Software Lifecycle and Release Notes

Software Lifecycle Policy and Release Notes

LogZilla provides a defined lifecycle for each software release to ensure reliability, performance improvements, and timely security updates.

Support Phases

End of Support (EOS).

A release receives active support, including feature updates, bug fixes, and noncritical enhancements, for one year from its initial release date.

End of Life (EOL).

A release continues to receive security fixes and critical issue patches for two years from its initial release date. After this period, the release reaches EOL and no further updates are provided.

Customer Responsibilities

Customers are encouraged to remain on supported versions to receive the latest improvements, ensure platform stability, and maintain compliance with current security practices. Upgrading regularly helps avoid operating on outdated or unsupported components.

Extended Support

For deployments requiring an extended maintenance window beyond the standard policy, additional support options may be made available upon request.

Release Lifecycle Dates

Release Notes

This page lists the last three releases. Older notes are available in source control.

Version v6.42

Notable Features

• New AppStore Applications - Added LogZilla apps for Netskope Security Cloud, Proxmox VE and Ceph, and Netgate pfSense, along with a ServiceNow Event Management forwarder integration. Each parsing app ships with rules, dashboards, triggers, and an event generator.
• Application Ports on LogZilla Cloud - Vendor apps that rely on a dedicated Application Port on-premises can now be enabled on LogZilla Cloud by tagging events at the relay with a source type, reproducing the on-prem Application Ports behavior where devices reach the platform through a relay rather than a direct syslog listener.

API Updates

• LZ-3396 - Netskope Security Cloud App - Added a parsing app for Netskope CEF events that extracts DLP, threat, and web-activity tags and includes dashboards and triggers. Events are identified by content, so no dedicated receiving port is required.
• LZ-3382 - Proxmox VE and Ceph App - Added a parsing app covering Proxmox VE cluster, task, authentication, and firewall events together with Proxmox Ceph storage health, including dashboards and triggers. Events are identified by program name.
• LZ-3391 - pfSense App - Added a parsing app for Netgate pfSense firewall and DHCP events, with a dedicated receiving port (Syslog Pfsense Port) and accompanying dashboards and triggers.
• LZ-3384 - ServiceNow Event Management Forwarder - Added an integration app that forwards actionable LogZilla events to ServiceNow Event Management, with a configurable severity map and a forwarding health dashboard.
• LZ-3395 - Application Ports on LogZilla Cloud - Added documentation describing how to tag events at the relay so vendor apps that depend on a dedicated Application Port work on the cloud platform.
• LZ-3378 - Fortinet AppRisk Tagging - Addressed an issue affecting some customers where the AppRisk tag was not generated for certain Fortinet events.
• LZ-3369 - Exception Class Naming - Corrected the spelling of several internal exception class names and added aliases for the prior names so existing integrations continue to work unchanged.
• LZ-3306 - OpenAPI Schema Corrections - Corrected typographical and formatting issues in the published OpenAPI schema.
• LZ-3394 - FIPS-Enabled Host Support - Updated the container images to select a compatible OpenSSL provider so LogZilla runs correctly on FIPS-enabled host operating systems.
• LZ-3386 - Offline Installation Reliability - Addressed an issue affecting some customers where offline installations could time out while loading container images on slower systems.

Version v6.41

Notable Features

• App-Schema-Aware AI Queries - The LogZilla AI Copilot is now aware of every installed application's schema, tag taxonomy, and vendor context. A TopN vendor pre-filter surfaces the most active applications to the query agent automatically, producing substantially more accurate results for vendor-specific natural-language searches.
• AI Multi-Model Accuracy (LZ-3341) - Query agent prompts have been restructured for token efficiency and reliability across a wider range of LLM providers, including smaller and locally hosted models, with added decomposition guidance for complex multi-step requests.
• New AppStore Applications - Added LogZilla apps for BlueCat DNS (DNSTAP), FortiAnalyzer, FortiWeb, Arista EOS, Cisco IOS-XR, and Dell N-Series switches. Each includes parsing rules, dashboards, triggers, and event generators.

API Updates

• LZ-3335 - Query Agent Prompt Rewrite - Restructured the query agent prompt into a token-efficient format that retains clarity on low-end models, improving consistency of generated queries.
• LZ-3317 - App Schema Injection for AI Queries - The AI query agent now receives the installed application schema and vendor context from a TopN pre-filter, producing more accurate results for vendor-specific searches.
• LZ-3316 - Query Decomposition Guidance - Tightened the main agent prompt with explicit decomposition instructions for multi-step queries.
• LZ-3328 - Query Timestamp Handling - Resolved an issue where the query agent occasionally mixed a preset time range with explicit ts_from and ts_to parameters.
• LZ-3320 - Configurable LLM Request Timeout - Added a new REQUEST_TIMEOUT setting (default 300 seconds, range 30 to 3600) to the AI configuration, adjustable through ai.yaml or the Settings interface. The default was tuned to accommodate tool-call buffering on Ollama deployments running on slower GPUs.
• LZ-3333 - Claude 4.6 Model Support - Added support for the claude-opus-4-6 and claude-sonnet-4-6 model names in the AI configuration.
• LZ-3329 - AI Model Type Consolidation - Consolidated the "vllm" and "ollama" model types into a single "vllm/ollama" option that covers both backends. Existing saved configurations using "vllm" are migrated automatically; configurations still using the old "ollama" value are rejected with a message describing how to update the selection.
• LZ-3338 - Dynamic Phoenix Tracing - Phoenix trace export can now be enabled or disabled at runtime without restarting the AI worker process.
• LZ-3336 - vLLM Streaming Reliability - Addressed an issue where concurrent vLLM streaming sessions could collide; each streaming request now uses an isolated client instance.
• LZ-3343 - AI Timeout Guards - Added timeout protection to the explain_event and ping_llm paths so stalled model calls no longer delay event analysis.
• LZ-3324 - Typed Query Timeout Errors - Introduced a typed QueryTimeoutError returned to AI clients, allowing agents to distinguish timeouts from other query failures and retry appropriately.
• LZ-3323 - AI Module Resource Handling - Addressed resource handling in the AI module that could leave database connections and threads lingering under sustained load.
• LZ-3313 - Phoenix Trace Export - Corrected a tracing configuration issue that prevented spans from reaching Phoenix when enabled.
• LZ-3311 - FortiGate WAF and Tagging - Added WAF event support to the FortiGate application and introduced HC_TAGS handling across the Fortinet app family to reduce cardinality on high-volume fields.
• LZ-3354 - Dashboard and Widget Validation - Serializers now reject unknown fields in widget and dashboard payloads, surfacing typos earlier instead of silently discarding them.
• LZ-3354 - IOS-XR Node Extraction - Corrected the order of IOS-XR parent-rule processing so node identifiers are captured before the generic Cisco prefix cleanup runs.
• LZ-3360 - SonicWall SonicOS 7+ - Updated the SonicWall application to recognize the customized Syslog ID format introduced in SonicOS 7, and replaced message-based triggers with tag-based filters.
• LZ-3340 - Dell Switch Receiving Port - Added a dedicated receiving port for Dell N-Series switches.
• LZ-3358 - Infoblox NIOS Expanded Coverage (upgrade action required) - The Infoblox application has been expanded from DNS-query-only coverage to the full NIOS product: DNS, DHCP, administrative audit, Advanced DNS Protection, and Response Policy Zone events. Because some NIOS events use a non-RFC syslog header that collides with standard daemon names, the application now requires a dedicated receiving port. Customers already running the Infoblox app should set Syslog Infoblox Port under Settings > System Settings > Application Ports and reconfigure their Infoblox grid members to send to the new port. Until the port is configured and the grid members are repointed, Infoblox events will not be parsed by the application.
• LZ-3307 - Lifecycle Date Correction - Adjusted the published end-of-support and end-of-life dates to match the current lifecycle policy.

UI Updates

• LZ-3353 - License Status Reporting - The interface now displays the specific reason for a license error (such as exceeding the events per day limit), and on-prem deployments are redirected to a dedicated license error page when a 423 response is returned.
• LZ-3291 - Upgrade Notification Action - Replaced an outdated documentation link in the upgrade notification with a clipboard copy action that captures the upgrade command.
• LZ-3305 - Trigger Filter Initialization - Addressed an issue affecting some customers where the match-criteria field was missing when creating or editing triggers in the legacy interface.

Version v6.40

Notable Features

• LogZilla AI Configuration - AI settings are now managed through Admin → Settings in the UI rather than on-disk configuration files.
• Event Taxonomies - All LogZilla apps now follow a shared taxonomy standard and include additional drill-down tags such as Vendor, Product, MITRE, and ~150 compliance mappings (PCI-DSS, HIPAA, SOX, GDPR, and others).

API Updates

• LZ-3271 - VMware App Update - Updated the VMware application with refined event generation behavior.
• LZ-3256 - F5 Dashboard - Added a new dashboard for F5 device monitoring.
• LZ-2657 - Dashboard Metric Badges - Added count-style badge widgets to application dashboards for improved data visualization.
• LZ-3297 - Watcher CPU Optimization - Addressed higher-than- expected CPU usage from status checks in the watcher component.
• LZ-3293 - Taxonomy Consolidation - Created a unified source for application taxonomies and MITRE ATT&CK mappings.
• LZ-3277 - Trigger Configuration Regeneration - Addressed an issue affecting some customers where trigger configurations were not regenerated after app reinstallation.
• LZ-3276 - Upgrade Version Detection - Corrected version detection during upgrades so the latest available release is identified.
• LZ-3274 - App Standards Compliance - Updated multiple applications to follow new taxonomy standards and removed duplicate rules.
• LZ-3244 - Tag Naming Consistency - Standardized IP-related tag names across applications to reduce cardinality.
• LZ-3230 - User-Defined MCP Servers - Added support for user-defined MCP servers to enhance AI context for queries.
• LZ-3227 - Container File Limits - Adjusted file descriptor limits in containers for improved stability.
• LZ-3221 - SEC Rule Support - Modified App Store applications to support Event Correlation example configurations.
• LZ-3173 - Start Command Timeout Flag - Corrected the --no-timeout switch behavior for the logzilla start command.
• LZ-3157 - SonicWall App Enhancements - Added user login and VPN session tracking tags to the SonicWall application.
• LZ-3083 - Report Templates - Enhanced report templates with additional data sources and output format options.
• LZ-2700 - Search Results Formatting - Improved formatting options for search results display.
• LZ-3186 - AI Provider Expansion - Added support for additional AI providers including Gemini, vLLM, Ollama, and OpenRouter. Note: v6.41 consolidated the vllm and ollama model types into a single vllm/ollama option.
• LZ-3038 - API Validation Enhancements - Added input validators and refined API response handling.

UI Updates

• LZ-3272 - AI Session Copy Function - Enabled copying of individual AI chat responses within a session.
• LZ-3265 - AI Copilot Settings Save - Corrected a disabled save button in the AI Copilot settings section.
• LZ-3262 - App Store List Display - Corrected truncation of the last item in the App Store list view.
• LZ-3258 - Severity Chart Labels - Corrected severity name mapping so text labels appear instead of integers in all chart types.
• LZ-3251 - Error Message Improvements - Improved error handling and messaging after legacy interface deprecation.
• LZ-3240 - Trigger Filter Protection - Restricted editing of regex-based trigger filters to avoid accidental overwriting.