WatchZit 1.4.0

WatchZit 1.4.0 adds checks without an agent, a network path history and alerts that learn what is normal.

Install or update: VM images (OVA, qcow2, VHDX, ISO) or install.sh — see the README. A running console offers the update under Settings → Updates and server; agents update themselves.

New

• Linux over SSH and Windows over WinRM, without an agent: CPU, memory, swap, the fullest disk, uptime (Linux also load). SSH takes a password or a private key and trusts the host key on first use; a changed key turns the check down and shows the new fingerprint. WinRM works over HTTP (5985, encrypted with NTLM) and HTTPS (5986, with channel binding). The usual CPU, memory and disk triggers and forecasts cover them.
• Network path (traceroute): probes every hop to a destination, records the round-trip time and loss per hop for 30 days, shows the last ten path changes and names the hop where loss begins. New trigger "Loss on the network path". Works on the console and on Linux and Windows agents and remote collectors.
• Value unusual for the time (learned): a trigger that learns the usual value of a metric for each hour of the week from the last 28 days and alerts when it is unusually high, low or either, with three sensitivities. It starts after 7 days of history.

Security

• SAML sign-in checks every response before the SAML library reads it (GO-2026-6909: assertions must carry an issuer and a subject, artifacts are refused, a parser panic becomes a refused sign-in).

Fixes

• Turkish: "Arrange" on the map editor is no longer the same word as "Edit".

WatchZit 1.3.6

WatchZit 1.3.6 hardens the appliance and adds new automatic security tests.

Install or update: VM images (OVA, qcow2, VHDX, ISO) or install.sh — see the README. A running console offers the update under Settings → Updates and server; agents update themselves.

Security

• Appliance hardening (also applied to existing appliances by the update): SSH allows no TCP, agent or X11 forwarding, 3 password tries per connection and logs key fingerprints; kernel settings hide kernel addresses, turn off SysRq, restrict ptrace and BPF and ignore ICMP redirects; the unused network protocols DCCP, SCTP, RDS and TIPC are not loaded; PostgreSQL settings are no longer readable by every user.
• Fixed a data race on a remote collector's state when its connection ended, found by the new race-detector tests.

Tests

• Every change now also runs the whole test suite with the Go race detector and fuzzes every parser of untrusted input (watchzit:// links, enrollment codes, SSO state, SAML metadata, data source responses, allow-lists, web scenario steps). Release images are checked with Trivy, Lynis, testssl.sh and Nuclei. See SECURITY.md.

WatchZit 1.3.5

WatchZit 1.3.5 brings the user guide in all 14 languages of the console.

Install or update: VM images (OVA, qcow2, VHDX, ISO) or install.sh — see the README. A running console offers the update under Settings → Updates and server; agents update themselves.

New

• The built-in user guide (User guide in the menu, with search) is now in German, French, Spanish, Italian, Portuguese, Dutch, Polish, Czech, Turkish, Russian, Chinese and Japanese, besides English and Serbian. Menus and buttons in the guide are named as in the console.

Fixed

• The maintenance form's "Repeat" field was translated as "repeat the password" in some languages; the console backup form now has its own "Repeat the passphrase" label.

WatchZit 1.3.4

WatchZit 1.3.4 is a security and reliability update for remote collectors and web scenarios, from a full QA, security and logic review of 1.3.3.

Install or update: VM images (OVA, qcow2, VHDX, ISO) or install.sh — see the README. A running console offers the update under Settings → Updates and server; agents update themselves.

Security

• Only administrators can make an agent a remote collector, assign devices or a discovery range to one, or set it in Change selected: a collector gets the passwords and SNMP keys of its devices.
• Removing an agent, or turning its collector role off, ends the role completely (devices, backups, discovery ranges); a computer enrolled later under the same name gets nothing. An agent the console no longer knows stops collecting and drops the passwords it held.
• A web scenario sends its password only to its own address, and a check whose address changes no longer keeps its stored password.

Fixed

• Devices of a collector that is offline (or never connected) now become unknown after a few intervals instead of staying green.
• Late or repeated results from a collector no longer overwrite newer ones; results are acknowledged only once stored.
• A collector's checks are sent again only when they really change.
• Editing a web scenario from its settings works again; errors in the steps are shown as they are.
• Very large numbers in list filters (devices, logs, problems, reports, audit) no longer cause a server error, and a malformed trigger or tool address shows "not found" instead of an empty form.

WatchZit 1.3.3

WatchZit 1.3.3 makes remote collectors work on their own at a remote site, lets every device choose its tools, and tidies the console.

Install or update: VM images (OVA, qcow2, VHDX, ISO) or install.sh — see the README. A running console offers the update under Settings → Updates and server; agents update themselves.

New

• Discovery through a collector: choose a remote collector next to a new range under Devices → Discovery; it scans the network of its site, and the devices you add from it are monitored from it.
• SNMP through a collector: the SNMP discovery on the device page and the reading of facts, interfaces and VLANs of remote devices go through their collector.
• No gaps when a site's internet fails: a collector keeps running its checks while the connection to the console is down and sends what it measured when it is back (up to a day).
• Backup collector: a second collector at the site takes over the devices while the first one is offline.
• Remote collectors on the Agents page: what they are, how to set one up and the list of collectors.
• Tools per device: the device form lists every Open with tool with a tick — a Proxmox or Linux server without Remote Desktop shows only what it has.
• Edit from the map: the device panel on a map has Edit device at the bottom; saving returns to the map. Metrics and the ways to connect are separated by lines.

Improved

• Forms line up: an "optional" note no longer pushes a field down, one-line fields have one height, small buttons next to fields match them.
• The hypervisor hosts and virtual machines share one table with aligned columns.
• Checked on phone and tablet widths; the guide's previous/next buttons wrap on phones.

WatchZit 1.3.2

WatchZit 1.3.2 brings remote collectors, check templates, changes to many devices at once and web scenarios.

Install or update: VM images (OVA, qcow2, VHDX, ISO) or install.sh — see the README. A running console offers the update under Settings → Updates and server.

New

• Remote collectors: monitor networks the console cannot reach (a branch office, a site behind NAT). Install the agent on any computer there, click Use as a remote collector on its device page and choose it under Monitored from on the devices of that network. It runs their checks (ping, TCP, SNMP, web, DNS, certificates, databases, RouterOS, JSON) and sends the results over its encrypted connection. It needs no open port and has no web interface. If it goes offline, its devices show unknown, not down.
• Templates: a set of checks for a kind of device (a Linux server, a MikroTik router, a printer). Apply it to a device, a group or all devices of its kinds; new devices of those kinds can get it by themselves.
• Change selected: tick devices in the device list and change their group, SNMP profile, dependency, type, monitoring, template or collector at once, or delete them.
• Web scenarios: a check that goes through a web application step by step (sign in, open a page behind the sign-in, look for a text), keeping cookies between steps. The alert names the step that failed.
• Dependencies from the map: the Dependencies button on a map follows the cables from the main router and proposes what each device depends on.
• Traffic history of a cable: click a cable on a map to see its traffic both ways for the last hour, day, week or month.
• Triggers for one check: the bell next to a check on the device page adds a trigger just for it — for SNMP OID values such as temperatures and voltages, each with its own unit.
• Start page: choose a map or a dashboard to start on (My account → Start page).

WatchZit 1.3.1 (release candidate)

WatchZit 1.3.1 brings the MaxZit Launcher installer and one-click sign-in with passwords from PassZit.

Release candidate: for test consoles. Settings → Updates and server → Update channel: Testing. Production consoles stay on official releases.

Install or update: VM images (OVA, qcow2, VHDX, ISO) or install.sh — see the README. A running console offers the update under Settings → Updates and server.

New

• MaxZit Launcher installer: a short setup wizard (MSI) for your Windows user, without administrator rights, with the MaxZit icon in Apps; it takes over the settings of the older WatchZit Launcher and the PassZit helper. Download it from the Launcher page (maxzit-launcher-1.3.1-x64.msi; the plain .exe stays too).
• One click with PassZit: with the PassZit browser extension allowed on the console, Open with signs in to RDP, SSH, WinBox and the other tools with the login saved in PassZit. A small badge next to the buttons shows "PassZit" (unlocked) or "PassZit locked"; without PassZit a dismissible hint explains how to set it up. The console never sees a password.
• Licenses page: the license and all third-party notices in the console (link at the bottom of the menu); the notices also ship in the agent and launcher installers and the agent packages.

Fixed

• Pairing the launcher with a console that moved to another address (or was restored elsewhere) now asks to use the new address instead of saying it is paired already.

WatchZit 1.3.0

WatchZit 1.3.0 brings the MaxZit Launcher for WatchZit and PassZit, watches processes and system error messages through the agent, reads printers, UPSs and MikroTik sensors over SNMP, and makes maintenance windows repeat. It includes everything of the 1.2.0 candidate.

Install or update: ready-made VM images for VMware (OVA), Proxmox/KVM (qcow2) and Hyper-V (VHDX), an appliance ISO, or install.sh on Debian, Ubuntu, AlmaLinux and Rocky Linux — see the README. A running 1.1 or 1.2 console offers the update under Settings → Updates and server.

New since 1.2.0

• MaxZit Launcher: the WatchZit Launcher becomes one program for WatchZit and PassZit. Pair the PassZit extension from its menu and it opens Remote Desktop, SSH, WinSCP, WinBox, VNC and Telnet with the login from the vault (Remote Desktop through a Windows credential that exists for seconds, SSH passwords and keys through files only you can read). It replaces the WatchZit Launcher and passzit-helper and takes over their settings. Download: maxzit-launcher-1.3.0-windows-amd64.exe.
• Agent packages: the Linux agent as deb and rpm (amd64, arm64).
• Watched processes: program names per computer, each with how many run, their CPU and memory; none running opens a problem.
• System error messages: critical and error events of the Windows System and Application logs and errors of the systemd journal go to Logs; log triggers can use them.
• Printers and UPSs over SNMP: toner and ink levels, UPS charge, runtime, load and on-battery state (UPS-MIB and APC cards), with ready triggers for low toner and short UPS runtime; MikroTik temperatures, voltages and fans.
• Recurring maintenance every day, week or month, optionally until a last day.
• No new data trigger: a check that got no new value for some minutes opens a problem.
• Maps: devices that are down only because a device they depend on is down are grey, not red; Arrange lays out a whole map by its cables; things that are not built for a rack get their own height and part of the width, side by side on a shelf.

From the 1.2.0 candidate

• Where devices are plugged in (LLDP, CDP, MAC tables, port descriptions, configurations) and maps that draw themselves; agent self-update; update channel; disk-full forecast; custom fields; links on every device; diagnostics.

Fixed

• The testing update channel pointed to a wrong address.

WatchZit 1.2.0 (release candidate)

WatchZit 1.2.0 finds where your devices are plugged in and can draw your maps by itself, keeps agents up to date on their own and warns before a disk fills up.

Release candidate: for test consoles. Settings → Updates and server → Update channel: Testing. Production consoles stay on official releases.

Install or update: ready-made VM images for VMware (OVA), Proxmox/KVM (qcow2) and Hyper-V (VHDX), an appliance ISO, or install.sh on Debian, Ubuntu, AlmaLinux and Rocky Linux — see the README. A running 1.1 console offers the update under Settings → Updates and server.

New

• Where devices are plugged in: links found from LLDP, CDP and MikroTik neighbour tables, switch MAC address tables (also for printers, cameras and servers known only from a router's ARP table), port descriptions and point-to-point networks in saved configurations. The map shows them with the ports; Add all or let a map draw by itself every 15 minutes (devices placed next to their switch). What you remove stays removed.
• Agent updates: agents older than the server update themselves when they connect, over their own encrypted connection with a checked SHA-256 (Windows MSI installs and Linux/systemd). Switch it off and update all online agents with one click on the Agents page. Agents before 1.2 are updated once by hand.
• Update channel: official releases, or testing (release candidates) for a test console.
• Disk-full forecast: a new trigger kind follows the trend of the last week and opens a problem when a value will reach its threshold within the days you set; a ready trigger warns two weeks before an agent disk is full.
• Custom fields for devices (asset number, warranty end, rack …), found by the device search.
• Links on every device: buttons that open the device in another program, for example RMMZit or BackupZit, with the device's name or address filled in.
• Diagnostics: Settings → Diagnostics shows where the logs are and the newest server log lines, and gives a ZIP for support with passwords, communities, tokens and keys removed.

Improved

• Neighbours heard over VLAN, VXLAN and VRRP interfaces no longer add duplicate links next to the real cable.

WatchZit 1.1.0

WatchZit 1.1.0 adds traffic flows, hypervisor monitoring, configuration backups of network devices, syslog and SNMP traps, network discovery, directory sign-in and backups of the console itself.

Install or update: ready-made VM images for VMware (OVA), Proxmox/KVM (qcow2) and Hyper-V (VHDX), an appliance ISO, or install.sh on Debian, Ubuntu, AlmaLinux and Rocky Linux — see the README. A running 1.0 console offers the update under Settings → Updates and server.

New

• Traffic flows: NetFlow v5/v9, IPFIX and sFlow collector — top sources, destinations, services, exporters and conversations with a traffic graph.
• Hypervisors: VMware ESXi and vCenter, Proxmox VE (hosts, virtual machines, containers, datastores, with triggers for full datastores and hosts that are down); Hyper-V machines and Docker containers from the agent. Hypervisor boxes on maps fill with their machines by themselves.
• Configuration backups of MikroTik, Cisco and FortiGate (or any command over SSH): nightly, a version only when something changed, differences line by line.
• Syslog and SNMP traps received from devices, searchable under Logs, with triggers on messages.
• Network discovery of address ranges on a schedule; found hosts added as devices in one click.
• Sign-in with Active Directory / LDAP and single sign-on (OpenID Connect: Entra ID, Google, Okta, Keycloak; SAML 2.0: ADFS); roles follow directory groups.
• Console backup and restore: daily, encrypted if you like, copied to an SFTP folder; restore from the setup menu or the command line.
• Notifications: Discord, Telegram, ntfy, PagerDuty and SMS (Twilio or your own gateway); escalation and on-call hours per channel; SLA targets per group and the availability report by email.

Improved

• Maps: port names on short cables in racks and compact SFP names that fit their port.
• Clearer messages when a device refuses the SSH user or does not answer.
• Security: the flow collector ignores senders that are no device before decoding anything; fuzz-tested network parsers; go-jose 4.1.6.
• The user guide no longer links operators and viewers to pages only administrators may open.