Release notes

Pandora FMS NG 784 Feature Release

This update includes new features and improvements designed for those who want to explore the full potential of Pandora FMS.

The latest stable release for production environments is Pandora FMS 777 Andromeda LTS (Long Term Support), intended for deployments that prioritize long-term stability.

Feature Releases, formerly known as RRR, are published approximately every two months and include new functionalities and minor changes not included in LTS versions. They are ideal for testing, non-critical environments, or experienced users who want early access to the latest updates and are not concerned about encountering minor rough edges.

LTS versions are released once a year and consolidate all prior changes, with a specific focus on stability.

New features and improvements
Improvements and small changes
Known Changes and Limitations

Feature Extinction
Bug fixes

New Features and Improvements

Architecture Change in Pandora FMS Server

The most significant new feature in this version is the new internal architecture of Pandora FMS server. This refers to the processes available on the server and how the different types of monitoring are distributed among them.

It’s a major shift that significantly modifies the monitoring thread distribution. The goal was to unify tasks of similar nature to optimize server resource usage without requiring an environment with excessive resource requirements.

The first thing you’ll notice in this version is the following servers not showing up in the list (their features are now handled by other servers):

ICMP Enterprise server
SNMP Enterprise server
Web server
WMI server
Prediction server
Inventory server
Plugin server
NCM server
Export server

And the introduction of these new (or previously existing) servers, which now handle the tasks of the ones above:

The Network server is now responsible for the following types of monitoring:

ICMP
TCP
SNMP
Remote command execution (SSH, Winexe)
WMI
Web
Prediction (services, arithmetic operations, averages, etc.)

The Network High Performance server replaces the former ICMP Enterprise and SNMP Enterprise servers, handling ICMP and SNMP monitoring (only numeric values) and allowing modules to be executed at intervals as low as 15 seconds.

The Heavy server handles:

Plugin monitoring
Inventario monitoring
Vulnerability monitoring
NCM monitoring
Exporting monitoring data to another server

These changes mean that tasks previously handled by dedicated threads now share the execution queue with other elements. The main advantage is that there is no need for dedicated servers and threads for monitoring groups that might be underutilized.

For example, in an environment with minimal WMI monitoring but significant ICMP or SNMP monitoring, it was still necessary to allocate at least one server and thread exclusively for WMI. With the new setup, all monitoring types may be handled by the Network server using the same resources.

New High-Performance Server for Short Polling Intervals

Related to the previous point and the new Pandora FMS architecture, it is now possible to perform basic network polling with intervals as short as 15 seconds (under certain conditions). This applies to centralized servers—note that the Satellite Server has always been capable of running polls with one-second intervals if needed.

New Monitoring Graphs

Another major update in this version is the upgrade of the graphing engine in Pandora FMS web console. Aside from visual improvements, it now includes usability enhancements such as exporting the graph as an image, copying it to the clipboard, and switching between bar, line, and area chart views on the fly.

New Data Comparison System

We’ve replaced the previous system with a more efficient one that compresses the data before sending it to the history database. It stores a specific number of samples per hour, which not only reduces disk usage but also improves synchronization between the real-time and history databases.

New Pandora FMS Marketplace

We’ve been working on a new portal to replace the existing plugin library and offer better search capabilities and a larger variety of useful components for any Pandora FMS environment.

With this release, we are launching the new site, accessible at: marketplace.pandorafms.com

This new interface not only provides improved browsing and presentation of components, but also allows all users to submit new items—be it plugins, image sets, extensions, or utilities—for review. Once approved, they will be available in the portal.

This new Pandora FMS version is fully integrated with the new marketplace, allowing direct component installation and downloading from within the console.

We’ll keep on improving this portal with new useful components.

New Security Monitoring – FIM (File Integrity Monitoring)

Expanding Pandora FMS’s security monitoring capabilities, this version includes a new feature for file integrity monitoring (FIM).

It is available for any MS Windows® or Linux® agent version 784 or higher and works alongside SIEM event monitoring in supported environments.

New Vulnerability Detection Database

As part of ongoing security monitoring improvements, the vulnerability detection database has been updated to significantly increase detection capabilities.

This update not only adds more information but also changes the detection system to be more efficient.

We will keep on developing this feature to offer more possibilities in future releases.

Microsoft® Patch Management through Vulnerability Monitoring

Related to the previous point and integrated with Pandora FMS’s RMM features, it is now possible to schedule Microsoft patch updates and installations with a single click to address vulnerabilities detected during monitoring.

SIEM – Decoder and Rule Management from the Console

We have expanded SIEM monitoring capabilities by improving management. Until now, adding decoders or rules required copying XML files to Pandora FMS server and restarting it. This is no longer necessary: you may now upload or edit them right away from the console.

As part of our Marketplace initiative, we will also increase the number of available decoders and rules, which can now be installed more easily.

Default SIEM Dashboard Improvements

The default SIEM dashboard now displays the top 10 source IPs by event count in the lower-left corner, along with unified pie charts below. Additionally, this chart is now available as a widget in user dashboards.

MySQL 8.4 Supported

Pandora FMS now supports MySQL 8.4.

PHP 8.4 Supported

Pandora FMS web console now supports PHP 8.4 as well.

Agent Creation and Editing from the Command Center

In previous versions, the Command Center had a wizard for centralized agent creation and editing. This feature was temporarily removed but is now reintroduced with improved performance.

Just like in standalone mode, you may now create and edit agents on any node from the Command Center.

Agent Configuration Refactor – Basic Options

The “Basic Options” feature, which allows basic monitoring to be added easily to any agent, has been refactored and enhanced.

Per-User or Group Visual Style Settings

For environments providing monitoring services to multiple clients, offering customized web console interfaces is important. This version now includes the ability to set visual styles individually per user or group.

New Console Languages

Pandora FMS console interface is now available in more languages. Full list:

Spanish
English
French
Catalan
Russian
Japanese
Traditional Chinese
Simplified Chinese
Italian
Portuguese
Arabic
German
Korean
Turkish

Terminology Change – Endpoint

Traditionally, the software installed on Linux® and MS Windows® devices for local monitoring was called simply “Agent,” as was the entity used in the Pandora FMS console to represent monitored systems.

This caused some confusion, so from now on, we will refer to the software formerly known as “Agent” as Endpoint.

New Feature – Force Status to Normal

This much-requested feature has now been included. It is now possible to force any module’s status to “Normal” without altering its data. This can be done right away from Pandora FMS web console.

Manually Add Monitoring Items from the Network Map

It is now possible to manually create a monitoring item right away from the discovered systems map in the Discovery visual editor. By default, it will use the detected system’s name, IP address, and OS, and will automatically add a basic connectivity check (ping).

SIEM: Dynamic Rule Creation via API

The API has been expanded to support dynamic rule creation, allowing integration with MISP systems’ IOCs to automate security rule generation within Pandora FMS SIEM. This API extension enables SIEM group creation, rule listing, rule enforcement, and many other operations needed for bidirectional integration with IOC-providing systems.

Improvements and small changes

Case#	GitLab#	Description
N/A	15482	Enabled module state override from the agent configuration view exclusively for superadmin users.
NA	15449 Related: MR 784, major improvement.	Added File Integrity Monitoring feature, abbreviated as FIM.
N/A	15580	Implemented agent creation and addition to Network Maps.
N/A	15746	Added a button in SIEM Events to create a rule for security monitoring from each item.
N/A	16087	Displayed a warning during synthetic module migration by nodes in the Command Center.
N/A	16183 Related: 16381, 16043, 16284, 16312, 16742	Added new SIEM feature to search dynamic event fields for related events based on a specific field, with the ability to refine the pop-up filtering.
N/A	16257	Improved multiple sections for better usability with the dark theme.
N/A	16265 Related: 16264, 16940	Enhanced the collapsed mode of the lateral menu.
20593	16376 Related: MR 784	Added immediate session termination in user management, both explicitly and implicitly when disabling users (preventing future logins).
N/A	16561 Related: 15905	Added the option to view full hierarchy in the Service Tree.
N/A	16473	Updated the license presentation and acceptance window.
N/A	9480 Related: 6429, 16120	Implemented full agent creation, editing, and deletion in the Command Center, both locally and on centralized nodes.
N/A	14213 Related: 16513, 16726, MR 84	Added feature to show or hide elements in charts across all Web Console sections with visual summaries.
N/A	14283	Added patch verification and tracking in monitored computers with EndPoints for Microsoft Windows® in Pandora RMM.
N/A	16152 Related: 16153, 17227, 16173, MR 84	Added feature for creating and updating SIEM rules through XML files, with the option for users to edit those rules through the Web Console.
N/A	16173 Related: 16152, 17227, MR 84	Added the option to create and edit Indicators of Compromise (IOC) in PFMS SIEM through API 2.0.
N/A	16153 Related: 17189	Added dynamic fields to the widget Top N Events in the SIEM feature.
N/A	16244 Related: 16941	Introduced a new visual experience in the Web Console, configurable at the group level (including superadmin users).
N/A	16299 Related: 16301	Added automatic updating of installed DISCO packages.

Known Changes and Limitations

Case#	GitLab#	Description
18828	15369	Command Center: Updated agent migration requirements between nodes.
N/A	16221	Disabled cascade protection by default when creating agents.
N/A	16229	Displayed warning when enabling the SIEM feature if the Log Collector feature is disabled.
N/A	16318	Added inline help in the alerting feature, under the Event Responses section.
N/A	16324	Expanded Web Console search results to be displayed as dropdowns.
N/A	16325 Related: 17264, 17265, MR 84	EndPoints: Added new global token to prevent unknown events from being generated.
N/A	16327	Added sidebar filters to the heatmap view.
N/A	16329	Modified the access menu for the Dashboards feature in both nodes and the Command Center.
N/A	16391	Included a confirmation dialog when deleting agent modules. 20570, 21098
20570, 21098	16392 Related: 17169, MR 84	Changed the description of the `logfile_usage` module (MSSQL Discovery PFMS plugin).
N/A	16527 Related: 16181, MR 784	Added six new languages to the Web Console.
N/A	16552	Adapted the Discovery IPAM summary view to the Web Console dark theme.
N/A	16528	Changed step display in cluster monitoring configuration (creation and editing).
N/A	16620 Related: 16875	Changed the default password used during Pandora FMS installation to meet MySQL 8 security requirements. It is strongly recommended to configure this password prior to installing PFMS—please refer to the official documentation.
N/A	16630	Renamed Software Agents to EndPoint.
N/A	16807	Added timestamping to the process of moving data to the history database.
N/A	15643 Related: 15735, 15736, 15737, 16077, 14963, 16087, 16023, 16024, MR 84	Added new WMI and Prediction module types. ICMP modules and some SNMP modules now support check intervals as low as 15 seconds. The asynchronous modules (1) now support minimum check intervals of 60 seconds.
N/A	16151 Related: 16736, MR 84	Moved access to the DISCO package library for Discovery PFMS and miscellaneous to: `https://pandorafms.com/library/api`.
N/A	16235 Related: 17264, 17265, MR 84	Modules created by PFMS EndPoints by default do not generate events in unknown states. This can be changed for EndPoints globally under the Performance section of the Web Console general configuration.
N/A	16136	In event filters, the Event type and Event status fields accept multiple parameters.
N/A	16233	Added security processes to the event exclusion list for inventory, for both Linux® and MS Windows®.
N/A	16290 Related: 16169	Improved the filtering mechanism in the Alert detail view.
N/A	16291 Related: 16169	Enhanced the filtering process in the Monitor detail view for both nodes and the Command Center.
N/A	16292 Related: 16169	Added a filtering mechanism in Discovery PFMS package management.
N/A	16293 Related: 16169, 16964	Refactored listing and filtering in Custom reports.
N/A	16294 Related: 16169, 16965	Reorganized the filtering process in agent management.
N/A	16295 Related: 16169, 16966	Implemented a lateral filter in the alert list with free-text search, by groups, by operating system, among other parameters.
N/A	16296 Related: 16169	Removed the group synchronization warning for agent groups in Command Center. The visual interface and filtering were also improved, including for nodes.
N/A	16297 Related: 16169	Renewed the Service list in Operation→ Topology maps view; filters for nodes and Command Center were reviewed.
N/A	16298 Related: 16169	Redesigned «Visual Console List» in «Topology maps», with added lateral filter.
N/A	16305 Related: 16474, WarpU 37	For PFMS server environments without internet access, changed the registration of a newly installed instance to the user’s Web Console (with internet connection). Also fixed a false positive on successful registration.
N/A	16481	The default PFMS SIEM Dashboard was improved and redesigned to cover more commonly used monitoring features in that area.
N/A	16668	Changed the update frequency (Warp Update) to every eight hours.
N/A	16021	Built a proprietary vulnerability detection database within PFMS.
N/A	16247 Related: 16245	Added support for PHP 8.4 and MySQL 8.4.
N/A	17104	Changed overwrite mode in debugging for the server parameter `thread_log`.
N/A	15986 Related: MR 84	Added “All” option for VMware® monitoring with the Discovery PFMS plugin (ESXi, Datastore, VM).
N/A	17456 Related: 17351	New web address for the plugin library for PFMS.
N/A	17562	SIEM: Added new token `log_collector_chunck_size` for inserting XML checks in block form.

Feature Extinction

Case#	GitLab#	Description
N/A	16332	Removed the agent/alerts view plugin.
N/A	16193	The token «console_apipass» has been deprecated.

Bug fixes

Case#	GitLab#	Description
19594	15381 Related: 16909, MR 784	Fixed the restoration of module behavior after applying scheduled Quiet downtime for modules.
20410	15526 Related: 15356, 14740	The bulk module editing feature was thoroughly reviewed and several issues were fixed.
20405	16127 Related: 16139	Corrected the search and addition of agents by group selection in network maps.
20375	16258 Related: 13026, 16107	In the Agent security view, fixed agent search and display and resolved duplicated buttons.
N/A	16282	Improved several usability elements in the SIEM search section.
N/A	16450 Related: 16448	In the agent detail view, fixed the graphical display and the count of active alerts.
N/A	16470	In EndPoint Security Audit, added an exception routine to perform each check individually.
N/A	16733	In the Log Collector, fixed creation of the required pipeline to start monitoring.
N/A	16747	Corrected the false positive message for agents in auto-load balancing mode.
N/A	16748	Fixed the operating system field in the filter of the Agent Detail view.
N/A	16801	Removed repetitive welcome message in the Free Version of Pandora FMS.
N/A	16813	Fixed unintended deactivation of the Log collector feature when changing other values in general settings.
N/A	16822	Fixed SQL query error in the service wizard (nodes and Command Center).
N/A	16866 Related: 16935	Corrected filters in the Discovery PFMS view (reset button and visual presentation).
N/A	16943	Refined and fixed the query of servers and Satellite Servers in nodes.
18326	14138 Related: 14184	Basic agent options were fixed to properly account for the related operating system and the involved file collections.
18770	14330 Related: 16909, 16967, MR 84	Fixed monitoring policy operations in the Command Center on nodes in real time while each node performs database maintenance.
N/A	16287 Related: 16002, 16892	Corrected minor errors during Discovery execution using the plugin SAP.
N/A	16090	Fixed the process of password change by the user, considering whether it is a node centralized to a Command Center.
N/A	16120 Related: 9480	Corrected the creation of agents by Command Center (HTTP 500 error).
20860	16449 Related: 16868, 16295	Alert filtering from agent details was fixed (nodes and Command Center).
20638	16508 Related: 15773	Fixed and recompiled the plugin for VMware monitoring with Discovery PFMS.
20643	16513 Related: 14213	Fixed the date selector in the custom graphs view.
20940	16924 Related: 15347	Fixed SNMP checks (non-standard port numbers and other OID variables).
N/A	15505 Related: 16392	In MS SQL Server® monitoring via Discovery PFMS, fixed prefixes for the creation of agents per database.
N/A	16826 Related: 16996	In the service tree view, both for nodes and in the Command Center, corrected recursion for three or more levels in service hierarchies with modules included at the last level. Also optimized RAM usage.
N/A	16936	Fixed SQL error when copying a Visual Console.
N/A	17045	In agent management in the Web Console, restored quick access links for editing agents, modules, and alerts.
N/A	17088	In saved event filters, set the value zero (0) to display items regardless of elapsed time.
N/A	17123 Related: 14184	Fixed HTTP 500 error in the creation of an agent through the Web Console.
21237	17170 Related: 13829, MR 84	Resolved duplicated external alerts applied through monitoring policies.
N/A	17161 Related: 16508	In the Heatmap widget, added exception handling in the centering calculation.
N/A	16666	Fixed the RPM installer for EndPoint to work with the `module_absoluteinterval` monitoring command.
N/A	17201	Tentacle protocol, client and server, corrected for encrypting communications with EndPoints for MS Windows®.
N/A	17221 Related: 16250	Log viewer section fixed to display monospace font (filters).
N/A	16237	Added exception handling for expired licenses in the PFMS API 2.0 feature.
N/A	17254	Fixed SQL error in the «Monitor detail» view.
N/A	16314	In the differences in inventory, fixed a parsing error delivered by EndPoint checks for MS Windows®.
N/A	17220 Related: 14213	The «Graph type» filtering parameter in the Log viewer was removed since those graphs do not exist; instead, it describes how to retrieve the data to be graphed.
N/A	17343	In the «Monitor detail» view, redefined the columns that cannot be sorted (ascending/descending).
N/A	17421 Related: 16657	SIEM: Rule cloning process has been corrected and its memory management and updating have been optimized.
N/A	17356	Fixed exception handling in Warp update online.
N/A	17476	Corrected the overreach in the deletion of agent modules by Web Console.
N/A	17480	Erratum corrected in configuration file when enabling inventory in agent.
N/A	17569	Monitoring Policies: corrected check interval message according to module type.

These release notes describe new features, enhancements and fixed issues as well as some workarounds for known problems. For more information about previous versions, visit the release notes section of our website.

For information on minimum system requirements, please visit the installation section in the official documentation.

How to update Pandora FMS

Automatic update: Use the Update Manager in Pandora FMS console (requires internet connection).
Manual update: Upload OUM update files in Pandora FMS console.
Package installation: Download and install packages (rpm, deb...) and update the console from the web.

To update the server, use RPM packages or tarball manually. The latest version includes MR 82, which should be applied according to the indications of the official documentation.

More information about downloads:

See our Wiki for detailed instructions on each upgrade process.

Other resources of interest

Official documentation

Plugin library

Technical support

Legal information

This document cannot in any case be reproduced or modified, decompiled, disassembled, published or distributed in whole or in part, or translated to any electronic or other means without the prior written consent of Pandora FMS. All rights, titles and interests in and towards the software, services and documentation will be the exclusive property of Pandora FMS, its affiliates, and/or respective licensees.

PANDORA FMS DISCLAIMS ALL LIABILITY FOR WARRANTIES, CONDITIONS, OR OTHER TERMS, EXPRESS OR IMPLIED, LEGAL OR NOT, OVER THE DOCUMENTATION, INCLUDING WITHOUT LIMITATION THE NON-INFRINGEMENT, ACCURACY, COMPLETENESS, OR CONTENT OF ANY INFORMATION ON ANY CONTENT. IN NO EVENT SHALL PANDORA FMS, ITS SUPPLIERS OR LICENSORS BE LIABLE FOR ANY DAMAGES, WHETHER ARISING FROM CONTRACT, INJURY OR BASED ON ANY OTHER LEGAL THEORY, EVEN IF PANDORA FMS HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

All registered trademarks of Pandora FMS are the exclusive property of Pandora FMS SLU or its affiliates, registered with the United States Patent and Trademark Office (U.S. Patent and Trademark Office), as well as with the European Patent and Trademark Office. They may be registered or pending registration in other countries. All other brands mentioned herein are used for identification purposes only and are trademarks of (and may be registered trademarks) of their respective companies.