Changelog

What changed, in plain English.

Every fix and feature — and when something goes wrong on our side, you read about it here first, honestly. The technical detail is one click away when you want it, and out of your way when you don't.

July 31, 20264 changes[+]
added

Know which laptop batteries are dying — months before anyone is stranded

Laptop batteries don't fail on a schedule you can see coming. They quietly lose capacity for two years, and then someone is in a client meeting watching their machine die at 40%. Arqos now reads the pack in every laptop it monitors — how much capacity it still holds against what it shipped with, and how many charge cycles it has been through against what it was rated for — and tells you while there is still time to order one. Open a laptop and its battery sits with its presence history: a capacity meter and a plain line like "84% health · 612 of 1000 cycles · 71% charged". When a pack crosses the line the industry considers worn, you get one advisory — never a page, never at 2am, because nothing is down. It is a purchasing signal, not an emergency, and it stays quiet until a replacement actually clears it. For anyone running a fleet, this turns the most common surprise hardware failure into a line you can plan and budget for a quarter ahead.

[+] for the curious

Agent 0.17.0 reads pack telemetry per platform — ioreg on macOS, powercfg's battery report on Windows (never WMI, which froze agents in the past; a plain child process has no COM apartment to wedge), sysfs on Linux — collected twice a day rather than per heartbeat, since wear moves over months. The agent reports RAW FACTS ONLY and health is expressed as a ratio of the machine's own full-versus-design numbers, so the mAh-versus-mWh mismatch between platforms cancels before it reaches the wire; the condition is derived server-side so one vocabulary spans every OS instead of three vendor dialects. Thresholds follow the lithium-ion specification rather than taste: packs are rated to hold ~80% of design capacity at their rated cycle count, so that is the worn line, with a deliberate gap before clearing so a reading that wobbles a percent with temperature cannot flap. A vendor hard-fault outranks healthy-looking ratios. One advisory per pack — degrading further escalates the existing one rather than opening a second — and it is excluded from connectivity recovery, so a machine coming back online can never mark a worn battery as fixed. Verified by 31 checks including that exclusion.

improved

See a workstation's week — and hear about the quiet that actually matters

Open a laptop or desktop in Arqos and you'll now find its week laid out: which hours it was awake each day for the last seven days, drawn so a pattern is obvious at a glance, with the total beside it. Its one-line summary changed too — a workstation now reads "resting · asleep 11h" or "awake 6h" instead of borrowing the CPU-and-memory line that only really means something for a server. And when a machine has genuinely been away too long, that now shows up where you actually look: on your Attention board, as its own kind of finding, with the machine's learned pattern spelled out in the explanation. Previously that situation nudged the counter on the sidebar but the board itself had nothing to show you — a number with no story behind it. Sleeping still never raises anything. That's the whole point: the quiet is recorded, and only the quiet that breaks a machine's own pattern gets your attention.

[+] for the curious

Presence findings (away-too-long, missed wake window) now flow to the attention board as a first-class 'presence' cause with its own chip, icon, and inspector verdict — they previously reached the badge aggregate but not the board, because resting devices are deliberately skipped by the per-device pass and only app-check alerts had an alert-derived path. Workstation vitals are derived from the power-state stamp already on the row, so the fleet view costs no extra queries. The presence band reads seven days of transitions and renders each awake session at its true position in the day; all calendar math lives in one timezone-aware module, since a renderer computing local midnight itself would silently use the server's UTC and misplace every bar. Org tiles now say "N resting · M reporting" rather than a flat "all quiet". iOS learned the resting vocabulary for its next release. Verified by a 21-case pure probe over the span/day math — including sessions crossing midnight, a machine that slept over lunch, and days it never woke — plus an 18-case end-to-end run against the real fleet view.

improved

Arqos is learning each machine's week — and it's watching before it acts

Knowing a laptop is allowed to sleep was the first half. The second half is knowing when its silence is actually strange. Arqos now learns each machine's own rhythm — the hours it's reliably awake, the nights and weekends it's reliably not — and open a workstation today and you'll see what it has worked out, in plain words: "awake weekdays ~8am–6pm, asleep nights & weekends." Two things come from that. The wait before a quiet machine is worth mentioning stops being one number for everyone: a travel laptop that's normally dark for days earns a week of quiet, while a desk machine that's never switched off gets flagged after a single dark day. And a machine that reliably wakes up for the workday and simply doesn't becomes something we can tell you about — the kind of quiet no alarm threshold can see, because no threshold knows the machine's schedule. For now the learning runs in the open but stays its hand: it records what it would have said, and the existing timing still governs every alert. Nothing new will page you until we've read those verdicts against real machines and turned it on deliberately.

[+] for the curious

A 168-slot hour-of-week awake-fraction fingerprint per device, recomputed offline every 6 hours from the presence ledger — the same statistical baselining engine already proven on switch ports, reusing its integrator and scorer so the math has one home. It is deterministic, not an LLM: being able to say WHY it stayed quiet is the point. Devices carry a stricter confidence rule than ports do — a cable sitting up for a month is self-evidently always-on, but a laptop with no observed sleep/wake events is simply one we haven't watched sleep yet, so it stays 'unknown' and inherits the previous flat behavior exactly. A verdict also needs 10+ days of real history. Archetypes: always-on (24h horizon), business-hours (72h), intermittent (7 days), unknown (72h, unchanged). Shipped behind an enforcement flag that is OFF: the learner writes its verdict to the baseline row and the cron response so it can be audited on the live fleet first. Verified by a 20-case pure replay probe over synthesized 28-day timelines plus 16-case end-to-end runs in BOTH modes against the real crons, proving the same condition acts under enforcement and stays silent under shadow.

added

Laptops and desktops stop crying wolf — sleep is no longer an outage

A server that goes silent is an emergency. A laptop that goes silent is usually just... asleep. Until now, monitoring tools treated both the same, which is why nobody monitors workstations — the 2am "MacBook offline" page teaches you to ignore alerts. Arqos now knows the difference. The agent recognizes what it's running on (a battery means a lid means a human), and workstations get their own rules: closing the lid or shutting down for the night shows the machine as quietly resting — never an incident, never an email. On Windows, the agent literally says goodnight before the machine sleeps; everywhere else, it confesses the nap when it wakes, and any alert that fired in the gap is corrected to what it really was. You still don't fly blind: a workstation that stays dark for days — lost, broken, or walked out the door — raises the one alert that actually matters. And if a sleeping machine was the one polling your printers and switches, its checks hand over to another agent immediately, so the rest of the fleet never loses coverage.

[+] for the curious

Agent 0.16.0 reports chassis truth (battery, form factor, virtualization — native reads only, no WMI) and the server auto-classifies kind: Server SKUs and VMs stay servers, battery or desktop chassis becomes a workstation; a manually chosen kind is never overwritten, and anything unrecognized defaults to server, keeping absence-based alerting exactly as before. Windows agents subscribe to suspend/resume power notifications and send a signed pre-sleep gasp; all platforms detect slept-through gaps by wall-clock skew and report the span retroactively — down alerts opened inside a confessed span are reclassified as sleep. Workstation absence flips the device to a first-class 'resting' state (dim, quiet) instead of 'offline'; a resting workstation dark past 72 hours opens a warning-severity not-seen alert (all-alerts audience, never the critical escalation ladder) that resolves the moment the machine resurfaces. Sleep and shutdown gasps release the device's probe leases immediately for instant failover. Every transition lands in an append-only presence ledger — the input for learned per-device rhythms coming next.

July 8, 20264 changes[+]
improved

Drill into your fleet — and each kind of device speaks its own language

The board used to be one long list where a printer, a hypervisor, and a server all showed the same three numbers — and most of those numbers meant nothing for most of the gear. Now the board is something you move through. Your sites read as tiles you can take in at a glance; open one and its devices group by what they are; open a class — printers, hypervisors, backup appliances — and you get a view built for that kind of device. A printer shows toner and page counts; a hypervisor shows its datastores and running VMs; a server keeps its CPU, memory, and disk. Wherever you drill to, "back" returns you exactly where you came from — the printer list, the site, the class you were in — never dumping you back at the top.

[+] for the curious

The site card became a tile wall with per-kind drill-ins; a single shared tile component drives both the site tiles and the tiered device cards inside them, so the whole surface reads as one system. Each device class renders through its own vocabulary rather than a server-shaped cpu/mem/disk row forced onto everything. Back navigation threads the origin path so returning from a device lands on the exact drill you came from, and falls back to the device's own site — never the whole board. Single-site views skip the wall and open straight to the card. Purely a display and navigation change over data already collected: no agent change, no migration.

improved

The app you leave open stays current on its own

When we ship an improvement, you no longer have to remember to refresh to get it. A browser tab left open on Arqos quietly brings itself up to the latest version when you come back to it, and the desktop app does the same — so what you're looking at is always the current build, not one from before the last update. Nothing about your monitoring changes; the screen just stops drifting out of date behind your back.

[+] for the curious

The running UI reloads to the deployed version on focus after an idle gap (throttled so it never interrupts active use); the desktop shell reloads its embedded view on the same trigger, with ⌘R / ⌘⇧R hard-reload available. It's a client-side freshness mechanism only — no change to how devices are polled or how alerts fire.

improved

See and update the SNMP community a check polls with

Adding an SNMP check always meant typing a community string — the read-only password Arqos polls a device with. Now you can see and change that string after the fact, without deleting the check and starting over. Open a device, and each SNMP check row has a small key: click it to reveal the community Arqos currently uses and type a new one. Changing it only reconfigures how Arqos polls — it never writes anything back to the device itself, true to the rest of Arqos. The row's controls got clearer while we were in there: a key to manage the community, a quiet trash to remove the check, lined up so a printer row and a ping row read the same.

[+] for the curious

Manager-gated, exactly like adding a check. The current value is fetched on demand when you open the control, and every reveal and every change is recorded in the audit trail — but the community string itself is never written into that record. The editor renders as a portal so a card's clipping can't swallow it. The row controls are presentation only: the stacked text links became inline icons (a key for the credential action, a dimmed trash for remove, red on hover) on a single baseline, so rows keep one height whether they carry one action or two. No agent change, no migration.

improved

Every device now shows its address at a glance

You used to have to open a device to find its IP. Now it's right on the board. A printer, switch, or firewall shows the address Arqos polls it at, tucked as a quiet second line under its name; a server shows its local address next to its operating system, where the column already promised a "host." It answers the small question that comes up constantly — which box is that, and where do I reach it — without a single extra click. Nothing about it pages or turns red: it's plain inventory, shown to your team behind their login.

[+] for the curious

The address shown for a probed device is its check target — the thing Arqos actually polls, which for a probed device is its address; agent machines report their own local IP in the heartbeat. It rides data already collected, so there's no new polling and no agent change. Placement follows each table's shape: where the name is the only identity column (printers, hypervisors, backup appliances) the IP sits as a dim subtitle beneath it; where the table already carries an os/host column (servers, switches, firewalls) it fills the host half that previously showed only the OS. Falls back cleanly to what it showed before whenever an address isn't known.

July 7, 20267 changes[+]
improved

The fleet board is calmer — only what needs you rises to the top

As your fleet grew more varied — servers, hypervisors, printers, and switches all on one board — the site cards started to feel busy, with healthy gear competing for attention against the one or two things that actually needed a look. The board now sorts itself by what needs you, not by what kind of device it is. Anything asking for a decision today sits up top; a disk or datastore creeping toward full gets a quiet 'worth an eye' line; disks simply parked on the watch line collapse to a single line; and everything healthy — every kind — settles into one calm row of dots you can still hover to read. Add twenty more devices and the board stays just as quiet.

[+] for the curious

The site card moved from a flat list to a four-tier hierarchy: act-now (offline, a failing check, an app down), watch (near-threshold — a disk climbing or ≥90%, a datastore ≥85%, low toner), parked (flat watch-line disks, one line), and a single uniform dot substrate for everything healthy regardless of kind. A shared SAN datastore near full now surfaces once for the cluster, not once per host — the same dedup the alerts already use. Purely a display change: no new data, no agent, and the thresholds match what actually pages you.

improved

The service list now flags older, unencrypted protocols with a quiet suggestion

The network-services list on each device does more than name what's listening now — for the older, unencrypted protocols it adds a short, plain-language nudge on what to do. See Telnet and it suggests SSH; an FTP port suggests SFTP or disabling it if it's unused; SNMP v1/v2c suggests moving to SNMPv3; a cleartext directory or mail port points at its encrypted equivalent. Each device's panel summarizes how many services are worth a second look, so the answer to 'are we still running anything we don't need?' is right there. It's guidance, not an alarm — nothing pages, nothing turns red; it just helps you decide what to tidy up.

[+] for the curious

A display layer over the existing passive service inventory — no new data collected, no agent change, no scanning. A curated set of legacy/cleartext ports (FTP, Telnet, TFTP, cleartext POP3/IMAP, NetBIOS, SNMP v1/v2c, cleartext LDAP, PPTP) carries an optional one-line action suggestion rendered beside its description, and the panel header counts how many carry one ('N to review'). Modern and TLS-secured services carry nothing. The cue uses the brand accent, never a health color, so it reads as advice and never as an incident.

added

Hypervisors now page before a datastore fills, a sensor fails, or a clock drifts

The health details arqos already read from your ESXi hosts now raise alerts instead of just sitting on a page. A datastore filling up gets a heads-up while there's still room to act — a warning as it climbs, and a louder note if it crosses into the danger zone — because a full datastore freezes the VMs it holds and blocks backups. A hardware sensor reporting a fault (a dead fan, a failing power component) opens an incident so you can catch failing hardware before it takes the host down. And if a device's clock drifts far from real time, you'll hear about it — because skewed clocks quietly break certificate checks, log timelines, and logins. Each one auto-resolves and threads its all-clear the moment the condition clears.

[+] for the curious

Three new alert kinds, all evaluated server-side from the existing read-only SNMP snapshot — no new agent, no extra polling. Datastore pressure fires per volume on first sight with hysteresis (warning at ≥80% full, critical at ≥90%, easing back under 85%, fully clearing under 75%), and skips ESXi system partitions (BOOTBANK/OSDATA/VFFS and anything under 20 GB). Sensor faults fire when an ENTITY-SENSOR reads nonoperational and clear when it reads operational again. Clock drift fires past five minutes of skew and clears within two. All three are 'warning' severity by design — they reach your standard alert channels and on-call but never walk the critical escalation ladder, exactly like disk-pressure alerts, so device health can't masquerade as an outage. Every kind is excluded from the reachability-recovery sweeps, so a device blinking offline never silently closes a live health incident.

added

Every device now shows the network services it's offering

Open any server or network device and arqos now lists the services it's actually listening for on the network — SSH, HTTPS, a print port, a database — each named in plain language next to its port. For your servers, it reads this from inside the machine itself, so it's the real picture rather than a guess from the outside. For switches, firewalls, and printers, the device reports its own listeners over the same read-only SNMP connection you already set up. Nothing is scanned and no probe packets are sent across your network — each device simply describes itself. It answers the inventory question every review eventually asks: what is this box offering on the network, and do we still need all of it?

[+] for the curious

Agent v0.11.0 builds a passive service inventory from two self-reported sources into one unified view. On machines running the agent it reads the host's own listening TCP sockets locally (the same information netstat shows) — observe-only, no connection opened, consistent with the agent's no-execution-channel design. On probed network gear it walks the standard TCP-MIB tcpListenerTable over the existing read-only SNMPv2c session (GET/GETBULK only), so a device that implements it reports its own listeners and one that doesn't simply shows nothing rather than being scanned. Well-known ports are labeled at display time (SSH, HTTPS, RDP, SMB, IPP and more); anything unrecognized shows as its plain transport and port. Pure inventory this release. Verified end-to-end in production against both a device's local sockets and a probed device's SNMP-reported listeners, each rendered with friendly names.

added

Hypervisors now show their datastores, memory, and every VM they carry

Point arqos at an ESXi host over the same read-only SNMP connection and its page now answers the questions that actually matter: how full is each datastore (a full one freezes VMs and kills backups — it's the quietest way a host takes a business down), how much memory is committed, and which virtual machines are running. A host that pings fine while the one VM that matters sits powered off is no longer invisible — the roster shows every VM with its power state, and honestly marks a machine whose guest heartbeat has gone quiet. Uptime got more truthful too: it's now the host's own clock, so restarting the monitoring service on the device no longer masquerades as a reboot. No vCenter required.

[+] for the curious

Agent v0.10.0 reads HOST-RESOURCES-MIB (hrStorageTable fixed disks and real memory, hrSystemUptime) plus VMware's VMINFO MIB (vmwVmTable: name, guest OS, memory, vCPUs, power state, tools heartbeat) over the existing SNMPv2c session — still GET/GETBULK only, self-detecting, so non-hypervisors cost a few empty walks. The tools heartbeat is a tristate: a VM without VMware Tools reads as unknown, never dressed up as down. Reboot detection prefers hrSystemUptime over sysUpTime when the device provides it (sysUpTime is the SNMP daemon's own uptime and resets on a service restart — the false positive this release removes); sysUpTime remains the fallback for gear without Host-Resources. Storage works on anything that implements the table — NAS volumes report the same way. Display-only this release. Verified end-to-end in production against a simulated hypervisor: three VMs across all three states rendered, and rigged uptime sequences confirmed a host reboot is detected while a daemon restart is not.

added

Every network device now fills in its own spec sheet

Open any monitored switch, firewall, or printer and it now shows what it actually is — model, serial number, and firmware version, read straight off the device, not typed in by anyone. Your asset register stops being a spreadsheet someone has to remember to update. For gear that reports them, you'll also see live environment readings — temperature, fan speed, voltage — so a failing fan or a hot chassis is visible before it becomes an outage. And each device's clock is quietly checked against real time, because logs and certificates only hold up when the clock is honest.

[+] for the curious

Agent v0.9.0 reads three standard MIBs over the existing read-only SNMP session (still GET/GETBULK only, self-detecting — gear without them costs one empty walk): ENTITY-MIB entPhysicalTable for model/serial/firmware (chassis row preferred, serial fallback), ENTITY-SENSOR-MIB entPhySensorTable for temperature/fan/voltage with operational status, and hrSystemDate for clock drift (computed against authoritative server time, and only when the device provides a timezone-anchored clock — a naive local clock is never guessed at, so no false alarms). All display-only this release: it's read-only inventory the device reports about itself. Verified end-to-end against a simulated device — model, serial, firmware, a 178°C fuser sensor, and a 3,200 rpm fan all extracted and rendered; the clock parser is unit-tested across UTC, offset, and timezone-naive forms.

added

Printers now ask for toner before anyone hits a hard stop

A monitored printer already told you it was reachable. Now it tells you what's inside: every supply's level as a bar on its page, the printer's own status (idle, printing, jammed, door open), and its lifetime page count. When a consumable drops to 10%, arqos opens one warning with the supply's exact name — stock the replacement, swap it, and the incident closes itself in the same email thread when the new cartridge is detected. Waste containers work the other way around: nearly full is the problem, so that's when they speak up. No polling schedule to set, no printer-vendor tool to install — it rides the same read-only SNMP connection you already configured.

[+] for the curious

Agent v0.8.0 polls Printer-MIB (prtMarkerSuppliesTable, prtMarkerLifeCount) and Host-Resources printer objects (hrPrinterStatus, hrPrinterDetectedErrorState bitmask) over the existing SNMPv2c session — still GET/GETBULK only, self-detecting (non-printers expose none of these OIDs and cost one empty walk). Supplies alert on first sight with hysteresis: consumed supplies open ≤10% and resolve ≥15%; filled receptacles open ≥90% and resolve ≤85%. Unquantified supplies (RFC 3805 level −2/−3) display honestly and never alert. Supply incidents are a distinct alert kind excluded from reachability-recovery sweeps, hold during snooze/maintenance, and thread their all-clear. Verified end-to-end in production against a simulated printer: 8% toner and a 92% waste box both paged, a simulated swap auto-resolved both into their original threads.

July 6, 20261 change[+]
added

Switches and firewalls now tell you which port, not just "it's down"

Until now, network gear that can't run an agent was watched from the outside: is it answering, how fast. With SNMP monitoring, the same on-site probe now asks the switch itself — every port's link state, its traffic, its error counters. So instead of "the switch is fine but the file server can't reach anything," you get "port 12 lost link at 2:14pm" — with an email when a port that should be up goes dark, and an all-clear in the same thread when the cable comes back. Ports an admin deliberately shut off are respected as a choice, never an alarm. Setup is one field: add the read-only community string when you register the device, and arqos handles the rest — including the automatic failover if the machine doing the polling ever goes quiet.

[+] for the curious

SNMPv2c, strictly read-only (GET/GETBULK only — no SET exists in the agent's codebase; community strings are delivered only with a check's lease to the HMAC-authenticated holder). Per-port status, speed, traffic, and error rates from 64-bit ifXTable counters with 32-bit fallback; rates computed on-agent from counter deltas and deliberately re-baselined after a probe failover so a takeover can never fabricate a traffic spike. Interface state is a current snapshot (the incident ledger is the history); port-down incidents open only for ports previously seen up, hold during snooze/maintenance windows exactly like every other alert, and auto-resolve on link recovery. Verified end-to-end against a live SNMP daemon: baseline poll, rates, a rigged link-loss firing the page, and the recovery resolving it.

July 5, 20266 changes[+]
added

A status page you can hand to anyone

Sometimes the most useful thing monitoring can do is answer one question for someone who doesn't have a login: is everything up? Each organization can now turn on a public status page — a single calm screen with the verdict at the top ("All systems operational"), every site's health, each device's dot, and an honest list of the last 30 days of incidents with how long each one lasted. Devices in a maintenance window show as such instead of alarming. There are no graphs, no addresses, no internals — just the answer. The link is a long unguessable address that you can rotate or switch off at any moment, so sharing it is a decision you can always take back.

[+] for the curious

Opt-in per organization: a 22-character random slug on the org row is the only credential — /status/[slug] is served without a session, outside the auth proxy, cached for 60 seconds, and marked noindex. The data layer is client-safe by construction: names, status dots, and the incident ledger (excluded alerts and internal monitoring-coverage alerts omitted) — never metrics, IPs, culprit paths, or versions. Enable, rotate, and disable live in settings (manager scope, audited); rotation invalidates the old URL immediately. Verified in production: page serves with no session, wrong slugs 404, and one organization's page contains nothing of any other's.

added

Alert thresholds can now be tuned per organization

Different fleets have different tolerances: a build server that lives at 92% disk is normal for one team and an emergency for another. The lines arqos pages on — how full a disk must be and for how long, and how long a machine can go quiet before it counts as offline — can now be set per organization instead of one-size-fits-all. The defaults haven't changed, and nothing changes for you unless your thresholds are deliberately tuned. One thing stays on the machine itself: CPU alerting is decided by the agent, which watches what's actually causing the load — no remote knob can do that job better.

[+] for the curious

alert_rules v1: org-scoped overrides for disk warn/express percent + sustain windows and the offline window, with the shipped constants as defaults. The disk clear line derives as warn − 5 (capped at 85) so lowered thresholds keep their hysteresis instead of flapping. Down-detection groups its sweeps by offline window — zero overrides compiles to exactly the prior queries. Thresholds resolve through a short-lived per-instance cache so the per-heartbeat evaluation cost stays flat. Verified in production against an isolated test org: warn at 50% fired a sustained 60% disk that the 90% default ignores, with no bleed into other organizations' thresholds.

added

Maintenance windows: schedule quiet hours, and arqos holds the pages

If you patch servers every Sunday at 2am, arqos no longer needs you to remember to snooze first. Set a recurring maintenance window — for one device, a whole site, or the whole organization — and during those hours alerts hold automatically: no pages for machines that go quiet on schedule. Monitoring itself never pauses. Everything that happens during the window is still recorded, devices show a calm "maintenance" tag instead of an alarm, and here's the part that matters: if the window closes and a machine hasn't come back, arqos pages you immediately — "the maintenance ended and this one didn't return." So a patch night that goes wrong still wakes someone, and one that goes right wakes no one.

[+] for the curious

maintenance_windows: weekly recurrence (day + start + duration, timezone-aware, midnight/week-boundary safe), scoped to exactly one of device/site/org. Same contract as snooze — suppression gates notification and escalation, never detection or the alert ledger; rows opened inside a window record suppressed:maintenance with notifiedAt null. A maintenance-end net in the down-detection cron sweeps state (not transitions): any still-offline device whose windows have all closed gets its held page fired, idempotent under the notifiedAt guard. Windows are managed from site settings and device pages (operator scope, enforced per-window at the API), and verified end-to-end in production: silence inside a window recorded without paging; window end with the device still down fired the page.

added

A daily or weekly digest email, per recipient

Any alert recipient can now also get a summary email — every morning, or every Monday — that reads the way a colleague would tell it: the verdict first ("Nothing needed you yesterday"), then what actually happened, with related dips grouped into one event instead of a page of rows, and one calm line about anything full-but-flat that arqos is watching. It's scoped to exactly what that recipient covers: their organization, or a single site. Real-time alerts are completely unchanged — the digest is a separate, optional rhythm for people who want the story without the pages.

[+] for the curious

A digest setting (off / daily / weekly) on each notification recipient. Composition is org-scoped at the query layer — a digest for one client is built only from that client's rows — and we probe that isolation with a dedicated dry-run script. Daily digests send at 8:00am Pacific; weekly on Mondays. Incidents opening within 20 minutes of each other cluster into a single event, disks on the watch line compress to one line, and anything still open gets the red treatment plus a direct link.

added

Fleet now tells you the story instead of showing you a wall

The Fleet page used to be a long table where 25 healthy machines got the same space as the 2 that needed you. Now the fleet speaks first: a short briefing at the top — what changed this week, which disks are filling and how many days of runway they have, what dipped and recovered. Each site opens with its own sentence (how long it's been quiet, what its last incident was, how fast it recovered). Only devices with a finding get a full row, written in plain English with the trend attached. Every healthy device becomes one small dot — hover it to read its vitals, click it to inspect. And if you want the classic table, it's still there: every site has a "ledger" that unfolds to all rows and remembers whether you left it open.

[+] for the curious

Sentences are composed server-side from the same signals that drive Attention, plus two new computations: disk trend (this week's growth per warned volume, from a metrics sample ~7 days back) and runway (days to 100% at the current pace — no claim is made without at least 3 days of history). Outage counts in the briefing count machines, not alert rows, and a snoozed device's open alert never contradicts "all recovered." The dot grid renders from data already on the page; per-device detail still loads only on click.

added

Click any device in Fleet for an instant read — no page change

Clicking a device row in Fleet now slides in the same inspector you know from Attention: what arqos thinks of that machine in one sentence, its vitals, a 24-hour CPU line, monitored apps, identity, and recent incidents — while the fleet list stays exactly where you left it. Walk the fleet from the keyboard with j and k, snooze with s, and jump to the full device page with Enter. The device name is still a normal link if you want the full page directly. Also new: click the arqos mark to tuck the navigation away — the rail collapses to just icons (the eye looks away while it's tucked) and remembers your choice.

[+] for the curious

The inspector fetches a per-device summary lazily on open — never preloaded for the list, so the fixed-query-count page render is untouched at any fleet size. The verdict sentence is composed server-side from the same signals Attention uses: offline/blind status, app-down checks, disk over the 90% alert line or the 80% watch line, unexpected reboots inside 24h, then healthy. Culprit folder paths stay operator-gated, exactly as on the device page.

July 4, 20265 changes[+]
improved

Moving around the dashboard is now instant

Clicking between Attention, Fleet, Sites, and the other sections used to show a brief loading placeholder while the next page was fetched. The dashboard now quietly keeps every section ready in the background, so navigation lands on real, current content immediately — and the section you're viewing still refreshes itself every 30 seconds as always. The same work also prepared Arqos for much larger fleets: the pages that assemble your fleet's status now ask the database a fixed, small number of questions whether you monitor 20 devices or 3,000, and we verified that with a 1,000-device test fleet before shipping.

[+] for the curious

Three layers. (1) The fleet data layer replaced per-device latest-sample lookups with single LATERAL queries — one index descent per key, a fixed ~12 queries per page render at any fleet size (measured with pg_stat_statements against a 1,027-device fixture; ~2,000 before) — and sparkline series now aggregate server-side as arrays, cutting the dominant per-row wire overhead 3×. (2) The client router cache holds each section for 60s while a keep-warm loop re-prefetches the rail sections every 45s and immediately after any acknowledge/snooze (which also busts the whole cache so no section can show pre-action state). A headless trace across all 7 sections, two passes, measured 67–133ms click-to-content with zero loading-skeleton mounts. (3) Rendering runs in the same region as the database.

[!] incident

This evening: a burst of false offline alerts, and the all-clears arrived late

Around 5:46 PM Pacific, nine machines were reported offline that were actually running fine, and the "back online" follow-ups didn't go out until we intervened about 45 minutes later. What happened: a database maintenance job ran heavily enough to briefly delay the machines' check-in reports past the missed-heartbeat window, so downtime detection did its job on bad input. Separately, a real bug kept the recovery notices from sending once check-ins resumed — that bug is now fixed at the root, and recovery can no longer be missed: every successful check-in now closes any open offline incident for that machine, no matter what happened before it. Maintenance jobs of that kind now run gently and off-hours.

[+] for the curious

The recovery path was transition-triggered: it only ran on the first report after a device was marked offline. If that exact request failed mid-work (as it did during the maintenance-induced load), the device was already recorded online and no later report would retry the resolve/notify step — incidents sat open silently. The sweep is now unconditional and idempotent on every report (an indexed update that matches zero rows on a healthy device), with disk and app-check incidents explicitly excluded since they have their own condition-keyed lifecycles.

improved

Old raw performance samples now clean themselves up

Arqos keeps the last 14 days of raw per-minute samples (CPU, memory, disk, network) for every device — enough for every chart and alert in the product, which look back at most 24 hours. Older samples are now pruned automatically every night, so the database stays fast permanently instead of slowly accumulating months of data it never reads. Your monthly evidence reports are unaffected: they're built from the durable incident record, which is kept forever.

[+] for the curious

Raw metrics and check-result rows older than 14 days are deleted by a dedicated nightly cron — deliberately separate from the every-minute down-detection cron so housekeeping can never delay an outage alert. Deletes run in small primary-key-ordered batches under a hard 45-second budget; a run that hits the budget simply resumes the next night. This closes the growth pattern behind the July 4 slowdown: the tables that had reached 700k+ rows now hold a bounded two-week window.

fixed

The dashboard got slow this afternoon — found and fixed at the root

For a few hours today, dashboard pages loaded slowly or hung — sign-in included. Monitoring itself never stopped: agents kept reporting, downtime detection kept running, and alert emails kept working the whole time. The cause was a database query pattern that got gradually more expensive as weeks of metrics history accumulated, and today's redesign tipped it over. Pages now load in a second or two, and we've added guards so a slow page can never snowball into a stuck dashboard again.

[+] for the curious

The metrics indexes are declared DESC NULLS LAST, but our ORM emitted plain DESC (NULLS FIRST) in ORDER BY — so Postgres couldn't use the index for "latest N samples" ordering and fell back to fetching every row per device (~32k) and sorting. Fine on a young table; ~5 s per device at 700k rows, multiplied across the fleet view. Fixed by matching the query ordering to the index (all nine call sites, mobile API included), batching sparkline series into single time-window queries, making the 30-second live refresh skip a tick while a refresh is still in flight (no more stacking renders against a slow server), and adding connect/idle/lifetime timeouts to the database pool so a wedged connection can't poison a serverless instance.

added

The dashboard now opens with what needs you — not a wall of data

Signing in now lands on Attention: a short plain-English briefing ("3 things need you. None of it looks like a site outage."), a card for each thing that actually needs a human — what happened, which machine, and what arqos thinks is going on — and your healthy fleet compressed to one quiet line per site. Click any card and a panel slides in with the story: the evidence, the machine's vitals right now, and one-tap Acknowledge and Snooze. If you live on the keyboard, j and k walk the list, e acknowledges, s snoozes. The full fleet view is still one click away — it just isn't the front door anymore.

[+] for the curious

Every sentence on the page is composed on the server from live fleet state — the same absence-based status, snooze semantics, and triage rules the fleet view has always used, now shared through one code path so the two views can never disagree. Acknowledge uses the same first-ack-wins record as email ack links and the iOS app; snooze is the standard 1-hour device snooze. The app also gained a persistent navigation rail and real interactive surfaces throughout — groundwork that the native apps share, since they render the same server-written copy.

June 16, 20261 change[+]
added

Watch the apps and ports your business actually runs on

A server can answer every ping while the thing it exists to run — your database, your line-of-business app, the service behind a port — is quietly stopped. Arqos now closes that gap: on any agent device, open its page and add a check for a Windows service, a running program, or a local port. If the machine is up but that app isn't responding, you get a warning (not a false "server down"), it appears at the top of your fleet's "needs attention" list with the reason in plain English, and it clears itself the moment the app comes back. Quiet maintenance? Snoozing the device silences these too.

[+] for the curious

Checks run on the agent's own host and ride the normal heartbeat — no new connection, no extra agent to deploy. A service check reads the Windows Service Control Manager with query-only access; a process check looks for a matching running program; a port check connects to the port on loopback to prove it's actually accepting. A warning opens only after a check has failed across two consecutive reports (so a momentary blip never pages you) and routes to your standard notification channels. True to the rest of Arqos, this is observe-only: the agent can see that a service is stopped, but it has no ability to start, stop, or restart it — service state, process existence, and port-listening are all metadata, never the contents of anything. Ships in agent v0.6.0.

June 15, 20261 change[+]
added

Arqos now tells you what's eating a busy CPU or a full disk

When a machine's CPU stays pinned high for a couple of minutes, its device page now names the program responsible — "top: backup.exe 82%" — right on the CPU card, so you know whether it's a runaway process or just a backup doing its job. And when a disk fills past 80%, Arqos points at the single folder eating the most space — "largest: D:\Updates\Cache — 35.6 GiB" — so you can see what to clear without remoting in and hunting for it. Both answers appear only while the problem is happening and clear themselves when it passes. They're shown to your team, not to view-only guests, because a process name or a file path is sensitive.

[+] for the curious

The agent captures the culprit only while the condition holds — top processes are sampled (a brief delta measurement) once CPU has been sustained above 80% for two minutes; the largest-directory scan runs on a volume over 80%, throttled to at most once every 12 hours, depth-limited, time-boxed, and at lowered priority so it never competes with real work. Both ride the normal heartbeat as a single line, so steady-state monitoring carries nothing extra. The detail is visible to operator-level access and above, reusing the same permission model as the rest of the device page.

June 13, 20262 changes[+]
improved

Download a monitoring report in one click — clean, every time

The "Download PDF" button on a monitoring evidence report now produces a finished, branded document in a single click — no print dialog, no "save as PDF" detour, and none of the browser clutter that used to creep in (the page title, the web address, and a page number stamped in the margins). What you get is the report and only the report: the white sheet, your logo, the fonts, ready to send to a client, an insurer, or a lender. The report is built on our own systems — your data never passes through an outside service to become a PDF.

[+] for the curious

A session-gated route (GET /api/reports/[orgId]/pdf) renders the existing report page with headless Chromium (@sparticuz/chromium + puppeteer-core) and displayHeaderFooter:false, returning a letter-size PDF as a direct download. The render reuses the page's own print stylesheet, so the document can't drift from what's on screen, and excluded (false-positive) incidents stay out of the exported file.

added

Remove a machine you no longer manage

When a server or workstation is decommissioned, you can now remove it from Arqos completely — open its device page and choose "remove device." That clears it from your fleet, stops its alerts, and permanently revokes the credentials it used to report, so a retired or wiped machine can never check in again. The Downloads page now also walks you through uninstalling the agent from the machine itself, so removal is clean on both ends: take the agent off the box, then remove the device from the dashboard.

[+] for the curious

Removing a device cascades its history and credentials in a single transaction. If it was polling network gear, those checks fail over to another agent at the same site within a minute — nothing is left unwatched. A Windows uninstaller (uninstall.ps1) reverses the install exactly: it stops and unregisters the scheduled task and deletes the binary, configuration, and stored credentials. macOS and Linux removal steps are documented for manual installs.

June 12, 20262 changes[+]
added

Problems now come to you — and uptime explains itself

The fleet page now opens with a "needs attention" list: every device with a problem, the reason in plain text ("disk 89% (F:)", "offline — last seen 3h ago"), most urgent first, one click from the device itself. No more scanning site cards hunting for the yellow cell — if the band isn't there, everything is healthy. And every device now answers the question its uptime raises: a new "last boot" line says why the machine last restarted — a planned Windows update, a person, or an unexpected loss of power. That last one matters: a dirty shutdown also appears in the attention list for its first day, because a server that lost power is a server worth a second look.

[+] for the curious

Agent v0.4.3 classifies boot cause once per start from the System event log (1074 initiated / 6008 unexpected / Kernel-Power 41), ships a one-line verdict with the heartbeat, and reads nothing else — Arqos is not becoming a log viewer. Within each site card, troubled devices float to the top; the cards themselves never reorder, so your spatial map of the fleet stays stable. Disk at 90%+ ranks critical in the band; snoozed devices never appear in it.

[!] incident

A morning of false alarms — and the change that makes it impossible to repeat

For about three hours early this morning, Arqos sent "offline" alerts for machines that were running fine. No monitored system was ever down: an update had idle computers reporting an activity number so close to zero our database refused to store it, and the whole check-in was rejected with it. To Arqos, everyone went silent at once. We found the exact error in the logs, fixed it the same morning, and every false alarm closed itself. The structural change: a device's "I'm alive" signal is now recorded before — and independent of — its measurements. A bad statistic can degrade a chart; it can never impersonate an outage again.

[+] for the curious

Windows agents' emulated load average decays into IEEE-754 subnormal floats (~1e-124) on idle machines; the value passed range validation but Postgres float4 rejected it (22003), and the un-isolated metrics insert failed the request before last_seen updated. Fix: ingest flushes |v| < 1e-37 to 0, the metrics insert is isolated from the liveness write, and the agent clamps the value at the source in v0.4.3. Full postmortem available on request.

June 11, 20265 changes[+]
added

Arqos now watches the gear that can't run an agent

Hypervisors, switches, and storage appliances don't allow software installs — so any Arqos agent at the same site now quietly polls them for you (ping and port checks, every minute). There's nothing to assign or babysit: agents share the work as a pool, and if one goes away another takes over on its own. If the site ever loses all eyes, you get one honest "monitoring blind" notice instead of a wall of false alarms.

[+] for the curious

Checks are site-scoped leases claimed and renewed by any reporting agent (failover in ~3–4 minutes once the fleet is on v0.4+). Probed devices use the same absence-based detection as agents: green checks count as life, partial failure shows as degraded, and silent-with-no-evidence becomes gray "unknown" with a single site-level alert after a grace period. SNMP and read-only vSphere collection are in development.

added

Alerts now know who to tell, and when to escalate

You can route notifications by site and severity, every incident stays in one email thread from first alert to all-clear, and anyone can acknowledge with a single click — no sign-in needed. If a critical alert sits unacknowledged, Arqos walks it up the chain you define, one contact at a time.

[+] for the curious

Per-channel routing with severity floors, signed one-click acknowledge links, and an escalation ladder driven by per-channel unacknowledged-delay. Recovery notices reply into the original incident thread, and anyone who was escalated gets the all-clear too.

added

Snooze alerts for planned maintenance

Rebooting a server on purpose? Snooze its alert emails for an hour, four hours, or until 8am — right from the alert email itself. Detection never pauses and the record never has gaps; only the emails go quiet. If the machine is still down when the snooze expires, you get one final alert.

improved

The agent can no longer be wedged by a dead network drive

A disconnected mapped drive or a stuck Windows subsystem could previously freeze an agent mid-collection — alive as a process, silent as a reporter. Every system call the agent makes now has a deadline, and a watchdog restarts the agent cleanly if a collection cycle ever stalls.

[+] for the curious

Per-call timeouts on load, partition, and per-mount usage reads; mounts that time out are benched for 30 minutes; no completed cycle within max(5× interval, 5 min) exits the process for the scheduled task to restart. Shipped as agent v0.4.2.

improved

The fleet view reads like a status, not a spreadsheet

Devices are now grouped by site with problems sorted to the top, healthy fleets collapse into a one-line "all quiet" strip that shows your last incident and how fast it recovered, and a quick switcher (⌘K) jumps you to any device by name.

June 10, 20262 changes[+]
security

One thing Arqos will never do: reach back

The agent has no remote-control channel — not a hidden one, not a disabled one. It can read health numbers and send them out; it cannot receive commands, run scripts, or update itself without your administrator acting first. That's an architecture decision, not a policy, and it's why a compromise of our service can't become a compromise of your network.

[+] for the curious

Outbound-only TLS on port 443, HMAC-signed reports with per-device secrets, no listening sockets, no execution surface. Agent updates run through your own admin tooling, never pushed from us. The full technical dossier is available on request.

added

Arqos goes live

One command installs the agent on a server, and from then on it checks in every minute over an encrypted outbound connection. If a machine goes silent, you get an email within about two minutes — and when it comes back, the alert closes itself and tells you. Setup is an afternoon; the day-to-day is silence.

See your whole fleet by this afternoon.

Early access is open to a small number of IT teams.

Get early access60-second install · free during pilot