is still legible at true tab size.
• If the file you upload really does have a solid background, you get told. The upload still goes through — a solid icon is a valid choice — but a note now points out that the background is part of the image itself.
• Rotating an image in the logo cropper now changes the result. The rotation slider moved the preview but the saved image came out unrotated, cropped from the wrong part of the picture.

Changed

• Settings → General now spells out what the favicon needs to be: a PNG or JPG, 64×64 or larger, .ico files are not accepted — no current browser needs one — and transparency is kept exactly as uploaded.

Fixed

• Devices with alerts switched on but no notification channel chosen now actually notify you. Until now such a device recorded the outage and turned red in the UI, but sent nothing — the alert had nowhere to go and was dropped quietly. It now falls back to every active channel so the message still reaches you, and the device page marks the missing routing so you can pick the right channels.
• Metric gauges no longer show an old reading as if it were live. When a device answers its probe but its collector has stopped reporting, the last value it sent used to be displayed as the current one — a host that had been silent for over a day still looked perfectly healthy. Readings older than 15 minutes (or three probe intervals on slowly polled devices) are now greyed out and labelled with their age, a period with no data shows a dash instead of a green 0 %, and thresholds ignore stale samples rather than raising or clearing an alert from a number that stopped moving.
• SNMP devices that answer but report no system tables no longer show 0 %. A partially responding or failing SNMP agent used to record 0 % CPU, memory and disk, which is indistinguishable from an idle machine. Those metrics are now simply left empty, and SNMP failures are recorded in the log with the host and the actual reason.

Fixed

• The dashboard's log-analysis panel and World Map stay up when the cache server is briefly unavailable. Previously a Redis hiccup made the panel reload every minute onto an error instead of quietly showing "no recent analysis". They now degrade to the empty state and recover on their own. A manual AI log analysis also no longer discards its result when the cached trend data cannot be read.
• More pages ride out a cache hiccup instead of showing an error. The security score in the header, the log scan history, and the status of a running backup or log-archive job now show their normal "nothing yet" state during a brief cache outage and recover on their own.
• Licence activation and the licence agreement no longer fail on a bad reply from the licence server. If a proxy or CDN answers with an error page instead of real data, you now get the usual "licence server unreachable" message and can retry, rather than an unexplained error.
• Checking for updates no longer errors out on an unexpected reply. The Updates panel reports the check as failed and tries again on the next cycle, the same as any other unreachable-server result.
• The health check now reports a database outage instead of an internal error. In 1.2.280, if the database went down while you were signed in, the System Health drawer showed a blank "unavailable" instead of naming the database as the failing component. It now correctly reports the outage. Nothing that watches AtlasEye from outside was affected.
• The Dashboard stops nagging installs that do not use AI. With the AI module off, the page used to raise an "Access denied" message every minute while it kept asking for findings, insights and the daily briefing it was not allowed to read. Those panels now stay quiet.
• A dashboard that cannot reach the API says so. Failed panels used to render as a confident page of zeros — no devices, no alerts, nothing wrong. You now get one message at the top, and each panel keeps the last values it received instead of pretending they are current. The Live Activity globe reports a failed fetch as an error rather than as "no activity".
• Fleet availability agreed with itself. The percentage on the hero tile was averaged differently from the one in the Uptime & SLA section, so the same fleet could read 99.4% in one place and 99.5% in the other. There is one calculation now, and reading it no longer downloads the entire device list every ten seconds.
• KPI numbers no longer jump backwards when a value changes mid count-up.
• Reordering dashboard tiles works from the keyboard. Every draggable tile, section and pinned metric now has its own grab handle you can Tab to and move with the arrow keys. Previously the whole tile was a tab stop, so Enter would both start a drag and follow the tile's link.
• You can see where the keyboard focus is. Focus outlines were missing on the drag handles and on the metric, inventory and insight buttons, and the new outline colour meets contrast on both the light and dark theme. Hover animations now stop for anyone whose system asks for reduced motion.
• The Uptime & SLA table and the container list behave like every other table — resize, reorder and hide columns, choose a page size, and the layout is remembered. Their headers were also stuck in English, and the container table's text was nearly invisible on the light theme.
• Translations across the Dashboard. The Uptime & SLA and Recent Outages sections, the Customize drawer, the Network Intelligence panel and the pinned metric menus were partly or wholly English in Portuguese, Spanish, German, French and Arabic. Arabic in particular had over a hundred untranslated dashboard labels.
• Seven Dashboard sections had no help icon — the triage hero, Live Activity globe, Command Center, Recent Activity, Quick Insights, Device Health and the syslog-volume tile. Each now explains what it shows and where the numbers come from, in all seven languages.
• Compliance posture cards were documented on the wrong page. Help and the feature list both pointed at the Dashboard; they live on the Compliance page.
• Counting-up KPI numbers respect "reduce motion". If your system asks for less animation, the dashboard's numbers now appear directly instead of ticking.
• Dragging a section no longer runs it twice. While a drag was in progress the dragged card was rendered a second time, so moving the network hero opened a second live-events connection and a second globe until you let go.

Performance

• The Dashboard stops redrawing itself when nothing has changed. Every ten-second refresh used to restart a 1.5-second animation on each chart even when the returned data was identical. Charts now hold still until a number actually moves.
• The globes are much cheaper to display. The hero globe stopped rebuilding its map layers on every screen update, and the decorative rotation on the Live Activity globe does a fifth of the work for the same visible speed. It already pauses in a background tab and does not spin at all under reduced motion.

Security

• The system health details are now behind login. Anyone who could reach your AtlasEye URL could read the full health report — which services back the deployment, which of them were failing and why, the server's CPU, memory and disk, and the monitoring scheduler's internals. That report now requires a signed-in session (any role — it is the same data the header status indicator and the disk-space banner already show you). Anonymous visitors and your orchestration tooling still get a plain up/down answer, so nothing that watches AtlasEye's health needs changing.
• Your exact version number is no longer public. Three places used to tell any unauthenticated visitor precisely which release and build you were running. That is the first thing an attacker looks for — it turns a generic vulnerability announcement into a confirmed target. Signed-in users see the version exactly as before, on the About page. The "a new version is available, refresh" prompt still works, including on the login screen; it just no longer needs to know the version to notice it changed.

Added

• The public status page now answers the question people actually ask. One line at the top of /status says whether the platform is healthy — All systems operational, Some systems degraded, Major outage or Under maintenance — and each component below it (API & web app, monitoring engine, log ingestion) carries its own state instead of a bare number. A component reading No data means AtlasEye cannot tell, not that it is broken, so it never turns the page red on its own.
• Planned maintenance shows up on the page. While maintenance mode is on, or a maintenance window from Alerting is running, the page says Under maintenance with the reason and ETA; a window that has not started yet is listed as Scheduled maintenance with its start and end.
• The page works when the rest of AtlasEye does not. It stays reachable during maintenance mode, and if it cannot reach the API it keeps showing the last state it saw, clearly labelled, instead of going blank.
• It reads like your status page: your name and logo, your timezone, live updates every 30 seconds that pause while the tab is in the background, and full right-to-left support.

Fixed

• /status was unreachable exactly when it was needed — maintenance mode hid it along with the rest of the app.
• The links at the bottom of /status showed internal placeholder text instead of Log in, EULA and Privacy.
• Removed a leftover "subscribe to updates" section that promised a sign-up form the product does not have; status-page recipients are added by an admin.

Security

• AI predictions now respect per-device permissions. A user granted only a few devices could previously see, acknowledge and snooze predictions for the whole fleet. Predictions that summarise the whole estate are admin-only.
• The daily briefing no longer shows admin audit counts to non-admins. The rest of the briefing is unchanged for everyone.
• The GeoIP status tile and the World Map's server location no longer expose internal details — the server's own public IP address and the container file path of the GeoIP database are no longer sent to the browser.
• Database query logging is off unless you turn it on (SQL_ECHO=true). Non-production stacks used to log every query, including the values written during password and licence changes.

Performance

• The dashboard's Infrastructure and System Overview tiles load faster. Their metric queries now run in parallel instead of one after another, and the connection to Prometheus is reused. A single slow or failing query no longer blanks the whole System Overview tile.
• Pinned metrics and outage history load faster on large estates — two new database indexes. They are created without locking the tables, so the update applies with no downtime.

Security

• AI network insight now respects per-device permissions. The insight text names devices, hostnames and outage reasons — a user granted only a few devices could previously read a summary covering the whole fleet, and shared one cached copy with everyone else. Each permission scope now gets its own insight and its own cache.
• Logging out really ends live updates. Signing out now revokes the token behind the dashboard's live event stream instead of only clearing the browser cookie, and every live-stream connection re-checks that a token hasn't been revoked.
• The "Refresh" button on AI insight and the daily briefing is now throttled (5 per minute per user). Normal viewing is unaffected — only forced regeneration is limited.

Fixed

• The dashboard's security-score tile always said "0 critical, 0 warning". It now shows the real counts.
• A stale cache entry could make the dashboard's AI findings panel fail repeatedly. It now falls back to "No recent analysis available".
• Installs with AI turned off no longer get "Access denied" errors on the dashboard. The AI panels and their background refreshes stay off entirely.
• The dashboard showed two slightly different 30-day availability figures — one on the KPI tile, one on the Uptime SLA card. There is now a single number, and the page stops downloading the full device list every 10 seconds to compute it.
• One failing data source no longer blanks every dashboard tile — only the affected tile shows zero.
• A dashboard left open in a background tab now stops streaming. The hero's live world-map feed pauses when the tab is hidden and resumes when you come back, and it no longer re-requests data the page already has.

Performance

• The outage timeline loads much faster on fleets with many outages, and the time range it accepts is capped at 90 days.
• The device list no longer loads every outage ever recorded — only the last 30 days, which is all it displays.

Changed

• Infrastructure is now a single-pane view of your real fleet. The page used to list Prometheus scrape targets; it now lists your actual monitored devices, each with its live CPU, memory, disk, load and network — pulled from the device's node exporter, or from cAdvisor (CPU and memory) when that's all a device exposes. A new summary shows how many of your devices are reporting, every column can be resized and reordered, and each device shows its current reachability status at a glance.

Fixed

• Wildcard TLS certificate renewals are more reliable. AtlasEye now reuses a single Let's Encrypt account across every wildcard certificate issuance and automatic renewal, instead of registering a new one each time — which at scale could trip Let's Encrypt's rate limits and quietly stall renewals.

Added

• A real Help centre. Help (/help) is no longer a flat list of features. It now opens on a setup checklist, and has a guide for every page in the product — what the page is for, and the numbered steps for the common task on it — plus a troubleshooting section written by symptom ("no email arrives", "containers show no data", "I lost my 2FA device") and a shortcuts/support tab. Everything is translated into all 7 languages.
• Every guide now tells you how, not just what. Each of the 45 page guides opens with a short explanation of what the page is for, then numbered steps for the job you came to do, then a "Good to know" list of the things that catch people out — which role or licence a button needs, what fails silently, what the product deliberately does not do — and finally links to the guide you will want next.
• A glossary. 36 terms the product uses in its screens and its alerts, in plain language and in your own language: outage vs incident, connector, drift, snapshot, cookieless visitor, agent transport, update channel, severity.
• Troubleshooting grew from 15 answers to 29, still written by symptom, and the setup checklist from 8 steps to 10.
• The feature list reads in your language too. Its rows used to stay English; they are translated now, like the rest of Help.
• Help follows you around the product. Every ⓘ help icon ends with a link to the full guide for the page you are on, and the header has a "Guide for this page" button — so you never have to find your page in a list first.
• One search box for all of Help. Type a page name, a task, or the words from the message you saw; results come from the guides, the troubleshooting answers, the setup steps, the glossary and the feature list together.
• Help shows only what you can use. Guides for pages your role or licence does not include are left out (with a count, so you know they exist) instead of sending you to a locked page.

Fixed

• Syslog: an empty sender allowlist is not "accept everything". The Security Settings banner said all sources were accepted whenever the list was empty. On a production install the collector does the opposite — it rejects every message until you add the first IP or CIDR — so a clean install could look fine while nothing at all was being stored. The banner now says what actually happens in each case, and Help was corrected the same way.
• Help now names the buttons you actually see. In a translated interface the guides still said "press Create User" while the screen showed the translated label — so the steps did not match the screen. Every language's Help now uses that language's own button and field names. Technical values you type (channel names, environment variables, API scopes) stay as they are.
• Portuguese text was garbled in places. The sidebar read "Definições" and the sign-in and profile screens had lost their accents ("Introduza o codigo da aplicacao autenticadora"). Both are fixed — only the accents were restored, the wording is unchanged.
• 19 places where Help described a button or a setting that is not there. Every sentence was re-checked against the product. Among the corrections: the Updates tab has no "Roll back" button (a failed update restores itself), device checks are re-run per service on the Services tab, account lockout is not a field in Settings → Security, AI Configuration has no monthly budget field, and the licence button is called "Refresh now".
• Help links that led to the 404 page. Several "Open page" links pointed at paths that no longer exist (log search, syslog settings, the SSH-audit row). All Help links now go where they say. The published feature list had the same stale paths and was corrected too.
• Help was English even in other languages. The whole page now follows your language setting — guides, troubleshooting, glossary and the feature list.
• Pages missing from Help. Domains, Web Analytics, Inventory conflict checks, Settings → General, GoDaddy and API & Integration now have guides, and links that pointed at an external repository (which customers cannot open) were replaced with in-app links.
• "Unreleased" version tags in the Help feature list now show the version that actually shipped the feature, or nothing at all when it was not recorded.
• The Infrastructure page shows data again. On newer Docker hosts, the Host Metrics and Top Containers tables read "No data" even though every exporter was healthy. They now populate correctly — host CPU and memory come straight from cAdvisor, and containers are listed by their real names. (Host disk usage still needs a node exporter on the host to appear.)

Fixed

• The Infrastructure page shows data again. On newer Docker hosts, the Host Metrics and Top Containers tables read "No data" even though every exporter was healthy. They now populate correctly — host CPU and memory come straight from cAdvisor, and containers are listed by their real names. (Host disk usage still needs a node exporter on the host to appear.)

Fixed

• Quick-search and Help links for Alerts/Incidents now work. They pointed at old addresses and opened a "not found" page; they now open the Notifications page on the correct tab.
• More of the interface is translated. "Service Manager" in the sidebar now shows in your language (Portuguese, Spanish, German, French, Persian, Arabic), and five Persian Settings tabs that were still in English are now translated.
• The side menu opens to the right section when you reach the AI, Service Manager or Active Sessions pages from a link or a page reload.
• Quick-search (Ctrl-K) now always matches the menu. It used to rely on its own separate list of pages, which had fallen behind — some newer pages (Service Manager, DNS, Domains, Web Analytics, Sessions, Access Matrix) never showed up in search, and a few removed ones lingered. It now searches exactly the pages you actually have, so it can never list something you can't open or miss something you can.
• The Infrastructure page is back on the menu. The infrastructure overview — host CPU/memory/disk, observed containers, exporter health, and the Fleet SLA / uptime report with its monthly scheduler — was fully built but had no way in: no menu entry and a broken address. It now lives under Monitoring → Infrastructure and opens correctly.
• Fixed several Help & Features links that opened a "not found" page. The cards for compliance posture, the AI assistant, network tools, and IP / NAT records now open the right pages.
• Two admin-only pages are now properly restricted. Compliance and AI Usage could be opened by non-admins on an entitled licence (the data was still blocked); they now redirect to the dashboard like every other admin page.

Security

• The audit log is now properly licence-gated. On licences without the Audit add-on, the activity-log data can no longer be pulled directly from the API (the menu already hid it). Access Events (login history) is unaffected.

Fixed

• The "Apply update" button now recovers on its own after a failed update. Previously, if an update failed, the button stayed greyed out — and "Check now" didn't help — until you reloaded the page. It now re-enables automatically once the update finishes, so you can read the error and retry without a manual refresh.

Changed

• Pricing page adapts when online sign-up is paused. If the vendor temporarily closes self-service billing, the in-product pricing page now shows a "Contact vendor" call to action instead of a "Subscribe" button that would fail at checkout — so you always know the right next step.

Changed

• On-host agent, manual enroll: the copy-paste install command now shows the callback URL it bakes in (auto-detected from the address you open AtlasEye with). To pin a fixed or HTTPS address for every agent, set AGENT_CALLBACK_BASE_URL in the server environment and re-enroll.

Changed

• API documentation now says AtlasEye. The interactive API docs (Swagger UI and ReDoc) previously showed the retired "Network Operations API" name and an outdated one-line description. They now identify as AtlasEye API and accurately describe everything the API covers — IPAM, monitoring, syslog, alerting & incidents, service manager, DNS & domains, web analytics, compliance, AI operations, licensing, and administration.
• Project README refreshed. Installation, update, backup/restore, and development instructions now match the current product, and the feature overview includes all shipped modules (DNS, Domains, Service Manager, Web Analytics, Compliance, and more).
• License statement corrected. AtlasEye is commercial, proprietary software governed by the End User License Agreement shown at activation; the repository's leftover open-source (MIT) license text has been replaced accordingly.

Fixed

• The on-host agent is easier to manage. Installing (or updating) the agent from the Services page now switches the service to agent control automatically — no separate "Switch" click, which previously left the service on SSH even though the agent was installed and running. The Manage-agent window now shows live status at a glance: whether the agent is connected, which version is installed, the latest version available (and a badge when an update is due), and when it last checked in. A failed update no longer knocks a working agent offline.

Fixed

• Service Manager reliability hardening. Whole-host snapshots now include parked/disabled vhosts (so restoring truly brings them back); host scanning works on non-standard nginx layouts (custom --prefix); the on-host agent can't apply a change after AtlasEye has stopped waiting for it; saving a draft is refused where it wouldn't actually stay disabled; and a change interrupted by a restart is now flagged for review instead of silently retried.

Added

• Service Manager discovers hosts automatically. A host you add is scanned in the background right away, and every managed host is re-scanned periodically, so its vhosts, certificates, and config stay current without you clicking Discover. The button is now a Rescan (refresh-now) action, and the list shows when each host was last scanned.

Fixed

• Health checks now probe the vhost's real endpoint. A TLS-only (HTTPS) vhost was previously checked on port 80 — where an unrelated site could answer and make a broken site look healthy. Apply now probes the vhost's actual listen port over TLS, so a failed reload of an HTTPS-only site is caught and rolled back.

Fixed

• Service Manager reliability & safety hardening. A batch of edge-case fixes to nginx config apply, certificate lifecycle, and snapshot/restore: an apply that fails mid-write now rolls back cleanly (no half-applied host), a frozen host now raises a visible critical alert, a whole-snapshot restore truly returns the host to the captured state (removing anything added since), wildcard auto-renewal no longer risks Let's Encrypt rate limits when delivery keeps failing, and revoking a certificate that's still serving a live site now warns and requires confirmation.

• Service Manager agents are clearer and more reliable. Updating an agent is now called exactly that — the "update available" tag is clickable and the menu says "Update agent". A healthy agent no longer wrongly shows "offline" (the status refreshes on its own), and "update available" only appears when the agent is genuinely too old — not on every release. Failures that need your attention (like a frozen host) now stay on screen, and actions against an offline agent fail immediately with a clear message instead of hanging.

• See how each managed service is connected — and when an agent needs updating. Every row now shows SSH or Agent; agent hosts show whether they're online and flag update available when the on-host agent is an older build (re-enroll to update it). Re-enrolling now correctly restarts the agent (previously the old one could keep running).
• Errors stay on screen. Service Manager operation errors (like a failed Discovery) now show a notification you can read and copy, instead of a message that disappears in a couple of seconds.