Tracix Collector release notes

Since 2.0.4, every Tracix Collector release ships for Linux, macOS and Windows on amd64 and arm64, and as a container image for Docker and Kubernetes. Tracix promotes one release at a time as the stable release: the console installs it, and the Collectors page shows which collectors are behind it. To move a collector to a newer release, see Upgrade collectors.

This page covers the October releases in detail and summarizes older ones. Versions that are not listed, such as 2.0.47 and 2.0.49, were not published for every platform; their changes ship in the next listed release.

October 2026

2.0.50

Released October 13, 2026.

• New: Software inventory reads more kinds of package metadata: Rust binaries built with cargo-auditable, .NET single-file and native AOT bundles, Ruby gems, PHP Composer, Perl CPAN, Erlang/OTP and Elixir releases, ELF package notes, statically linked library signatures, and SBOM documents shipped inside images.
• New: Software inventory reads the Node.js agents a process preloads from outside its application, through --require or --import on its command line or in NODE_OPTIONS, including the auto-instrumentation the OpenTelemetry Operator injects. Only the preloaded modules' paths are kept from the environment.
• New: Sampled CPU profiles name the components behind Ruby, PHP, Perl, BEAM and .NET frames, and Java archives and BEAM applications list their packages and modules.
• Changed: The Helm chart caps the collector at one CPU (it was 500m; the request stays at 100m). The container image sets GOMEMLIMIT to 80% of the container's memory limit unless you set it, and the plain Kubernetes manifest uses the chart's limits: one CPU and 2Gi.
• Fixed: With software inventory on, the collector no longer grows to its memory limit.
• Fixed: Software inventory reads chiseled Ubuntu images, npm packages installed inside another package's node_modules, gRPC Java archives, Maven metadata with unresolved placeholders, and packages that setuptools vendors.

2.0.48

Released October 13, 2026. Includes the changes prepared for 2.0.47.

• New: The Software Inventory integration records each Linux application's components from its package and language metadata, with runtime evidence from eBPF. Turn it on with softwareInventory.enabled in the Helm chart, --enable-software-inventory on the Linux installer, or the docker-compose.software-inventory.yaml Compose file.
• Fixed: Software inventory reads the host, never the collector's own image, when no host root is configured, and the Helm chart sets the host root whenever it is mounted.
• Fixed: URLs that carry credentials are scrubbed from spans and logs before export.
• Fixed: Kubernetes cluster absence is judged per cluster, and workload availability from desired versus ready replicas.
• Fixed: File integrity monitoring keeps a rename's two halves together when they arrive in separate reads.
• Fixed: The Linux installer verifies downloads with sha256sum, so minimal Debian and Ubuntu hosts without shasum install cleanly.

2.0.46

Released October 12, 2026.

• Fixed: CPU profiles from Kubernetes carry each workload's declared service and container names.
• Fixed: Configuration reloads no longer trip the collector's liveness checks, and OBI skips system processes.

2.0.45

Released October 11, 2026.

• Fixed: A receiver that fails to start, such as Docker against a daemon that refuses its API version, is switched off and reported instead of restarting the collector in a loop. The rest of the policy keeps running, and the receiver is retried every 30 minutes.
• Changed: When a pushed configuration fails to start because of an exporter, processor, connector or extension, the collector rolls back to the last configuration that ran, and Tracix records the rejection with its reason.
• Changed: A configuration is reported as applied only once the collector has started it.
• Fixed: The Docker integration negotiates the API version with the Docker daemon. Its version setting is gone, and versions saved earlier are ignored.

2.0.44

Released October 11, 2026.

• Fixed: Policies that turn on profiling apply cleanly: the check a collector runs on a pushed configuration uses the same feature settings as the running collector, and a self-update no longer stops on such a host.
• Fixed: macOS and Windows collectors no longer receive the eBPF profiling receiver, which runs on Linux only, so a policy with profiling on applies to them without it.

2.0.43

Released October 10, 2026.

• New: Cloud security posture for AWS, Azure and GCP accounts and for Kubernetes clusters, scanned by Prowler. The scanner runs only while a posture integration is set up.
• New: Network configuration management blocks and unblocks an address as a structured access list entry, and verifies the change by reading the device's configuration back.
• Changed: Kubernetes collector identities that a newer identity replaced, or that were uninstalled, are removed after a day of silence. Collectors you revoked are kept.
• Fixed: Collectors compress the data they write to your workspace, about 25 times smaller for metrics, so batches no longer miss their deadline on slow links.
• Fixed: A connection timeout is recorded only against the tables the push carried data for.
• Fixed: Host response checks a process's start time to within a second, so a kill is not reported done while the process is still exiting.

2.0.42

Released October 9, 2026.

• New: Linux Endpoint Security reports process starts and exits, user ID changes, TCP connections, file changes, file integrity and the kernel audit stream, through eBPF where the kernel allows it and /proc polling otherwise. Run the Linux installer with --enable-security to grant the capabilities it needs.
• New: Host response ends a process, or quarantines and restores a file, on the collector's own host once a response action is approved. The host's owner opts in with --enable-response on Linux and macOS, or -EnableResponse on Windows.
• New: Cloud response actions for AWS, Azure and GCP quarantine instances, deny traffic to or from an address, rotate or disable keys, and snapshot disks, all behind approval.
• New: Threat intelligence feeds from any TAXII 2.1 collection, OpenCTI, Spamhaus DROP and the Tor exit list, with a license and an expiry on every indicator.
• New: Security and identity log packages classify their records as OCSF classes, and Duo authentication and admin logs and CrowdStrike Falcon alerts are collected and classified.
• New: Enrollment tokens are reusable per policy until revoked or expired, and can be shown again. An enrolled collector switches to its own credential, so revoking a policy's token leaves it running.
• New: The installers take an HTTP proxy (--proxy, or -Proxy on Windows), and the collector uses it too. Heartbeats report ingest failures per table and the collector's listeners.
• New: Windows releases include a .zip of each build, for Windows Server 2016, which has no tar.exe.
• Changed: Syslog listens on port 514 by default. Saved integrations keep their port, and a port below 1024 is given only to collectors that can open it.
• Changed: Destructive, containment and credential actions in connector packs, and AWS write actions, file an approval request when a workflow runs them instead of running straight away.
• Changed: A private address the Tracix cloud cannot reach is refused, with a message to run the connector on a collector inside that network.
• Fixed: Log packages built on the parsing engine, such as Palo Alto, Windows Security, Okta and Entra ID, attach their parsing and classification pipelines. Their records used to arrive unparsed.
• Fixed: Host names land in the fields Sigma's host name rules read, from Sysmon, Carbon Black, Squid, Netskope and Cisco Meraki logs.
• Fixed: install.ps1 runs on Windows PowerShell 5.1 and Windows Server 2016, removes a half-built service when a step fails, and waits for the collector to enroll before it exits.
• Fixed: CEF packages whose parsing uses regular expression backreferences no longer make the collector refuse its configuration.
• Fixed: An SNMP row with a blank indexed value, such as a loopback interface's MAC address, gets an empty attribute instead of failing the scrape.

2.0.41

Released October 7, 2026.

• New: The Helm chart's containerLogs.enabled value, off by default, lets the Kubernetes integration read the pod log files that the container runtime writes for root only.
• New: The collector reports when it can read node log files and enrich network flows, so Tracix can offer the Helm upgrade to Kubernetes installs that lack them.
• Fixed: With cnm.enabled, the collector runs as root so its capabilities take effect: network flows on Kubernetes carry process attribution and no longer keep a Service's cluster IP as their destination.

2.0.40

Released October 7, 2026.

• New: Synthetic probes (HTTP, DNS, TLS, TCP connect and ICMP) report an explicit outcome for every run, so a failed run counts as a failure instead of going missing.
• New: HTTP, DNS, TLS and TCP probes can trace the network path to the target in the same run. On Linux, run the installer with --enable-network-path to grant the permission hop-by-hop tracing needs; without it, probes still measure the target.
• New: The APM gateway applies per-service tail sampling overrides.
• New: The OBI integration has language runtime settings: the Java agent on or off, its attach timeout, the JVM runtime metrics interval, and Node.js on or off.
• New: The Helm chart can create an OpenTelemetry Operator Instrumentation (apm.autoInstrumentation, off by default) that injects language agents into annotated pods.
• Changed: Runs a collector cannot measure, without ICMP permission, on an unsupported OS or against an IPv6 target, report permission_denied or unsupported instead of failing the target.
• Fixed: HTTP tests evaluate their accepted status codes per test, a run cut short by a configuration reload is not recorded as a failure, and an ICMP target that rejects ping no longer counts as answering.
• Fixed: Saved tail sampling settings survive a restart of the services Tracix runs in your workspace.
• Removed: The TLS probe's SNI and OCSP metrics, which were never measured.

2.0.39

Released October 6, 2026.

• New: Each SD-WAN poll reports how collection went for every scope (complete, partial, failed, turned off or not collected by the vendor's connector), so Tracix can tell a quiet source from a stopped one.
• New: SD-WAN telemetry names the controller and the integration, so sites with the same ID on two controllers stay separate.
• New: vManage devices report their type and role, and vManage alarms carry their ID, original severity and cleared state.
• Fixed: Events an SD-WAN controller repeats on every poll are stored once.

2.0.38

Released October 5, 2026.

• Fixed: The collector writes every attribute map with its keys sorted, so one series is no longer stored under several key orders and counted as several series.

2.0.37

Released October 5, 2026.

• New: vManage edges report their interface addresses once an hour, so Tracix can link an SNMP device to its SD-WAN edge.
• New: vManage links report their own receive and transmit throughput.
• New: Collectors that stay silent for 30 days are retired, so they no longer count as running or keep alerts firing. A retired collector runs again as soon as it reports.
• Fixed: vManage link byte counts count each sample once.

2.0.36

Released October 4, 2026.

• New: SD-WAN tunnels report their state, remote site and transport, and vManage alarms arrive as SD-WAN events in logs.
• New: A built-in monitor, "Device missing interface, CPU or memory data", warns when a device answers SNMP but sends no interface data or, for network gear and servers, no CPU or memory data.
• Fixed: An SNMP device matches a library profile only when its walk shows it answers that profile's OIDs.
• Fixed: SD-WAN polls may take up to one collection interval, so large vManage fabrics and large Meraki, Cato or Mist organizations are no longer cut off after 30 seconds.

2.0.35

Released October 4, 2026.

• Security: Collector ingest credentials can only insert data. A collector's credential can no longer read your workspace's telemetry.
• New: Tracix validates every configuration before a collector receives it. A policy change that would produce a configuration collectors reject is refused with the problem named.
• Fixed: Windows collectors no longer hang in Stop Pending when a configuration change or an update restarts the service.
• Fixed: Updates swap the binary before restarting and put the old one back if the new one does not start.
• Fixed: Collector shutdowns are time-limited on every OS, and a reconnecting collector keeps its SNMP devices.
• Fixed: An SNMP profile with a metric the receiver would refuse no longer stops every metric of that receiver.
• Fixed: Collectors keep exporting after the workspace's database restarts.
• Fixed: On Windows, the collector's service log is readable in Event Viewer and with Get-WinEvent.

2.0.34

Released October 2, 2026.

• New: Collectors report their host's clock offset, and the host installers check the clock before installing and turn on time sync when it is off.
• Fixed: On policies with automatic updates, a failed update is retried after 15 minutes, 1 hour and 4 hours.
• Fixed: A duration without a unit no longer makes collectors reject every policy update; saving one is refused with a field error.

2.0.33

Released October 2, 2026.

• New: Cisco VTP and Q-BRIDGE VLAN tables map onto VLAN fields: ID, name, type and MTU.
• New: Interfaces report their access VLAN, trunk native VLAN and trunking status.

2.0.32

Released October 2, 2026.

• New: Every SNMP device kind is walked once and composed from the profile library.
• New: SNMP discovery reports each device's operating system name and version.
• Changed: The base SNMP profile polls the system, interface and link aggregation tables; host resources and LLDP follow each device kind's walk.

September 2026

August 2026 and earlier

Next steps