Software Lifecycle and Release Notes

Software Lifecycle Policy and Release Notes

LogZilla provides a defined lifecycle for each software release to ensure reliability, performance improvements, and timely security updates.

Support Phases

End of Support (EOS).

A release receives active support, including feature updates, bug fixes, and noncritical enhancements, for one year from its initial release date.

End of Life (EOL).

A release continues to receive security fixes and critical issue patches for two years from its initial release date. After this period, the release reaches EOL and no further updates are provided.

Customer Responsibilities

Customers are encouraged to remain on supported versions to receive the latest improvements, ensure platform stability, and maintain compliance with current security practices. Upgrading regularly helps avoid operating on outdated or unsupported components.

Extended Support

For deployments requiring an extended maintenance window beyond the standard policy, additional support options may be made available upon request.

Release Lifecycle Dates

Release Notes

This page lists the last three releases. Older notes are available in source control.

Version v6.41

Notable Features

• App-Schema-Aware AI Queries - The LogZilla AI Copilot is now aware of every installed application's schema, tag taxonomy, and vendor context. A TopN vendor pre-filter surfaces the most active applications to the query agent automatically, producing substantially more accurate results for vendor-specific natural-language searches.
• AI Multi-Model Accuracy (LZ-3341) - Query agent prompts have been restructured for token efficiency and reliability across a wider range of LLM providers, including smaller and locally hosted models, with added decomposition guidance for complex multi-step requests.
• New AppStore Applications - Added LogZilla apps for BlueCat DNS (DNSTAP), FortiAnalyzer, FortiWeb, Arista EOS, Cisco IOS-XR, and Dell N-Series switches. Each includes parsing rules, dashboards, triggers, and event generators.

API Updates

• LZ-3335 - Query Agent Prompt Rewrite - Restructured the query agent prompt into a token-efficient format that retains clarity on low-end models, improving consistency of generated queries.
• LZ-3317 - App Schema Injection for AI Queries - The AI query agent now receives the installed application schema and vendor context from a TopN pre-filter, producing more accurate results for vendor-specific searches.
• LZ-3316 - Query Decomposition Guidance - Tightened the main agent prompt with explicit decomposition instructions for multi-step queries.
• LZ-3328 - Query Timestamp Handling - Resolved an issue where the query agent occasionally mixed a preset time range with explicit ts_from and ts_to parameters.
• LZ-3320 - Configurable LLM Request Timeout - Added a new REQUEST_TIMEOUT setting (default 300 seconds, range 30 to 3600) to the AI configuration, adjustable through ai.yaml or the Settings interface. The default was tuned to accommodate tool-call buffering on Ollama deployments running on slower GPUs.
• LZ-3333 - Claude 4.6 Model Support - Added support for the claude-opus-4-6 and claude-sonnet-4-6 model names in the AI configuration.
• LZ-3329 - AI Model Type Consolidation - Consolidated the "vllm" and "ollama" model types into a single "vllm/ollama" option that covers both backends. Existing saved configurations using "vllm" are migrated automatically; configurations still using the old "ollama" value are rejected with a message describing how to update the selection.
• LZ-3338 - Dynamic Phoenix Tracing - Phoenix trace export can now be enabled or disabled at runtime without restarting the AI worker process.
• LZ-3336 - vLLM Streaming Reliability - Addressed an issue where concurrent vLLM streaming sessions could collide; each streaming request now uses an isolated client instance.
• LZ-3343 - AI Timeout Guards - Added timeout protection to the explain_event and ping_llm paths so stalled model calls no longer delay event analysis.
• LZ-3324 - Typed Query Timeout Errors - Introduced a typed QueryTimeoutError returned to AI clients, allowing agents to distinguish timeouts from other query failures and retry appropriately.
• LZ-3323 - AI Module Resource Handling - Addressed resource handling in the AI module that could leave database connections and threads lingering under sustained load.
• LZ-3313 - Phoenix Trace Export - Corrected a tracing configuration issue that prevented spans from reaching Phoenix when enabled.
• LZ-3311 - FortiGate WAF and Tagging - Added WAF event support to the FortiGate application and introduced HC_TAGS handling across the Fortinet app family to reduce cardinality on high-volume fields.
• LZ-3354 - Dashboard and Widget Validation - Serializers now reject unknown fields in widget and dashboard payloads, surfacing typos earlier instead of silently discarding them.
• LZ-3354 - IOS-XR Node Extraction - Corrected the order of IOS-XR parent-rule processing so node identifiers are captured before the generic Cisco prefix cleanup runs.
• LZ-3360 - SonicWall SonicOS 7+ - Updated the SonicWall application to recognize the customized Syslog ID format introduced in SonicOS 7, and replaced message-based triggers with tag-based filters.
• LZ-3340 - Dell Switch Receiving Port - Added a dedicated receiving port for Dell N-Series switches.
• LZ-3358 - Infoblox NIOS Expanded Coverage (upgrade action required) - The Infoblox application has been expanded from DNS-query-only coverage to the full NIOS product: DNS, DHCP, administrative audit, Advanced DNS Protection, and Response Policy Zone events. Because some NIOS events use a non-RFC syslog header that collides with standard daemon names, the application now requires a dedicated receiving port. Customers already running the Infoblox app should set Syslog Infoblox Port under Settings → System Settings → Application Ports and reconfigure their Infoblox grid members to send to the new port. Until the port is configured and the grid members are repointed, Infoblox events will not be parsed by the application.
• LZ-3307 - Lifecycle Date Correction - Adjusted the published end-of-support and end-of-life dates to match the current lifecycle policy.

UI Updates

• LZ-3353 - License Status Reporting - The interface now displays the specific reason for a license error (such as exceeding the events per day limit), and on-prem deployments are redirected to a dedicated license error page when a 423 response is returned.
• LZ-3291 - Upgrade Notification Action - Replaced an outdated documentation link in the upgrade notification with a clipboard copy action that captures the upgrade command.
• LZ-3305 - Trigger Filter Initialization - Addressed an issue affecting some customers where the match-criteria field was missing when creating or editing triggers in the legacy interface.

Version v6.40

Notable Features

• LogZilla AI Configuration - AI settings are now managed through Admin → Settings in the UI rather than on-disk configuration files.
• Event Taxonomies - All LogZilla apps now follow a shared taxonomy standard and include additional drill-down tags such as Vendor, Product, MITRE, and ~150 compliance mappings (PCI-DSS, HIPAA, SOX, GDPR, and others).

API Updates

• LZ-3271 - VMware App Update - Updated the VMware application with refined event generation behavior.
• LZ-3256 - F5 Dashboard - Added a new dashboard for F5 device monitoring.
• LZ-2657 - Dashboard Metric Badges - Added count-style badge widgets to application dashboards for improved data visualization.
• LZ-3297 - Watcher CPU Optimization - Addressed higher-than- expected CPU usage from status checks in the watcher component.
• LZ-3293 - Taxonomy Consolidation - Created a unified source for application taxonomies and MITRE ATT&CK mappings.
• LZ-3277 - Trigger Configuration Regeneration - Addressed an issue affecting some customers where trigger configurations were not regenerated after app reinstallation.
• LZ-3276 - Upgrade Version Detection - Corrected version detection during upgrades so the latest available release is identified.
• LZ-3274 - App Standards Compliance - Updated multiple applications to follow new taxonomy standards and removed duplicate rules.
• LZ-3244 - Tag Naming Consistency - Standardized IP-related tag names across applications to reduce cardinality.
• LZ-3230 - User-Defined MCP Servers - Added support for user-defined MCP servers to enhance AI context for queries.
• LZ-3227 - Container File Limits - Adjusted file descriptor limits in containers for improved stability.
• LZ-3221 - SEC Rule Support - Modified App Store applications to support Event Correlation example configurations.
• LZ-3173 - Start Command Timeout Flag - Corrected the --no-timeout switch behavior for the logzilla start command.
• LZ-3157 - SonicWall App Enhancements - Added user login and VPN session tracking tags to the SonicWall application.
• LZ-3083 - Report Templates - Enhanced report templates with additional data sources and output format options.
• LZ-2700 - Search Results Formatting - Improved formatting options for search results display.
• LZ-3186 - AI Provider Expansion - Added support for additional AI providers including Gemini, vLLM, Ollama, and OpenRouter. Note: v6.41 consolidated the vllm and ollama model types into a single vllm/ollama option.
• LZ-3038 - API Validation Enhancements - Added input validators and refined API response handling.

UI Updates

• LZ-3272 - AI Session Copy Function - Enabled copying of individual AI chat responses within a session.
• LZ-3265 - AI Copilot Settings Save - Corrected a disabled save button in the AI Copilot settings section.
• LZ-3262 - App Store List Display - Corrected truncation of the last item in the App Store list view.
• LZ-3258 - Severity Chart Labels - Corrected severity name mapping so text labels appear instead of integers in all chart types.
• LZ-3251 - Error Message Improvements - Improved error handling and messaging after legacy interface deprecation.
• LZ-3240 - Trigger Filter Protection - Restricted editing of regex-based trigger filters to avoid accidental overwriting.

Version v6.39

API Updates

• LZ-3248 - Windows Agent Origin Computer - Added origin computer information from Windows event data as a user tag.
• LZ-3242 - AI Query Timestamp Validation - Addressed an issue affecting some customers where an exception surfaced when timestamp range validation failed in AI queries.
• LZ-3238 - AppStore Config Validation Testing - Added automated testing to validate application configurations against their schemas.
• LZ-3237 - Operations Dashboard App - Created a new Operations app providing a centralized dashboard for high-severity events, service disruptions, application errors, and infrastructure changes.
• LZ-3230 - User-Defined MCP Servers - Added support for user-defined MCP servers to enhance AI context for queries such as root cause analysis and event correlation.
• LZ-3227 - Container File Descriptor Limits - Corrected the open-file limit in containers so services requiring many file handles operate as expected.
• LZ-3219 - JSON Rules User Tags - Added support for user tags in the rewrite section of JSON rules.
• LZ-3217 - Lua Rules Event Generation - Lua rules can now generate new events, supporting additional event processing workflows.
• LZ-3214 - Rule Validation Fix - Addressed an issue affecting validation of rule files with list structures at the top level.
• LZ-3208 - Integrated AI Chatbot - Introduced an AI chatbot integrated with the LogZilla API, removing the need for separate containers or databases.
• LZ-3205 - WebSocket Migration - Migrated WebSocket functionality from Tornado to Django Channels for improved performance and maintainability.
• LZ-3204 - Help Menu Link Update - Updated the help menu to link directly to the LogZilla documentation website.
• LZ-3192 - Unified Query API Filters - Simplified query API filter logic to improve usability and AI query generation accuracy.
• LZ-3184 - Palo Alto Prisma App - Created a new LogZilla app for Palo Alto Prisma integration.
• LZ-3176 - HTTP Receiver Fix - Addressed an attribute error in the HTTP receiver token management component.
• LZ-3157 - SonicWall App User Tags - Added user information tags to the SonicWall app for tracking VPN login activity.
• LZ-3156 - Minimum Word Length Setting - Updated the minimum word length setting for search indexing.
• LZ-3146 - HTTP Receiver Documentation - Corrected a path typo in the HTTP Event Receiver documentation.
• LZ-3120 - Ubiquiti Rule Source Check - Updated the Ubiquiti rule to check for source tags so filtering works regardless of port configuration.
• LZ-3118 - Palo Alto App Documentation - Updated Palo Alto app documentation with Traffic, System, and Config event format examples.
• LZ-3116 - CDR Loader Startup Fix - Addressed an issue affecting CDR Loader startup on some deployments.
• LZ-3086 - Dashboard Export - Added the ability to export dashboards directly from the dashboard menu.
• LZ-3085 - Widget Export - Added the ability to export widget data in JSON, XLS, and PNG formats.
• LZ-3083 - Report Templates Enhancement - Enhanced report templates with additional data sources, format selectors, and Excel integration.
• LZ-3081 - New Reports Engine - Introduced a new reports engine supporting scheduled reports, multiple output formats, and direct exports from the interface.
• LZ-2858 - Ubiquiti UniFi OS Support - Added dedicated receiving port and rules for Ubiquiti UniFi device logs including iptables events.
• LZ-2720 - AV Rules to Apps Conversion - Initiated conversion of antivirus vendor rules to LogZilla apps for improved management.
• LZ-2693 - Checkpoint firewall app - Added a new Checkpoint firewall application to the AppStore.
• LZ-2482 - Juniper Dashboard installation - Addressed an issue affecting some customers where the Juniper dashboard was missing after app installation.
• LZ-2480 - Implement Ford triggers - Added over 300 triggers for Cisco WAAS, Cisco ACI, Cisco IOS, Cisco Nexus, Cisco ACE, SDWAN, Cisco ASA, and F5 platforms.
• LZ-3166 - AI chat API - Created a REST API for the LogZilla AI chatbot functionality.
• LZ-3236 - AI installation documentation - Improved formatting and clarity in the AI installation documentation.
• LZ-3235 - Splunk HEC forwarder documentation - Updated documentation to clarify both HTTP and HTTPS support for Splunk HEC forwarding.
• LZ-3232 - End of support policy documentation - Added software lifecycle policy documentation with end-of-support and end-of-life definitions.
• LZ-3194 - Cloud onboarding video - Added cloud onboarding video to the documentation.
• LZ-3189 - API documentation correction - Corrected errors in the detailed API method documentation.
• LZ-3148 - API documentation table formatting - Corrected table formatting in the API method documentation.
• LZ-3145 - HTTP ingestion endpoint documentation - Clarified usage of incoming versus incoming/raw endpoints for HTTP ingestion.
• LZ-3144 - HTTP event receiver documentation - Updated documentation to explain the difference between extra_fields and json parameters.
• LZ-3129 - Trigger script documentation - Unified duplicated trigger execution script help sections into a single reference.
• LZ-3044 - API documentation section correction - Corrected section 9.2 so API documentation appears in place of forwarder information.
• LZ-2992 - Static IP configuration guide - Added step-by-step instructions for setting a static IP address in the LogZilla VM.
• LZ-2932 - ServiceNow integration documentation - Created documentation and examples for ServiceNow ticket integration.
• LZ-2684 - Detailed installation guide - Added an installation guide covering system requirements through post-installation verification.
• LZ-2599 - Documentation rewrite - Completed a major rewrite of the LogZilla documentation.

UI Updates

• LZ-3251 - Error handling improvements - Improved error-message handling and added graceful fallback when the legacy UI is disabled.
• LZ-3241 - AI chat message copy functionality - Addressed an issue affecting some customers where copying AI chat messages did not include content above embedded charts.
• LZ-3225 - Search export functionality - Addressed an error that could surface when exporting search results to CSV or XLS format.
• LZ-3224 - Icon package replacement - Replaced the icons package and applied style improvements throughout the interface.
• LZ-3218 - AI chat integration - Integrated AI chat functionality into the new interface.
• LZ-3179 - AI interface connection - Connected the AI user interface to the new AI API.
• LZ-3113 - Account management buttons - Added activate and delete buttons to the account management interface.