What's new in RackMon

Every release, newest first. Upgrade any time with docker pull rackmon/rackmon:latest — your data and license carry over.

v1.2.9 — Two paid features that could not work, and one that let strangers share an account · 19 Oct 2026

• SSO could not complete a sign-in at all. The identity provider redirects the whole browser window back to RackMon, and the callback answered it with a JSON document — so the user ended up looking at their own tokens printed on a blank page, and the app never learned that anything had happened. There was no route in the frontend waiting for that result either. SSO is gated behind a Pro licence and is one of the features we advertise most; a customer who paid for it could not sign in with it. The callback now redirects back into the app, carrying the session in the URL fragment so it is never sent to the server or leaked through a Referer header, and a new screen stores it and clears the address bar immediately. A test now pins both halves together, so renaming the route on either side fails the build instead of silently breaking sign-in.
• Every LDAP user without an email address shared one account — and could inherit admin. The code asked whether the mail attribute was present rather than whether it had a value, and ldap3 returns a requested-but-empty attribute anyway, with a value of None. That became the literal string "none", so every such user mapped to a single local account. Since the account is promoted to admin as soon as one of its members belongs to the admin group, one administrator without an email address was enough for all of them to sign in with admin rights — and to see each other's session. Identity now comes from the attribute's value, falling back to the directory username, which is unique by definition.

v1.2.8 — A device that dies now says so, and three paid features stop lying · 14 Oct 2026

If you run SNMPv3, check your devices after upgrading. A typo in the protocol name used to be accepted and silently downgraded the session to unauthenticated and unencrypted. Those devices will now refuse to save until the name is right — which is the point.

• A Pro licence key was published by mistake in RackMon’s own repository and Docker image, and is now revoked. A perpetual Pro key used by the test suite was signed with the real vendor key instead of a throwaway one, and it sat in backend/tests/conftest.py — a file that neither .gitignore nor .dockerignore excluded, so it reached both the public repository and every published image. Anyone who found it could unlock the paid features for free and for ever. 1.2.8 refuses that one key by its hash: the vendor keypair is not rotated, so every legitimate licence keeps working untouched. The test suite now mints its own throwaway keypair at run time, the tests no longer ship inside the image, and a new test walks the whole project on every run looking for anything that verifies against the real vendor key, so this cannot come back quietly. If you hold a paid licence and ever see “this key was published by mistake” in your logs, that key came from our repository rather than from us — get in touch and we will replace it.
• A device that stopped answering altogether raised nothing at all. When a poll failed, RackMon logged a warning, incremented a counter and moved on to the next device. The alert engine only sees readings, and a dead device produces none — so there was no condition to evaluate, no alert, no email, no Slack. The only signal was a grey card on the dashboard, for whoever happened to be looking at the screen at that moment. A whole rack could go unmonitored over a weekend with nobody told. Every sweep now produces a reachability heartbeat, and a new baseline rule (Device unreachable, critical, after three minutes of continuous silence) turns it into a real alert with the full lifecycle — deduplication, maintenance suppression, notifications, auto-resolution. A broken probe is deliberately not an unreachable device: a sensor returning the vendor's "not available" sentinel still proves the machine answered.
• The SLA report gave a dead device 100 % availability. It derives downtime from firing critical alerts; with no alert for an unreachable device, a machine that was off for the whole month was reported as perfectly available. The heartbeat above fixes the cause. Two more: asking for a period that runs into the future counted the time that has not happened yet as uptime (a month-to-date report on the 14th handed out 17 free days), and a period with the dates the wrong way round returned 100 % and zero incidents instead of an error. The compliance verdict is now taken from the same rounded percentage that gets printed, so a report can no longer show "99.9 %" next to "MISS" against a 99.9 % target.
• SNMPv3 could be silently downgraded to cleartext. The protocol name was looked up in a table with a fallback: anything not in that table — sha256 in lowercase, SHA-256 with a hyphen, a protocol we do not support — produced a noAuthNoPriv session. The device still showed as authPriv on screen, the operator believed they had secure SNMPv3, and the credentials went over the management network in the clear, without a single line of log. Unknown protocol names, a protocol configured without its key, and privacy-without-authentication are now rejected when you save the device, with the error in front of the person typing it.
• One misbehaving device could send you a thousand emails. An SNMP trap is pushed by the device over UDP and nothing limits how many it sends; a flapping link or a restarting agent produces hundreds a minute. Each one created a new alert and fired a new notification — no grouping, no quiet period, no cap. Repeats of the same trap from the same device are now folded into one alert with a count, re-notified at most once every 15 minutes. Traps also no longer stay open forever: they are point-in-time events, nobody ever sends an "it's over", and leaving them firing meant the active-alert list never emptied and the SLA report counted a single critical trap as permanent downtime. They close themselves after 30 minutes and stay in the history. A device in a declared maintenance window records its traps without waking anyone — the polling path already honoured maintenance; this one did not.
• The device limit on a paid licence was not enforced on discovery import. Adding devices one at a time respected the band you paid for; importing a scan did not, so a 50-device licence would happily take 500 in one click. That is the normal way to add many devices at once.
• Every alert displayed its value in degrees. A stalled fan showed as "450.0°", a CPU at 85 % as "85.0°". Values now carry the unit they actually have.
• A network scan no longer blocks the server. Addresses were probed one at a time, each dead one costing the full timeout: a /24 with half the addresses down took over four minutes with a server thread held the whole time, and two or three concurrent scans stopped the API responding to anything else. Hosts are now probed 32 at a time.

v1.2.7 — The mute warning stays off the public demo · 13 Oct 2026

• A demo instance no longer shows the "this install cannot notify anyone" banner. It was accurate — a demo has nobody to notify, by design — but it became the first thing a visitor saw after clicking through from the website, in amber, looking like a fault. The counters behind it stay truthful in the API either way: the banner is suppressed, the numbers are not.

v1.2.6 — The dashboard now admits when it cannot reach you · 13 Oct 2026

1.2.5 made sure a fresh install has alert rules. This one makes sure you find out when, for any reason, this install still cannot tell anybody anything.

• A banner on the overview when RackMon is mute. There are two ways to be silent and both have happened in the wild: no alert rule is enabled, so the engine never fires; or no notification channel is configured, so a firing alert only writes a line to a log nobody reads. Neither is visible today — the dashboard keeps drawing red cards and looks perfectly healthy, and because the console channel is always on and always records sent, even the notification history gives nothing away. The overview now says it plainly, in the first thing you see, with a link to the screen that fixes it.
• The overview reports both counts (alert_rules_active, notification_channels) so you can alert on them from outside too. The console channel deliberately does not count: it never leaves the machine.

v1.2.5 — Seven defects in the core, and one of them made RackMon silent · 13 Oct 2026

If you installed with RACKMON_SEED_DEMO_DATA=false, open Alerts → Rules before reading any further. If that list is empty, RackMon has never been able to notify you about anything.

• A clean install had no alert rules, so nothing was ever sent. The only rules RackMon shipped lived inside the demo-data branch — and false is exactly what our own .env.example, the docs and the Helm chart recommend for a clean start. Measured: a real device at 41 °C for thirty minutes, 120 polls, and not one email, webhook or entry in /api/v1/alerts. Meanwhile the dashboard card was painted red the whole time, because the colour comes from the reading and not from the alert engine. The customer sees red, assumes they would be told, and never is. A monitoring product that looks like it is working and says nothing is worse than one that fails to start. 1.2.5 seeds four baseline rules on every start — inlet above 27 °C and 32 °C, CPU above 80 °C, fan stalled — using the same thresholds this site publishes, so the colour and the alert finally agree. They are idempotent by name and never overwrite a rule you changed, disabled or re-tuned.
• A failed sensor read as a real temperature, and could close a live alert. HPE's CPQHLTH-MIB documents -1 as "not available"; other vendors use -99 or 32767. The device answers — there is no SNMP error — but it does not know. That -1 was stored as a reading of −1 °C, classified as nominal, drawn in cyan as the coldest thing in the rack, and pulled the room average down. Worse: the alert engine received it too, evaluated "−1 > 32" as false, and after two polls resolved a firing alert and sent a "recovered" notification — with the rack still at 40 °C. Sentinels are now rejected on the raw value (before scaling, because a vendor reporting tenths turns −1 into a perfectly plausible −0.1) and the reading is marked unavailable rather than silently dropped, so the engine treats it as a gap, which it already handled correctly.
• A device that stopped responding stayed green forever. The in-memory cache keeps the last value indefinitely, so a machine that lost power three days ago still reported "24 °C, nominal". A reading older than three times its own poll interval (minimum 90 seconds) is now no data. The tolerance is deliberate: marking a single late poll as an outage teaches people to ignore the dashboard, which is the other way to fail.
• Retention of 0 deleted everything instead of meaning unlimited. RACKMON_RAW_RETENTION_DAYS=0 put the cutoff at "now" and the hourly sweep removed the entire history, including points written a second earlier. Zero is what people write when they mean "keep it all" — it is the convention across this category. Zero or less now means keep forever.
• A failed escalation was never retried. The alert was marked escalated whether or not the email actually sent, so an SMTP hiccup buried the notification permanently — on the one mechanism whose entire job is to catch an alert nobody acknowledged. It is now only marked when the message went out, with a cap of five attempts so a permanently misconfigured relay cannot fill the table.
• Deleting a metric did not remove it from the device's status. A misconfigured temp_inlet reading 275 °C (tenths without scaling) kept the device red at 275 °C after being deleted from the catalogue, until the process was restarted — with nothing on screen to explain it.
• On Kubernetes, the dashboard was permanently empty. The value cache lives in the API process's memory and is only ever written by the poller — and the Helm chart's default is a dedicated poller pod with polling switched off on the API replicas. So those replicas never held a single reading: the overview, the rack map, the averages and the hottest list were all blank while Postgres filled up with data. The API now loads the cache from the database at start-up, and keeps it current when it is not the process doing the polling.
• Your Pro licence now warns before it expires, at 30 days and more insistently at 7, and says plainly when it has lapsed and which features are off. Previously a one-year licence simply stopped: the status page, SLA reports and white-label branding disappeared overnight with only a line in a log nobody reads.

v1.2.4 — What an audit of the un-reviewed code turned up · 9 Oct 2026

Eight confirmed defects, every one reproduced before being fixed. Four of them were in 1.2.3 itself. If you are on 1.2.3 and your read-only account stopped working, this release is the fix.

• The disabled read-only account can be recovered — the remedy 1.2.3 printed did nothing. When 1.2.3 disabled viewer@rackmon.io it logged "to use it again, start with RACKMON_VIEWER_PASSWORD=…". Doing that changed nothing: the seeding routine returns early when the row already exists, so the account stayed disabled, kept the hash of the published password, and from the second start-up printed no explanation at all. Anyone running a kiosk screen or a NOC iframe on that account lost it with no documented way back. Setting the variable now resets the password, re-enables the account and invalidates older sessions.
• Disabling that account now destroys the published credential too. 1.2.3 only set is_active = false and left the hash of viewer12345 in place — one click of "Enable" in Admin → Users reopened the hole instantly, and the next start-up disabled it again, in a loop. The password is now replaced with a random one nobody holds.
• A second air probe is treated as air. Intake metrics were matched by exact name, so a device with two probes — temp_inlet and temp_inlet_2 — had the second one judged on component limits. An aisle at 41 °C, nine degrees above the critical threshold RackMon publishes in its own guides, showed as nominal, in green, with no alert and absent from the hottest list. Matching is now by family, in the dashboard, in status and in SLA reports.
• The hottest-devices list no longer hides everything without an air probe. In 1.2.3, one device with an intake sensor was enough to drop all the others from the only list people read to find what is hot: the dashboard could say "critical: 1" and "peak 24 °C" at the same time. The list now includes every device, ranked by status first, and each row is coloured on its own scale. Averages and peak still come from intake only — those describe the room.
• Network discovery passes the vendor through. The scan already reads the vendor from sysDescr and shows it in its own table, but the import threw it away, so every imported device got the generic catalogue regardless of make. Importing forty devices of five brands now gives each one its own vendor template.
• A printer is no longer taken for a server. Vendor matching was by substring, so "Hewlett-Packard HP LaserJet 4200" picked up the iLO catalogue and a Dell Networking switch picked up iDRAC. Both then answered "No Such Instance" and sat there created, enabled and silent. Product names now win over company names, and printer and switch families rule a server template out.
• HEAD requests work. RackMon answered 405 to every HEAD, including on /health — the endpoint you point an uptime monitor at. Uptime Kuma, UptimeRobot, Pingdom and Nagios' check_http default to HEAD, so they reported a perfectly healthy RackMon as down.
• SLA reports colour each row on the right scale. A server with no air probe whose CPU averages 55 °C — entirely normal — was printed in critical red next to its own "0 % over warning". The report contradicted itself in the document customers show their management.
• A chosen theme stays chosen. The light/dark listener was installed once and never re-checked your choice, so a NOC screen deliberately set to light turned dark by itself when the operating system switched at dusk.

v1.2.3 — Security fix: the read-only account, and a heatmap that shows heat again · 30 Sep 2026

Please upgrade. This release closes a credential that was published on this website, and repairs the rack heatmap, which 1.2.2 accidentally flattened.

• Security — the read-only account is no longer seeded with a factory password. Every install created viewer@rackmon.io with the password viewer12345, active, and that password was printed on the RackMon home page as the demo login. The quickstart command set no passwords, so any install that followed it had a valid account whose password was published on the internet. A viewer can read the whole estate: device names, IP addresses, hostnames, racks, telemetry and history. The production start-up guard never caught it, because it only audited RACKMON_JWT_SECRET, RACKMON_MASTER_KEY and RACKMON_ADMIN_PASSWORD.
  From 1.2.3 the account is created only when you set RACKMON_VIEWER_PASSWORD yourself. On upgrade, an existing viewer@rackmon.io is disabled — but only if its password is still the published one. If you had changed it, the account is left exactly as it is. The log says which happened. The credential has also been removed from every page of this site.
• The quickstart command now sets RACKMON_ENVIRONMENT=production, an admin password, and binds to 127.0.0.1. It used to publish port 8000 on every interface and leave the environment at development, where the start-up guard warns instead of refusing.
• The rack heatmap shows heat again. 1.2.2 correctly changed the dashboard to show intake temperature (18–32 °C), but the colour ramp was still anchored to a CPU range of 15–90 °C. The whole room collapsed into one shade of teal — between the coldest rack and the hottest, the red channel moved by two units — and a rack at 32 °C, critical by RackMon's own rule, was drawn green. There are now two ramps, anchored to the same thresholds the alerting uses: intake turns amber at exactly 27 °C and red at 32 °C, component at 70 °C and 80 °C. The API now reports which metric a device's temperature came from, so the two can never be coloured with the wrong scale.
• The dashboard no longer averages intake with CPU. 1.2.2 fixed this in SLA reports and in device status but missed the overview screen, where a PDU's 22 °C of air and a server's 70 °C CPU were still pooled into one number, and the hottest-devices list was topped by whichever machine had a CPU sensor.
• No support form on the public demo. Anyone can enter the demo without an account, so the "contact the vendor" form there was an open mailbox, not a customer writing to their supplier. It is switched off on the server, not merely hidden.
• Your system dark/light preference is followed until you choose. The app stored whatever your system said on your very first visit and never consulted it again, so switching your machine to dark mode did nothing — without you ever having picked a theme. It now follows the system live, and only remembers a choice you actually make.
• Fixes — fleet status labels (Nominal / Warning / Critical…) appeared in English on Spanish, French, German and Portuguese screens; the dashboard showed a reassuring green "0 devices, 0 alerts" for a moment while loading, at the same time as listing firing alerts below; running the test suite twice on one machine corrupted both runs, because they shared a single database file.
• Documentation — the comparison table listed SLA reports and the status page as "Built-in" when both are Pro; the Enterprise plan advertised multi-site aggregation and HA/clustering, neither of which exists; the APC and OID-reference pages claimed built-in profiles they do not ship; and "full history" is now stated as what it is — 30 days by default, configurable.

v1.2.2 — The number on the dashboard is the intake now · 28 Sep 2026

RackMon has always said the same thing in its documentation: measure the air going in, not the component. The product was not doing it. This release makes the software agree with its own advice.

• A device's temperature is its intake reading. The dashboard averages, the rack heatmap and the hottest-devices list were all showing CPU temperature. A CPU at 68 °C is a normal CPU; it says nothing about your room. Where a device has no intake sensor, the previous reading is still used, so nothing goes blank.
• Devices without a CPU sensor now show a temperature at all. An APC PDU reports ambient and nothing else, so it appeared on the dashboard with no reading whatsoever.
• Intake readings are coloured on intake limits. The warning and critical bands were 70 °C and 80 °C for every temperature metric, so an intake at 45 °C — a room in serious trouble — was drawn green. Intake now uses the same thresholds this site publishes: nominal to 27 °C, warning 27–32 °C, critical above 32 °C.
• SLA reports stop averaging the CPU with the intake. Both were pooled into one avg_temp, which meant the headline figure in a customer-facing report was the mean of two unrelated things, and the hottest-device ranking ranked by CPU.
• The API reference is closed unless you turn it on. It used to be open whenever RACKMON_ENVIRONMENT was not set to production — which is the default. Forgetting one variable should not publish your API surface. Set RACKMON_API_DOCS_ENABLED=true if you want it.
• Upgrades from before 1.2.1 leave a note on the timeline. When a metric is repaired, an annotation is written at that point on the device's chart explaining that earlier data is not comparable and that hand-tuned alert rules should be reviewed.
• Fixes — on a 1024 px screen the last navigation link was clipped out of reach.

If you had alert rules tuned to the pre-1.2.1 numbers, check them. Upgrade with docker pull rackmon/rackmon:latest and restart.

v1.2.1 — The vendor templates were reading the wrong sensors · 28 Sep 2026

A correctness release, and an uncomfortable one. The built-in templates for Dell, HPE and APC shipped OIDs that had never been checked against the vendor MIBs. If you created a device from one of them, some of your readings were wrong — and one of the ways they were wrong is the kind that hides rather than complains. RackMon repairs those catalogs for you on first start; nothing to do by hand.

• Readings in tenths are now divided. iDRAC returns 275 for 27.5 °C and APC returns tenths of an amp. Without scaling, a cool server room was stored as 275 °C and a threshold of 35 could never fire. Metrics now carry a scale factor, applied before the value is stored, alerted on and coloured.
• The HPE OIDs returned nothing at all. The temperature table is indexed by chassis and sensor, so the OIDs needed one more component: they answered “No Such Instance” and the metric simply never produced data. The fan OID pointed at the fan's condition column, not its speed.
• The APC temperature OID was in the wrong subtree — and its neighbouring column is the same sensor in Fahrenheit, also in tenths, which is a quietly dangerous thing to poll and label °C. What the template called “input voltage” was in fact power in watts.
• Inlet and CPU were the wrong way round on Dell and HPE. On a PowerEdge probe 1 is the inlet, not the CPU; on a ProLiant sensor 1 is the ambient probe. The labels now match the hardware.
• Existing devices are corrected automatically. On first start after the upgrade, metrics created from an old template are updated in place and the change is written to the log. Anything you had adjusted by hand is left exactly as you set it.

Every OID in this release was verified against the vendor MIB itself — CPQHLTH-MIB, IDRAC-MIB and PowerNet-MIB — and pinned by tests so it cannot drift back. Upgrade with docker pull rackmon/rackmon:latest and restart.

v1.2.0 — Locks, limits and a demo you can just walk into · 28 Sep 2026

A security and correctness release. If you installed from the Unraid template, please read the first item — it affects you.

• Installs that never changed the template secrets now refuse to start. The Unraid template shipped a placeholder signing key; anyone who accepted it was running with a key published in the public repository. RackMon now stops at boot and tells you how to generate a real one. The template itself no longer pre-fills them.
• The API reference is closed in production. /docs and /openapi.json answered to anyone, handing out every route and schema without a login. They stay available in development.
• SSO admin mapping works with Entra ID and Okta. Providers that do not send an email_verified claim were treated as if they had denied it, so administrators silently signed in as viewers. An explicitly unverified address is still refused.
• License limits are real limits. The device cap in a license was read and displayed but never enforced, and an expired license kept working until the container restarted.
• Typos in a device address are caught. 192.168.1.300 was accepted and left you with a device that never answered. Hostnames and IPv6 are unaffected.
• Fixes — the feedback button no longer covers the last table row on phones; added a Permissions-Policy header; the public feedback endpoint now caps request size and cannot be flooded past its per-IP limit with a forged header.

Upgrade with docker pull rackmon/rackmon:latest and restart. Your data and license carry over.

v1.1.0 — Tell us what's broken · 23 Sep 2026

A release about getting your reports to us. RackMon is built by one person, and every message lands in a real inbox.

• Bugs, ideas and questions — the in-app Feedback panel now asks what kind of message you're sending, so bug reports get triaged ahead of the rest. Your report reaches the maker tagged and in order.
• Report without an account — a public form at rackmon.app/feedback, for anyone who hit a problem before they even finished installing.
• Honest about being off — instances that don't have a support desk configured (or run white-label) no longer show a Feedback button that could only ever fail.
• Fixes — the feedback form no longer reports a failure for a message that was in fact delivered; the support channel used by your instance can no longer be starved by traffic on the public form; keyboard focus and screen-reader announcements corrected throughout the panel.

Upgrade with docker pull rackmon/rackmon:latest and restart. Your data and license carry over.

v1.0.0 — Initial public release · 13 Aug 2026

The first public RackMon. A finished, self-hosted rack thermal & SNMP monitor in one container.

• Rack heatmaps — every rack rendered U-by-U and coloured by temperature, with a fleet roll-up.
• Live telemetry — real-time SNMP readings over WebSocket, history (30 days by default, configurable), z-score anomaly flags and one-click CSV.
• Honest alerting — thresholds with hold windows, dedup, snooze and escalation, grouped into correlated incidents; a poll gap never fakes a recovery.
• Notifications — email, Slack, Microsoft Teams, generic webhook and Telegram.
• Discovery — scan a subnet for SNMP hosts; SNMP v2c and v3 (authPriv).
• Security — encrypted secrets at rest, API keys, RBAC, audit log, TOTP two-factor, and a production start-up guard against insecure defaults.
• Pro — SSO (OIDC) & LDAP/AD, public status page, SLA/availability PDF reports and white-label branding, unlocked by an offline Ed25519 license key.

Get started   ← Back to RackMon