Stasys

Fixed

• A security maintenance window stays before its deadline when it is announced late. A window announced late was moved to give full notice onto the next allowed maintenance day, which could fall after the security deadline it was booked for. Security windows now keep any weekday within your maintenance hours when they are moved.

Fixed

• Windows machines no longer show as "not shipping metrics" while they are. The live-host check looked for the system load average, which Windows does not have, so Windows machines always looked dark. It now uses memory size, which every agent sends. The telemetry status page's host count is corrected the same way.

Changed

• Unusual outbound traffic incidents now show when the server's own backup was running. If a backup of the server was sending data when the alert fired, the incident says so, with how much was sent and when the run started. A first whole-server backup is by far the largest.

Fixed

• Hosting-platform "compliance red" incidents now say which control failed. The platform sends the control's name with the alert, but the incident page did not show it. It now appears in the headline and as a fact.

Fixed

• "Not shipping metrics" incidents now close when the server starts sending metrics again. Recovery was never recorded, so one machine's incident stayed open for nine days while it reported every 30 seconds. The alert now clears on the first check after metrics arrive.

Fixed

• SSH login probes and web rate-limit refusals no longer trigger "Service error storm" incidents. The rule counts log lines containing "error", which included SSH guesses at users that don't exist (already handled as a security event) and the web server refusing requests over its rate limit. Four ignore rules now keep these out of every rule's count. The lines remain in the log store, and you can remove the rules under Log rules.

Fixed

• Security updates are now scheduled before their 14-day deadline even when maintenance runs only on certain days. With maintenance limited to, for example, Sundays, the extra security window rounded forward to the next allowed day, which could fall after the deadline. When that happened, nothing new was booked. A security window now keeps your allowed hours and the full notice period, but may fall on any day of the week.

Fixed

• Whole server backups no longer warn about missing database tools on servers that don't need them. A Whole server backup adds a database-dump step automatically, so a server without PostgreSQL or MySQL tools got a warning on every run. The warning now appears only when the policy chose database dumps.

Changed

• The recovery card explains how the backup server itself comes back. The backup server is no longer listed as a server that cannot be brought back. Its backups live on its volume, which outlives the server: rebuild it with the installer and attach the volume again. It is left out of the "proven" count.

Fixed

• Recovery drills now see a restored server boot. A drill restored a server and the copy booted to its login prompt, yet the drill reported that it did not start, because its check could not reach inside the test container. The check now runs through the server's service manager.

Fixed

• Sharing attacker sightings with the threat feed keeps working all day. Standby re-sent the whole day's sightings every hour, so the feed's daily allowance ran out within hours and later sends were refused, showing the worker as broken. Standby now sends only what changed since the last accepted send. Reaching the daily allowance is shown as exactly that, not as a broken connection.

Fixed

• The security overview no longer counts logins you marked as false positives as attacker logins. A known automation account logging in with a new key was flagged, marked as a false positive, and still counted in the "attacker logins" figure for a week. Logins marked as false positives are now left out.

Fixed

• Recovery drills now run on backup servers set up with the installer. The drill looked the backup server up by an id the installer never stores, so "Drill now" refused every server even though the Backups page showed the backup server enrolled. It now finds it by name as well.

Fixed

• Disk alerts and disk charts now cover Windows drives. Only Linux filesystem types were treated as data disks, so an NTFS drive could never trigger a disk alert. NTFS and ReFS drives now count.

Changed

• The recovery card shows which servers have no backup at all. Servers that no backup policy covers now read "Not backed up", and servers whose policy saves only some folders say they cannot be rebuilt from them. Neither offers a recovery drill, which needs a whole-server backup. The header counts both next to how many servers are proven.

Fixed

• Moving backups onto the backup server's volume now completes. The previous update's mounting fix was skipped because of a faulty check, so the move still rolled back. The check is corrected.

Fixed

• Disk alerts, disk charts and free-space figures now read what the agents actually send. Five places asked for a free-space figure that no agent sends, so they came back empty and the disk alerts could not fire. They now use the agent's own used percentage, which matches what df shows on the server, and fall back to used and free bytes where that is not sent (Windows).

Fixed

• The backup server's volume is now mounted for the whole server, not only for the Standby agent. The agent works in a protected view of the server's disks, so a volume it mounted was invisible to the backup service, and moving backups onto the volume kept rolling back. The volume is now mounted through the server's service manager, so everything on the server sees it. This applies to the backup-server installer too.

Fixed

• Hosting-platform incidents now name the machine in the incident list. These alerts often identify a machine only by an id, so several incidents could read exactly the same. The machine's name is now added to the title as soon as it is known, including for incidents from the last 30 days.

Fixed

• The built-in disk, inode and CPU alerts now fire. The rules added in the previous update stored their limits in the wrong unit, so a disk at 81% never triggered the 80% alert. They now trigger at 80%, 90%, 90% and 95% as intended. Installs that already have them are corrected automatically; a limit you changed yourself is left as you set it.

Fixed

• Moving backups onto a volume keeps whatever is already on it. If the volume already has a backup folder, for example from an earlier installation, it is renamed aside and kept untouched. The move copies into a clean folder and never writes over the old one.
• A failed move always shows its reason on the Backups page. The page also records where the backups really are, so it no longer believes they are on the volume when they are not.

Added

• The Backups page shows how the move went. While it runs, the notice says so and updates itself. Afterwards it says what moved where and how much space it freed on the system disk, or why it failed, with a Try again button.

Fixed

• Moving backups onto the backup server's volume now finds the backups wherever they are. It assumed the backups were in /mnt/backup and stopped when they were not. It now reads the backup service's own setting, copies everything onto the volume, checks every file arrived, and only then removes the old copy. If anything fails, the service is put back as it was.

Every install now alerts on disks, inodes and CPU, and a disk incident shows what is filling the disk.

Added

• A disk incident shows what is filling the disk. Each filesystem with its growth over a day and a week and when it will be full, and Find what is filling it: a read-only scan of the biggest directories and files, kept on the incident.

Fixed

• New installs had no alert rules. Every install now starts with disk over 80% and over 90%, inodes over 90%, and CPU over 95% for 30 minutes. Each is added once; one you delete stays deleted.
• Disk percentage is counted the way df counts it. It ignored the space kept for root, so 80.6% on the server read 75% in Standby.
• Disk forecasting and log rules run by default. Both were off unless switched on; log rules such as network-card hangs and database login failures had never run on a new install.
• kstack alerts name the machine. The machine's name is looked up from the nodes Standby already knows.

Whole-server backups, and a weekly drill that restores each server on the backup server and boots it.

Added

• Whole server backup preset. Everything on the disk except /proc, /sys, /run, scratch space and package caches, plus database dumps: what a server is rebuilt from.
• Weekly recovery drill that boots each server. The backup server restores each server's newest whole-server backup, checks it is a working system, boots it with no network, measures the restore and projects the time to be back on a fresh server, then deletes the copy.
• Can each server come back? on the Backups page. Last backup, last drill, its verdict in words, the projected time back on a fresh server, and Drill now.

Upgrading

Switch backup policies to Whole server once the backup server has room (Move to volume and Grow from 0.16.69). Allow scripts for the backup server on Host access: the drill runs there.

The backup server keeps backups on its data volume, not its OS disk.

Added

• Move to volume and Grow on the Backups page. When a backup server keeps its repository on the OS disk beside an unused volume, one button moves it, checking every file arrived before removing the old copy. When the volume was made bigger, Grow extends the filesystem online.

Fixed

• Backups were kept on the backup server's OS disk. The installer now mounts an attached, unused volume for the backups (formatting it only when it is blank) and refuses the OS disk unless ALLOW_ROOT_FS=1.
• Backup capacity can follow a volume. The Backups page no longer rewrites the repository's path to the disk that held it, which pinned capacity to the OS disk.

Upgrading

Allow scripts for the backup server on Host access, then press Move to volume on the Backups page.