Software Lifecycle and Release Notes

Software Lifecycle Policy and Release Notes

LogZilla provides a defined lifecycle for each software release to ensure reliability, performance improvements, and timely security updates.

Support Phases

End of Support (EOS).

A release receives active support, including feature updates, bug fixes, and noncritical enhancements, for one year from its initial release date.

End of Life (EOL).

A release continues to receive security fixes and critical issue patches for two years from its initial release date. After this period, the release reaches EOL and no further updates are provided.

Customer Responsibilities

Customers are encouraged to remain on supported versions to receive the latest improvements, ensure platform stability, and maintain compliance with current security practices. Upgrading regularly helps avoid operating on outdated or unsupported components.

Extended Support

For deployments requiring an extended maintenance window beyond the standard policy, additional support options may be made available upon request.

Release Lifecycle Dates

Release Notes

This page lists the last three releases. Older notes are available in source control.

Version v6.43

Notable Features

• Executive Report - A scheduled weekly or daily report for managers summarizes platform health, security, operations, and identity activity, with every figure compared to the previous period. It is delivered as an HTML email with an Excel workbook attached and is available as a JSON document through the API. The report is built from the Operations apps and GeoIP, does not use LogZilla AI, and is created and scheduled from the Reports page as the Weekly Executive Report or Daily Executive Report preset. New installations come with the Weekly Executive Report scheduled for the admin account every Monday at 06:00; the schedule switches on once the SMTP server or the sender address is changed from its default and the admin account has an email address.
• Operations Apps and GeoIP Installed by Default - The SecOps, ITOps, NetOps, AuthOps, and ComplianceOps apps, and the GeoIP app, are now installed on new installations and added on upgrade to systems that do not have them. Their cross-vendor dashboards, severity and threat levels, and geolocation tags are available without an App Store step.
• Built-in ServiceNow Event Management Action - Triggers can now send matched events to ServiceNow Event Management directly. The instance is configured once under Settings > System Settings > ServiceNow, and Send to ServiceNow is then enabled per trigger. Events are batched per trigger, delivered with retries, and mapped to ServiceNow severities through an adjustable table. This replaces the ServiceNow Event Management app introduced in v6.42: on upgrade the app is removed, its connection settings move to System Settings, and its script triggers are converted to the new action. Administrators should review the filters of the converted triggers, since each matched event is forwarded to ServiceNow.
• LogZilla AI - The AI assistant formerly called Copilot is now LogZilla AI across the interface, settings, and documentation. The large language model (LLM) client libraries have been updated to their current releases, so the latest models from each provider are supported, new installations default to Claude Sonnet 5, and the Model Name setting is now a drop-down populated from the provider's own model list.
• AI Reports - A saved prompt can now run as a scheduled report. A report template with the AI source stores the prompt text, the configured LogZilla AI model answers it on the report's schedule, and the answer arrives as an HTML email, with the same document stored as the report file. AI report templates are created through the API and require LogZilla AI to be enabled. The model answers from the instance's stored events, which it queries with the permissions of the user who scheduled or ran the report, and the report is rendered as text and tables.
• New AppStore Application - Added a LogZilla app for Juniper MX routers and EX switches, complementing the existing Juniper SRX app, with parsing rules, dashboards, triggers, and an event generator.
• Query Scheduling - Interactive searches and dashboard refreshes are now served ahead of long-running full-scan queries such as AI-driven analyses, and a canceled or expired full-scan query now stops instead of continuing in the background, so one heavy query no longer slows the interface for other users.
• Dashboard Performance on High-Volume Tags - Several tags that were treated as high-cardinality now use the pre-aggregated counters: Interface in the Cisco IOS, Cisco Nexus, and Dell N-Series apps, and the Linux Service tag after per-session systemd descriptions are normalized. For time ranges that include data recorded before the upgrade, widgets on these tags still query stored events; ranges containing only new data use the pre-aggregated counters.
• License Expiration Warning - On new installations the expiration warning now starts 60 days before the license lapses, allowing more lead time for renewal. Existing installations keep their stored value; the License Expiration Warning Days field under Settings > System Settings > Generic is now documented so it can be raised.
• App Settings Preserved on Upgrade - Values entered in an AppStore app's configuration now survive the app's version upgrades instead of reverting to the shipped defaults.

API Updates

• LZ-3439 - ServiceNow Event Management Trigger Action - Added the send_servicenow trigger action with per-trigger batching (each trigger sets its own period; the Triggers setting SEND_SERVICENOW_PERIOD, default 60 seconds, applies when none is set), retry with backoff, a configurable severity map, and templated fields with event placeholders. A new servicenow settings group holds the instance URL and credentials. The ServiceNow Event Management app is retired: it is removed on upgrade, its configuration is imported, and its triggers are converted automatically. The trigger dialog gains the Send to ServiceNow option, System Settings gains a ServiceNow group, and a placeholder picker lists event fields, trigger fields, and user tags for the email, webhook, and ServiceNow templates.
• LZ-3440 - App Configuration Carried Across Upgrades - App upgrades now carry the installed configuration forward instead of resetting it to the shipped defaults.
• LZ-3442 - Executive Report - Added the executive_weekly and executive_daily report presets. GET /api/report-presets now returns requires_apps and missing_apps for every preset, and generating a preset report whose required apps are not installed is refused with a message naming the apps. App definitions returned by GET /api/apps carry an aggregate flag. A new exec_report settings group holds the report's branding, link paths, and attention thresholds. A scheduled executive report is emailed as an HTML message with the Excel workbook attached, and a JSON report follows the logzilla.exec-report/1 schema when downloaded through GET /api/reports/{id}/export.
• LZ-3452 - Reports API - Generated reports now carry schedule, template, and document_id, so GET /api/reports-schedules/{id}/reports lists the runs of a schedule and GET /api/reports?document_id= finds the report behind an executive report document. The report file_type values are now csv, xlsx, and json; the unused xls, htmldoc, pdf, and docx values are gone. Creating or updating a report template checks preset_code against the available presets and file_type against the formats of the preset or dashboard, and creating a schedule without a template returns 400 instead of a server error. Excel downloads from GET /api/reports/{id}/export and GET /api/query/{qid}/export, and the emailed workbook, are served as application/vnd.openxmlformats-officedocument.spreadsheetml.sheet.
• LZ-3453 - Report schedule recipients - email_to on POST /api/reports-schedules and on PUT and PATCH /api/reports-schedules/{id} accepts several addresses separated by commas. Each address is validated, the stored value is returned as a comma-separated list without spaces, and the scheduled report is sent as one message addressed to every recipient.
• LZ-3493 - Run-Now Report Delivery - POST /api/reports-templates/{id}/generate accepts an optional JSON body with email_to, recipient addresses separated by commas in the shape a schedule stores. Each address is validated with the schedule's rules and a bad one is refused with 400 before the run starts. When recipients are named, the report is mailed as a scheduled run would mail it; without them the run stores the report and sends no mail, as before.
• LZ-3454 - Default executive report - A new installation creates the Weekly Executive Report template and an inactive Monday 06:00 schedule for the admin account; the schedule is switched on, addressed to the admin, once SMTP_SERVER or MAIL_SENDER is changed from its default and the admin account has an email address. EXEC_REPORT_DEFAULT_SCHEDULE in the exec_report settings group disables this. Cron report schedules are now evaluated in the server time zone (TIME_ZONE) instead of UTC; on servers with a time zone other than GMT, existing cron schedules move to the configured wall-clock time after their first run following the upgrade. A scheduled preset report whose required apps are not installed is logged as a warning naming the report and the apps.
• LZ-3456 - AI Reports - Added the ai report template source. POST /api/reports-templates with source: "ai" stores the prompt text in the new prompt field; the template's file_type is htmldoc, the only type the source produces, and is set when the request names none. Creating, updating, or generating an AI template while LogZilla AI is disabled returns 400 with a message that says to enable AI features in Settings. A scheduled run drives the configured model through the LogZilla query tools as the report's owner, so the answer is built from the instance's events under that user's host permissions, then renders the Markdown answer as an HTML document, mails it as the message body without an attachment, and stores it as the report file, which GET /api/reports/{id}/export serves as text/html with an .html download name. Raw HTML, links, and images in the answer are rendered as text. A run that cannot complete produces no report: with LogZilla AI disabled it is logged as an error naming the report; a run that reaches the AGENT_MAX_RUN_TIME limit is logged the same way and mails the schedule's recipients (or the owner) a notice naming the template and the limit.
• LZ-3495 - Report Export Error Detail - Addressed an issue where GET /api/reports/{id}/export for a report whose file could not be opened returned an error message containing the server's filesystem path. The message now names the report and its file, and the path is recorded as a warning in logzilla.log instead.
• LZ-3494 - Report Readiness Flag - Generated reports now carry ready, true once the report file has been written, on GET /api/reports, GET /api/reports/{id}, GET /api/reports-schedules/{id}/reports, and in the result of a report generation task. A preset or AI report run lists its report before it writes the file, so a client listing reports can tell a report that is still being generated from one that can be downloaded.
• LZ-3496 - Report Rows Without an Owner - Addressed an issue where GET /api/reports/{id}, GET /api/reports/{id}/export, and DELETE /api/reports/{id} returned a server error for a report that has no owner, although GET /api/reports listed it. Such a report is now readable, exportable, and deletable by every user who can list it.
• LZ-3497 - Run-Now Report Failure Notice - Addressed an issue where the failure notice for an AI report started with POST /api/reports-templates/{id}/generate, mailed when the run reached the Agent Max Run Time limit, described the report as scheduled and advised running the schedule again. The notice now describes a run started on demand and advises running the report again; the notice for a scheduled run is unchanged.
• LZ-3498 - Interrupted Report Cleanup - A report whose run was cut short by a restart of the background worker no longer stays listed with ready: false indefinitely. An hourly check removes a report that has no file once it is older than the Agent Max Run Time setting plus one hour. This covers a report whose run was cut short and a report whose file was removed from the server. A report that is still being generated and a report whose file exists are never touched, and each removal is recorded in the celeryworker log.
• LZ-3499 - API Schema Action Summaries and Task Responses - Addressed an issue where eleven viewset actions appeared in the OpenAPI documents (GET /api/schema, GET /api/dev-schema) without their summary, description, or query parameters, among them POST /api/dashboards/{id}/widgets (source_id), GET /api/license/info (with_counters), GET /api/events/{ev_id}/timestamps, GET /api/triggers/{id}/history, the recalculate, remove, and stop query actions, and GET /api/reports-schedules/{id}/reports. The operations that start a report task (POST /api/dashboards/{id}/report, POST /api/widgets/{id}/report, POST /api/reports-templates/{id}/generate) and GET /api/events/{ev_id}/explain_nowait now document the response they send: 202 with task and status, or 408 and 500 with detail and status. Operation ids and behavior are unchanged.
• LZ-3500 - API Schema Action Responses and License Operation Ids - Addressed an issue where several operations in the OpenAPI documents (GET /api/schema, GET /api/dev-schema) declared a request body or a response other than the one the server reads or sends. POST /api/dashboards/{id}/widgets and POST /api/dashboards/{id}/templates now document 201, the latter without a request body; DELETE /api/dashboards/{id}/widgets/ documents the dashboard it returns; GET /api/events/{ev_id}/timestamps documents its page of timestamps with the page and page_size parameters; and GET /api/events/{ev_id}/triggers, GET /api/triggers/{id}/history, and GET /api/reports-schedules/{id}/reports document the arrays they return. POST /api/dashboards/{id}/report, POST /api/widgets/{id}/report, and POST /api/query/{qid}/stop no longer document a request body. Two operation ids changed: GET /api/license/info is license_info_retrieve (was license_info_retrieve_2), and the legacy GET /api/license-info is license_info_legacy_retrieve (was license_info_retrieve) and is marked deprecated. Clients generated from the documents should be regenerated; behavior is unchanged.
• LZ-3501 - Task State Enum Order in the OpenAPI Documents - Addressed an issue where the CeleryTaskStatusEnum component of the OpenAPI documents (GET /api/schema, GET /api/dev-schema), shared by GET /api/async-results/{id}, the archive and performance test operations, the operations that start a report task, and GET /api/events/{ev_id}/explain_nowait, listed its members in an order that changed from one API worker or render to the next, so document diffs and regenerated clients changed without an API change. The members are now listed alphabetically with IN_PROGRESS last. The member set and behavior are unchanged; a client regenerated from the documents sees the members reordered once.
• LZ-3362 - LLM Library Update and Model List - Updated the LLM client libraries to their current releases, changed the default provider and model for new installations to Anthropic and claude-sonnet-5, and added GET /api/settings/ai/models, which returns the models offered by the configured provider. In the AI settings, the Model Name field is now a drop-down fed by this list, with a message when the list cannot be fetched.
• LZ-3492 - Model List From Unsaved AI Settings - Added POST /api/settings/ai/models, which lists the models a provider offers for the provider, API key, and base URL sent in the request body, each falling back to the saved LogZilla AI setting when omitted. Nothing is saved by the call, so a settings form can fill its Model Name list before the settings are stored. GET /api/settings/ai/models is unchanged. Provider error messages returned by either call are cut to one bounded line with any recognizable piece of the API key they echo blanked out. The Model Type field in the LogZilla AI settings now shows a description instead of "undefined".
• LZ-3502 - AI Settings Accept Every Model the Provider Offers - Addressed an issue where saving the LogZilla AI settings with an Anthropic or OpenAI model missing from LogZilla's built-in list of model sizes, usually one released after the LogZilla version in use, was rejected with a message listing every model on that list, even though the provider had just listed the model, and where such a name, once saved, failed every chat answer, event explanation, and AI report. Such a model now uses the Context Window setting, or 200000 for Anthropic and 128000 for OpenAI when the setting is empty; a model on the list keeps its listed size, and the test completion at save time remains the check that the model exists. When the provider answers that the model was not found, the error is shown on the Model Name field with a short message; when it answers that the key is unauthorized, on the Api Key field. The provider's error text is cut to one bounded line with any recognizable piece of the key blanked out.
• LZ-3503 - Context Window Fallback for vLLM and Ollama - Addressed an issue where saving the LogZilla AI settings with the vllm/ollama provider and an empty Context Window field was rejected with a message naming an 8192-token context window although no value had been entered. An empty field now falls back to the 100000 minimum for vLLM/Ollama, as it already does for OpenRouter; a value that is set is used as given.
• LZ-3504 - Settings Validation Errors Without the Submitted Values - Addressed an issue where a rejected logzilla settings update printed the validation message together with part of the submitted settings values, which can include a secret such as an API key, and where the same text was written to the log when a ServiceNow settings import was rejected. The message now lists one entry per problem: the setting name, or the settings group for a check that spans the group, followed by the validation message. The settings API responses are unchanged.
• LZ-3505 - Superuser Flag Read-Only in the Users API - Addressed an issue where the users API accepted the is_superuser field in a create or update request from a non-administrator account that holds the Manage Users permission, which let that account grant full administrator rights to itself or to another user. The field is now read-only for every caller, like is_admin; administrator rights are granted only through admin group membership, which only an administrator can assign.
• LZ-3506 - Authentication Failure Limits - Added a limit on repeated authentication failures. Five failed logins for one username from one client address lock that username from that address for the rest of a five-minute window, and an address that produces 30 failed logins, or separately 30 unknown API tokens, in that window has further failures of that kind answered with 429 Too Many Requests and a Retry-After header. Correct credentials, internal LogZilla components, and the HTTP event receiver are not affected. The limits are the new Auth Failure settings in the Auth and Sessions group, and each limit can be raised or switched off.
• LZ-3507 - API Token Value Shown Once - The value of an API token is now returned only by the request that creates it. GET /api/authtokens and GET /api/authtokens/{id} return the token's id and a masked form (masked_key, the type prefix and the last four characters) instead of secret_key; retrieve and revoke take the id, and a token that is not the caller's answers 404 unless the caller is an administrator or holds the Manage Users permission. logzilla authtoken list and info show the id and the masked form, and info and revoke take the id; create still prints the value on its last line. Authentication with existing tokens and event ingestion are unchanged.
• LZ-3510 - Client Address Behind Trusted Proxies - Added the AUTH_TRUSTED_PROXY_HOPS setting to the Auth and Sessions group. Set to the number of additional proxies or load balancers in front of LogZilla, it makes the authentication failure limits charge the client address those proxies recorded instead of the address of the proxy. The login audit now records the same address the limits charge. With the default of 0, the limits behave as before.
• LZ-3513 - Documentation Corrections from the Security and AI Settings Reviews - Corrected several documentation pages. The Server Settings page now states which settings files the watcher applies without a manual restart and which module containers read their settings at start; the API sample reports the Retry-After value of a 429 Too Many Requests response instead of waiting a fixed minute; the HTTP Receiver Settings page points to the supported token management paths; the two scripted token examples on the Data Archiving page now create their token the same way; and the LogZilla AI Installation page states that a keyless vLLM or Ollama endpoint needs no Api Key.
• LZ-3511 - Password Reset Key Failure Limit - The password reset endpoint now follows the authentication failure limit added in this release: wrong reset keys are counted separately from failed logins and unknown API tokens, and once an address has presented 30 of them within the failure window, further wrong keys from that address are answered with 429 Too Many Requests and a Retry-After header. A valid reset key is never refused, and requesting a reset key is not counted. Reset keys are now generated with a cryptographically secure random source.
• LZ-3515 - Inert AI Query Loglevel Setting Removed - Removed the QUERY_LOGLEVEL setting (Query Loglevel in the LogZilla AI settings group). The setting never had an effect: the code that was to write each AI query to the application log was never called, so no value of the setting changed what was logged. A value saved by an earlier release is ignored. To inspect the queries LogZilla AI runs, enable tracing in the same group's advanced settings: turn on Tracing Enabled and set Tracing Server Url to a Phoenix server.
• LZ-3509 - Script Server and Forwarder Reload Endpoints - Added POST /api/scripts/reload, which makes the Script Server pick up new, changed, and removed trigger scripts without a container restart (the workers are replaced one at a time and scripts that are running finish first), and POST /api/forwarder/reload, which reloads the forwarder configuration and reports the module's reply. Both require the Manage Settings permission. Installing or removing an app that ships scripts now requests the same reload, so the manual logzilla restart -c scriptserver step after an app installation or removal is no longer needed. Enabling Event Correlation and the forwarder through PATCH /api/settings/sec and PATCH /api/settings/forwarder is the supported API path and is now documented in the API Endpoint Overview.
• LZ-3520 - Event Correlation Reload Command - Addressed an issue where logzilla settings reload sec and PATCH /api/settings/sec did not reload the Event Correlation (SEC) rules: the request the watcher sent to the SEC server carried no API token and was refused, while the watcher reported a successful reload. This affected every release since v6.35, so rule changes took effect only when the SEC container restarted. The watcher now authenticates the request, gives up after 30 seconds without a reply, reports the number of running instances, and restarts the SEC container when the request fails. A reload the SEC server refuses because an instance's config.yaml is invalid is reported in the watcher log and the running instances keep their previous rules.
• LZ-3518 - Event Correlation Documentation Corrections - Corrected the Event Correlation Overview, the Advanced Event Correlation Walkthrough, and the Forwarding to Event Correlation pages, which applied forwarder configuration changes with a logzilla settings reload command that does not reach the forwarder module, so the command returned without reloading the forwarder. The pages now use logzilla forwarder reload, and the Forwarding to Event Correlation page names POST /api/forwarder/reload as the equivalent for an API token. The same pages placed SEC rule files in a rules/ subdirectory that the SEC instance never reads; they now place them directly in /etc/logzilla/sec/<instance>/.
• LZ-3519 - Forwarder Reload Reports Failures - A forwarder reload now fails when the new configuration could not be applied in full: logzilla forwarder reload exits with a non-zero status and POST /api/forwarder/reload answers 500, naming the file that could not be loaded or whose forwarder failed validation, and the previous configuration stays active. A forwarder that the forwarding engine refuses also fails the reload, with the details in the forwarder module log. Earlier releases of logzilla forwarder reload reported success and only logged the file that was skipped. A successful reload now reports the number of enabled forwarders. A forwarder file that an earlier release skipped makes the reload fail until it is fixed or removed.
• LZ-3517 - Event Correlation and Script Test Endpoints - Added GET /api/sec, GET /api/sec/{name}, POST /api/sec/reload, and POST /api/sec/{name}/events, which list the SEC instances, report one instance's rule statistics and memory use, reload every instance, and write test lines into one instance, and POST /api/scripts/run, which runs one trigger script with a supplied event and returns its output. All require the Manage Settings permission and a user token, so a deployment tool no longer needs the internal API token to operate the SEC server. A SEC reload now also starts an instance whose directory was created after the SEC server started, which previously needed a container restart, and refuses an instance whose config.yaml is invalid with an error that names the instance, instead of failing with an unexplained server error.
• LZ-3521 - File Forwarder Output Kept Across Reloads - Addressed an issue where every forwarder reload and every start of the forwarder module emptied the output file of each file forwarder, so the file only held the events forwarded since the last reload or restart, and a reload that was refused left the running forwarder writing past a gap of zero bytes. The forwarder now appends to an existing file, a refused reload leaves the file unchanged, and logzilla forwarder print no longer empties a file it can reach. Rotation with rotate_period is unchanged: the .0 file keeps the earlier events and the new file starts empty.
• LZ-3516 - Artifact File API - Added GET, PUT, and DELETE /api/artifacts/{path} for single files under /etc/logzilla/sec, /etc/logzilla/forwarder.d, and /etc/logzilla/scripts, so an orchestration client on another host can deploy event correlation rules, forwarder configuration files, and trigger scripts without an SSH account. Paths are confined to the three directories, forwarder files are validated against the forwarder's rule models, and scripts must start with an interpreter line before a file is replaced; a rejected write leaves the previous file in place. Reads return the file with its SHA-256 hash. The endpoints require the new Manage Artifacts permission or an admin account.
• LZ-3429 - Gemini and OpenRouter Client Parameters - Addressed an issue where the API base URL and request timeout settings were not applied to Gemini connections, and the API base URL was not applied to OpenRouter.
• LZ-3419 - HTTP Receiver Worker Stability - Addressed an issue affecting some customers, mostly on slower hosts, where an HTTP receiver worker was repeatedly restarted during startup. The AI libraries are now loaded only when the AI features need them, and the worker health check now allows 60 seconds instead of 5 for a worker to start.
• LZ-3471 - AI Query Agent on Slow Systems - Addressed an issue where every LogZilla AI question failed with a query timeout on systems where the one-hour vendor summary behind the query agent took longer than 10 seconds. The agent now proceeds with all installed apps in its context and retries the summary after five minutes.
• LZ-3477 - AI Query Agent Date Ranges - Addressed an issue where the LogZilla AI query agent computed Unix timestamps by hand for questions such as "yesterday" and could query the wrong day, or even the wrong year, returning no results until it retried. The agent is now steered to the server's named ranges (today, yesterday, last N hours, days, or weeks), and every range is resolved in the user's time zone.
• LZ-3478 - Time Range Presets with Singular Units - The query API and the LogZilla AI query agent now accept time range presets with a singular unit, such as last_1_hour; previously only the plural form (last_1_hours) was accepted and the API answered with a server error. The Query API Parameters page has been corrected to match, including the long-standing default of UTC for queries that omit timezone.
• LZ-3467 - API Database Connections Under Load - Addressed an issue where the API did not release its PostgreSQL connection at the end of each request, so bursts of requests could exhaust the database connection limit, fail the health check, and restart the API workers. The health check no longer depends on the database.
• LZ-3473 - Bounded API Database Connections - In the standard Docker deployment each API worker now draws its PostgreSQL connections from a bounded pool. A burst of requests waits briefly for a free connection instead of opening one per request, so a refresh storm from many browser tabs can no longer exhaust the database connection limit. The per-worker maximum is the Api Db Pool Max Size field under Settings > System Settings > Generic, shown when Show Advanced Settings is enabled (default 20).
• LZ-3472 - Live Update Client Disconnect - Addressed an issue where a browser closing a dashboard or search while a live update was being delivered was logged as an error with a traceback in logzilla.log. The disconnect is now treated as a normal client disconnect.
• LZ-3491 - AI Answers Survive a Client Disconnect - Addressed an issue where closing or leaving the LogZilla AI page while an answer was being built interrupted the queries behind it, logged an error, and discarded the answer. An answer now runs to completion on the server, is stored in the conversation, and a browser that reconnects while it is still under way sees its progress and the result. Every AI run, whether a chat answer or a scheduled report, is bounded by the new AGENT_MAX_RUN_TIME setting (Agent Max Run Time, default 900 seconds, range 60 to 7200) in the LogZilla AI settings. A chat answer that reaches the limit ends with a message naming it; a scheduled AI report that reaches it mails the schedule's recipients (or the report owner) a notice instead of the report and is logged as an error.
• LZ-3476 - AI Tracing Log Noise - With tracing enabled, the AI assistant no longer logs an "Unhandled event" warning for every step of a conversation.
• LZ-3475 - AI Tracing Dependencies - The runtime image no longer includes the Phoenix tracing server package, which LogZilla never ran: traces are exported to the external tracing server configured in the AI settings. With tracing enabled, API workers no longer load the server's web, database, and machine learning libraries at startup, and the runtime image is about 0.5 GB smaller.
• LZ-3489 - Dictionary and Widget Type Requests on Large Systems - Addressed an issue where every dictionary and widget type request enumerated the user tag names through an InfluxDB metadata scan, which takes seconds on systems with millions of aggregate series, so the legacy web interface could fail to load after login. The name list is now fetched once per API worker and refreshed in the background when a request finds it older than 60 seconds; no_cache=true still forces a fresh fetch. The built-in dictionaries (severity, facility, status, time range, script, and sec) no longer trigger it at all.
• LZ-3406 - Query Priority and Broker Timeouts - Query requests now carry a priority so interactive requests are served first, and canceled or expired full-scan queries stop promptly. The AI query agent is steered toward bounded time ranges, and the query module's broker timeouts are exposed as the QUERY_POLL_TIMEOUT and QUERY_LIFECYCLE_TIMEOUT runtime settings (default 30 seconds).
• LZ-3355 - Ingestion During a License Lock - Addressed an issue affecting some customers where the HTTP receiver rejected events with an authorization error while the license was expired or over its limit. LogZilla's own internal API calls are exempt from the license lock, so event processing continues while the interface is locked.
• LZ-3437 - Internal API Session Handling - Internal API callers that reach the login or logout endpoints now receive a client error response (login) or no action (logout) instead of a server error.
• LZ-3416 - SEC Reload Response - Addressed an issue where reloading SEC handlers through the API reported a server error even though the reload had succeeded.
• LZ-3308 - Example SEC Rule - The sample SEC rule is no longer installed by default, freeing the memory it consumed.
• LZ-3435 - Filter Validation for Substring Operators - Filters and rewrite rules that use the =* or !* substring operators with a wildcard value are now rejected at save time with a message pointing to eq and ne, since those operators match literally and such a filter could never match. Previously saved objects continue to load, with a warning in the logs.
• LZ-3441 - Word Filter Validation - Addressed an issue where a malformed word expression under the nwm operator was accepted at save time instead of being rejected like wm.
• LZ-3431 - Trigger Filters That Never Fired - Corrected two shipped triggers (Microsoft AVD domain checks and Squid 5xx responses) whose substring filters used wildcard values and therefore never matched, and aligned the Microsoft app schema and README with the shipped rules.
• LZ-3410 - IBM DataPower Port Parsing - Addressed an issue where events sent to the dedicated DataPower port were not parsed by the DataPower app, and standardized the app's source type value. The app's triggers and README were tidied at the same time (LZ-3434).
• LZ-3411 - UniFi Gateway Daemon Events - DHCP, DNS, BIND, and PAM events from UniFi gateways on the UniFi port are now parsed by the corresponding Linux apps. They keep their Ubiquiti vendor and UniFi product tags and remain on the UniFi dashboards (LZ-3433).
• LZ-3427 - Cisco User Tag Extraction - The Cisco rules no longer keep surrounding quotes in the User tag or tag words such as "was" and "access-group" as users, reducing User cardinality and cleaning up the Cisco dashboards.
• LZ-3428 - High-Cardinality Declarations - Reconciled the high-cardinality declarations between rules and schemas across sixteen apps: translated ports, vendor vocabularies, and configured names now use the pre-aggregated counters, while users, client addresses, hostnames, and file paths stay high-cardinality.
• LZ-3422 - Interface Tag - The Interface tag is no longer treated as high-cardinality in the Cisco IOS, Cisco Nexus, and Dell N-Series apps, so their Interface TopN widgets use the pre-aggregated counters.
• LZ-3430 - Linux Service Tag - Systemd unit descriptions that embed session, user, or runtime identifiers are normalized before they reach the Service tag, session scopes are tagged as "User Session" with the user name in the User tag, and Service is no longer high-cardinality.
• LZ-3421 - Infoblox DHCP Hostname - The IB DHCP Hostname tag is now declared high-cardinality, since production deployments show a distinct value per client.
• LZ-3361 - Juniper MX and EX App - Added the parsing app for Juniper MX routers and EX switches, and scoped the Juniper SRX triggers and dashboards to the SRX product so the two apps do not overlap.
• LZ-3374 - Dell N-Series MAC Move Events - Addressed an issue where MAC move events were not parsed when the switch reports them under the FDB program.
• LZ-3371 - Raw Forwarding Example - Added a documented example of forwarding a raw source from LogZilla to another log receiver.
• LZ-3212 - Dashboard Filter Best Practices - Added a guide on moving multi-term message filters into a rewrite rule that sets a tag, so widgets filter on the tag instead of scanning message text.
• LZ-3424 - Rewrite Rule Documentation - Corrected the rewrite-rule walkthrough so the example file loads, documented the actual logzilla rules subcommands, described how rule order works, and added a page on rule test fixtures.
• LZ-3425 - Query API Operator Documentation - Corrected the query API filter documentation: =* is a literal substring match, wildcards belong to eq and ne, and qp is a legacy alias of wm.
• LZ-3399 - Windows Agent Download Location - Updated the Windows agent documentation to point at the repository that hosts the installer.
• LZ-3438 - License Warning Setting Documentation - Documented the LICENSE_EXPIRATION_WARNING_DAYS setting in the Server Settings reference.
• LZ-3533 - Postfix Overview Dashboard - Addressed an issue where every widget on the Postfix: Overview dashboard showed 0. The widgets selected events by a program name, Postfix, that the Postfix app stopped assigning in v6.40.0; Postfix events keep their component name (smtp, smtpd, qmgr). The dashboard and the Postfix triggers now select events by the Vendor and Product tags, and the Top Senders widget is filled from the sender the queue manager and rejected-mail lines log. Every Postfix line now carries the Vendor and Product tags, including the connection and cleanup lines the app previously left untagged, so the activity timeline and the live stream show the whole mail stream. Existing installations receive the corrected dashboard and triggers when the Postfix app is upgraded; a dashboard edited by hand as a workaround is replaced.
• LZ-3536 - Multi-Product App Schemas - The Cisco, Cisco ASA and FireEye apps now declare every Product value their rules assign (Cisco: IOS, IOS-XR, ASA, FTD and Wireless LAN Controller; Cisco ASA: ASA and FTD; FireEye: MPS, NX, EX, HX and CMS) instead of a single value, and the AI assistant's list of installed apps shows every Product value of such an app, so its queries can filter on the product an event really carries.
• LZ-3535 - Prisma SD-WAN Flow Denied Trigger - Addressed an issue where the Palo Alto ION: Flow Denied trigger never fired: it selected flow logs by a program name the app does not assign. It now matches the cgxFlowLog program the app stores for flow logs, so denied and rejected flows are marked and notified as documented. Existing installations receive the corrected trigger when the app is upgraded.
• LZ-3534 - Postfix Client and Relay Lines - The Postfix app now classifies the smtpd client= line (a connection event carrying the client address as SrcIP), the cleanup message-id= line (a queue event) and the smtp "connect to ... unreachable" line (a delivery failure carrying the relay that could not be reached as Postfix Relay), so a relay that cannot be reached is visible and searchable by tag. The app claims only programs whose syslog name starts with postfix and ends with the Postfix service, such as postfix/smtpd or postfix-out/smtp. Existing installations receive the new classification when the app is upgraded; saved searches and custom dashboards that count Postfix Event values connection or queue will see higher counts, because the client= and message-id= lines now fall into those categories.
• LZ-3538 - App Schema Completeness - The Cisco, FortiGate, FortiWeb, Linux iptables, NetOps and Prisma SD-WAN ION apps now declare every tag their rules set (XR Node, the FortiGate WAF tags, FortiWeb HTTP Method, Criticality, Link Status, the MITRE tags), so the AI assistant's field listing for those apps is complete. Existing installations receive the completed schemas when the apps are upgraded.
• LZ-3537 - Compliance Tags in App Schemas - Every app's field schema now includes the Compliance - <framework> tags its events carry (for example Compliance - PCI-DSS), derived from the event types the app classifies, so the AI assistant can filter on a compliance framework by tag. The tags appear in every installed app's schema after the server upgrade; no app upgrade is needed.
• LZ-3540 - AI App Field Listing - The AI assistant's per-app field listing now files Event Class, Event Type and the other common fields whose name differs from their schema key under Common instead of App-specific, and the assistant's summary of installed apps lists their Event Class and Event Type values when no aggregate app is installed. This takes effect after the server upgrade; no app upgrade is needed.
• LZ-3530 - SEC Instance Status Reads - GET /api/sec/{name} no longer terminates a SEC instance that was started moments earlier: the rule statistics dump is requested only once the SEC process has installed its signal handler, and a read that arrives before then waits for it or answers without the dump. Every instance read (GET /api/sec, GET /api/sec/{name}, POST /api/sec/reload) now reports pid, running, and returncode, so a monitoring view or a deployment check can tell a dead instance from a live one instead of receiving the same answer for both, and POST /api/sec/reload restarts an instance whose process has ended even when its files are unchanged. This takes effect after the server upgrade, which includes the SEC container.
• LZ-3544 - SEC Ingest Into an Ended Process - Lines sent to a SEC instance whose process ended moments earlier are now refused with the same sec is not working error a stopped instance returns, and the SEC server logs one line naming the instance, its process and how many lines of the batch it had accepted, instead of failing with an unexplained server error and a traceback. The forwarder redelivers the whole batch once the instance is running again, so lines accepted before the process ended can reach the restarted instance a second time. This takes effect after the server upgrade, which includes the SEC container.
• LZ-3545 - SEC Stop Escalation - Stopping a SEC instance whose process does not exit on SIGTERM now ends the process with SIGKILL after five seconds and logs that it did so, instead of waiting indefinitely while holding the instance's lock, which blocked the instance's status reads, ingest, reload and removal and held up the SEC container's shutdown. This takes effect after the server upgrade, which includes the SEC container.
• LZ-3546 - SEC Shutdown and Reload Stop Instances Together - The SEC container now stops its instances concurrently at shutdown and during a reload, so several instances whose processes do not exit on SIGTERM cost one five-second wait in total, instead of one wait per instance, which previously kept only a single stuck instance within the container's stop budget and within the reload timeout. A reload in which one instance fails to start now reloads the remaining instances and names the failing one in the log, instead of stopping at the failure and leaving the instances after it on their old rules. This takes effect after the server upgrade, which includes the SEC container.

UI Updates

• LZ-3200 - LogZilla AI - Renamed Copilot to LogZilla AI throughout the interface and settings.
• LZ-3201 - License Expiration Warning Default - New installations show the license expiration warning 60 days ahead instead of 30.
• LZ-3453 - Report schedule recipients - Send email to on the Reports page accepts several addresses separated by commas.

Version v6.42

Notable Features

• New AppStore Applications - Added LogZilla apps for Netskope Security Cloud, Proxmox VE and Ceph, and Netgate pfSense, along with a ServiceNow Event Management forwarder integration. Each parsing app ships with rules, dashboards, triggers, and an event generator.
• Application Ports on LogZilla Cloud - Vendor apps that rely on a dedicated Application Port on-premises can now be enabled on LogZilla Cloud by tagging events at the relay with a source type, reproducing the on-prem Application Ports behavior where devices reach the platform through a relay rather than a direct syslog listener.

API Updates

• LZ-3396 - Netskope Security Cloud App - Added a parsing app for Netskope CEF events that extracts DLP, threat, and web-activity tags and includes dashboards and triggers. Events are identified by content, so no dedicated receiving port is required.
• LZ-3382 - Proxmox VE and Ceph App - Added a parsing app covering Proxmox VE cluster, task, authentication, and firewall events together with Proxmox Ceph storage health, including dashboards and triggers. Events are identified by program name.
• LZ-3391 - pfSense App - Added a parsing app for Netgate pfSense firewall and DHCP events, with a dedicated receiving port (Syslog Pfsense Port) and accompanying dashboards and triggers.
• LZ-3384 - ServiceNow Event Management Forwarder - Added an integration app that forwards actionable LogZilla events to ServiceNow Event Management, with a configurable severity map and a forwarding health dashboard.
• LZ-3395 - Application Ports on LogZilla Cloud - Added documentation describing how to tag events at the relay so vendor apps that depend on a dedicated Application Port work on the cloud platform.
• LZ-3378 - Fortinet AppRisk Tagging - Addressed an issue affecting some customers where the AppRisk tag was not generated for certain Fortinet events.
• LZ-3369 - Exception Class Naming - Corrected the spelling of several internal exception class names and added aliases for the prior names so existing integrations continue to work unchanged.
• LZ-3306 - OpenAPI Schema Corrections - Corrected typographical and formatting issues in the published OpenAPI schema.
• LZ-3394 - FIPS-Enabled Host Support - Updated the container images to select a compatible OpenSSL provider so LogZilla runs correctly on FIPS-enabled host operating systems.
• LZ-3386 - Offline Installation Reliability - Addressed an issue affecting some customers where offline installations could time out while loading container images on slower systems.

Maintenance Releases

• LZ-3398 - Disk Metrics on RHEL (v6.42.1) - Addressed an issue affecting some customers on RHEL hosts where the disk metrics collector logged repeated errors for automount and pseudo filesystems.
• LZ-3397 - Stepped Upgrade Documentation (v6.42.1) - Expanded the upgrade guide with version targeting and stepped upgrades from older releases.
• LZ-3404 - Linux Authentication Dashboard Performance (v6.42.2) - Addressed slow-loading widgets on the Linux Authentication dashboard: TopN widgets now inherit the dashboard time range instead of a fixed "today" preset, and the Infoblox and VMware vSphere rules are gated on their dedicated source types so they no longer tag events from the shared stream.
• LZ-3409 - Cisco Meraki Port Parsing (v6.42.3 and v6.42.4) - Addressed an issue affecting some customers where events sent to the dedicated Meraki port were not parsed, and added handling for Meraki AMP security events.

Version v6.41

Notable Features

• App-Schema-Aware AI Queries - The LogZilla AI Copilot is now aware of every installed application's schema, tag taxonomy, and vendor context. A TopN vendor pre-filter surfaces the most active applications to the query agent automatically, producing substantially more accurate results for vendor-specific natural-language searches.
• AI Multi-Model Accuracy (LZ-3341) - Query agent prompts have been restructured for token efficiency and reliability across a wider range of LLM providers, including smaller and locally hosted models, with added decomposition guidance for complex multi-step requests.
• New AppStore Applications - Added LogZilla apps for BlueCat DNS (DNSTAP), FortiAnalyzer, FortiWeb, Arista EOS, Cisco IOS-XR, and Dell N-Series switches. Each includes parsing rules, dashboards, triggers, and event generators.

API Updates

• LZ-3335 - Query Agent Prompt Rewrite - Restructured the query agent prompt into a token-efficient format that retains clarity on low-end models, improving consistency of generated queries.
• LZ-3317 - App Schema Injection for AI Queries - The AI query agent now receives the installed application schema and vendor context from a TopN pre-filter, producing more accurate results for vendor-specific searches.
• LZ-3316 - Query Decomposition Guidance - Tightened the main agent prompt with explicit decomposition instructions for multi-step queries.
• LZ-3328 - Query Timestamp Handling - Resolved an issue where the query agent occasionally mixed a preset time range with explicit ts_from and ts_to parameters.
• LZ-3320 - Configurable LLM Request Timeout - Added a new REQUEST_TIMEOUT setting (default 300 seconds, range 30 to 3600) to the AI configuration, adjustable through ai.yaml or the Settings interface. The default was tuned to accommodate tool-call buffering on Ollama deployments running on slower GPUs.
• LZ-3333 - Claude 4.6 Model Support - Added support for the claude-opus-4-6 and claude-sonnet-4-6 model names in the AI configuration.
• LZ-3329 - AI Model Type Consolidation - Consolidated the "vllm" and "ollama" model types into a single "vllm/ollama" option that covers both backends. Existing saved configurations using "vllm" are migrated automatically; configurations still using the old "ollama" value are rejected with a message describing how to update the selection.
• LZ-3338 - Dynamic Phoenix Tracing - Phoenix trace export can now be enabled or disabled at runtime without restarting the AI worker process.
• LZ-3336 - vLLM Streaming Reliability - Addressed an issue where concurrent vLLM streaming sessions could collide; each streaming request now uses an isolated client instance.
• LZ-3343 - AI Timeout Guards - Added timeout protection to the explain_event and ping_llm paths so stalled model calls no longer delay event analysis.
• LZ-3324 - Typed Query Timeout Errors - Introduced a typed QueryTimeoutError returned to AI clients, allowing agents to distinguish timeouts from other query failures and retry appropriately.
• LZ-3323 - AI Module Resource Handling - Addressed resource handling in the AI module that could leave database connections and threads lingering under sustained load.
• LZ-3313 - Phoenix Trace Export - Corrected a tracing configuration issue that prevented spans from reaching Phoenix when enabled.
• LZ-3311 - FortiGate WAF and Tagging - Added WAF event support to the FortiGate application and introduced HC_TAGS handling across the Fortinet app family to reduce cardinality on high-volume fields.
• LZ-3354 - Dashboard and Widget Validation - Serializers now reject unknown fields in widget and dashboard payloads, surfacing typos earlier instead of silently discarding them.
• LZ-3354 - IOS-XR Node Extraction - Corrected the order of IOS-XR parent-rule processing so node identifiers are captured before the generic Cisco prefix cleanup runs.
• LZ-3360 - SonicWall SonicOS 7+ - Updated the SonicWall application to recognize the customized Syslog ID format introduced in SonicOS 7, and replaced message-based triggers with tag-based filters.
• LZ-3340 - Dell Switch Receiving Port - Added a dedicated receiving port for Dell N-Series switches.
• LZ-3358 - Infoblox NIOS Expanded Coverage (upgrade action required) - The Infoblox application has been expanded from DNS-query-only coverage to the full NIOS product: DNS, DHCP, administrative audit, Advanced DNS Protection, and Response Policy Zone events. Because some NIOS events use a non-RFC syslog header that collides with standard daemon names, the application now requires a dedicated receiving port. Customers already running the Infoblox app should set Syslog Infoblox Port under Settings > System Settings > Application Ports and reconfigure their Infoblox grid members to send to the new port. Until the port is configured and the grid members are repointed, Infoblox events will not be parsed by the application.
• LZ-3307 - Lifecycle Date Correction - Adjusted the published end-of-support and end-of-life dates to match the current lifecycle policy.

UI Updates

• LZ-3353 - License Status Reporting - The interface now displays the specific reason for a license error (such as exceeding the events per day limit), and on-prem deployments are redirected to a dedicated license error page when a 423 response is returned.
• LZ-3291 - Upgrade Notification Action - Replaced an outdated documentation link in the upgrade notification with a clipboard copy action that captures the upgrade command.
• LZ-3305 - Trigger Filter Initialization - Addressed an issue affecting some customers where the match-criteria field was missing when creating or editing triggers in the legacy interface.