PRTG Release Notes:
Stable Channel

PRTG now validates the value of a device icon to avoid the risk of modifying it to possibly enter arbitrary content into the style tags when loading the Cascading Style Sheets (CSS) for the relevant page. (CVE-2022-35739)

For more information please see our Knowledge Base article: https://kb.paessler.com/en/topic/91149.

We hardened PRTG against a possible Cross-Site Scripting (XSS) attack where a malicious actor could trick a victim into running injected javascript code over a manipulated link.

With PRTG version 23.2.83 we now support TLS 1.3 in the Notification Delivery settings for the Delivery Mechanism Use one SMTP relay server (recommended in LANs/NATs). If you select this option, TLS 1.3 will additionally be displayed for the SSL/TLS Method radio group.

We updated our reporting engine to the Chromium version 89. This update will improve the rendering of PDF reports that did not work in certain cases before. Chromium will create temporary files under %TEMP%/prtg_reporter that will be removed when the PDF report creation is finished.

To ensure secure communication furthermore we updated to the OpenSSL version 1.1.1t. We now support TLS 1.3 in the connection security settings for High, Default and Weakened security connection in the Probe Connection settings and PRTG Web Server settings.

Important: Please note concerning your running HTTP sensors that we do not support any cryptographically broken ciphers for outgoing HTTP connections anymore with this update to OpenSSL 1.1.1t due to security reasons. This concerns the encryption methods MD5, DES, RC4. If you run any HTTP sensors for devices that do not offer any ciphers supported by OpenSSL 1.1.1t anymore, the sensors may run into an error with the message ssl3_read_bytes:sslv3 alert handshake failure.

For further information about the high security standards of PRTG please see our Knowledge Base article: https://kb.paessler.com/en/topic/61108.

We improved our HPE 3PAR Drive Enclosure sensors that in certain cases returned an error with the message An error occured. For more information, check the \Logs\sensors subfolder of the PRTG data directory on the probe system. If you have not enabled debug options, activate Store result under Debug Options in the settings of the sensor, rescan, and check the \Logs\sensors subfolder of the PRTG data directory on the probe system. showcage: invalid option -d. The issue occurred because the sensor uses the option showcage -d in the API what could not be processed by the Primera system, which instead uses the option showcage -all.

We updated our Microsoft Azure Subscription Cost sensors so that they now support the new Azure billing model from Microsoft. Before, the sensor returned an error in the result of sensor log with the message No billing periods found. Cannot continue since there are no individual billing periods anymore in the new Azure billing model and it uses invoices for calendar months instead.

With the update of OpenSSL we also improved certain sensor types that now support TLS 1.3 connection security:

• SSL Security Check sensor now has a new channel for TLS 1.3 TLS 1.3 (Perfect) that the sensor will check if it is supported by the target device and either display Accepted or Denied. In case of Denied, the sensor will report an error in the channel Security Rating.
• HTTP Push Data sensor, HTTP Push Data Advanced sensor, HTTP Push Count sensor, HTTP IoT Push Data Advanced sensor now have a third option for TLS Settings for HTTPS high security (TLS 1.2 to 1.3 and strong ciphers). Default setting for added sensors will be HTTP Unsecure. If you use sensors running on HTTPs and update to this PRTG version, the sensors will use HTTPS low security (TLS 1.0 to 1.3 and weak ciphers) to stay compatible.
  
  Please note that all HTTP Push sensors always support TLS 1.3 even in low security setting. If you use HTTPS high security setting, TLS 1.0 and TLS 1.1 will be disabled and the sensors use the high security ciphers instead.

We improved several sensor types by signing them digitally with Secure Hash Algorithms sha256. In the previous PRTG version, these sensor types failed in certain cases when an AV scanner detected the unsigned .exe files as insecure. Sensor types improved, for example, are as follows: FTP Server File Count sensor, Windows MSMQ Queue Length sensor, Ping Jitter sensor, Windows Print Queue, Traceroute Hop Count sensor, HTTP XML/REST Value sensor.

Various other minor fixes and improvements.

With PRTG version 23.2.83 we deliver a new Python distribution. Python distribution 3.9.13 includes security patches and several other improvements.

Please make sure your custom Python scripts are compatible with Python version 3.9.13. You only need to consider the change if you are using the Python Script Advanced Sensor.

We fixed an issue for the Microsoft 365 Mailbox sensor that could not match emails when you used special (non-ASCII) characters in the filter options Filter by 'subject' with Contains all or Contains any, for example words with accents like "é". The issue was located in the library used by the sensor where URL encoding did not work properly.

We fixed an issue where subjects in email notifications could not be displayed correctly in certain cases in previous PRTG version 23.1.82.2175 and 23.1.82.2074. The issue occurred in cases when you used diacritics or umlauts in the subjects of email notifications.

We fixed an issue for the PRTG core server that caused high CPU usage in certain cases. The reason for this were connection threads in the background that were not terminated.

You can now generate PDF reports again when you are logged in via single-sign on. We first introduced this feature for single-sign on with PRTG version 22.2.77.2204, yet it did not work anymore in the previous PRTG version. The PDF report only displayed the text Unauthorized instead of the report data.

The new UI and PRTG API v2 will now be served under port 1616 (HTTPS) or 1615 (HTTP). We exchanged the old configured ports HTTPS 8443 and HTTP 8080 because we experienced issues in certain cases that the PRTG application server could not start. Please ensure that these ports are not blocked by your firewall and be sure to update any bookmarks and hardcoded URLs. The Open new UI button in the classic UI will be updated automatically.

With PRTG version 23.2.83 you will receive a to do ticket for your NetApp sensors that you still can add but they will no longer work when you update to ONTAP 9.13.1. NetApp ONTAPI will no longer be available by the end of July and NetApp delivers a new RESTful API (ONTAP REST API) for ONTAP based storage systems. With PRTG version 22.3.79.2108 we introduced new NetApp v2 (BETA) sensors that support ONTAP 9.6 and higher.

Please also see our Knowledge Base article for more information: https://kb.paessler.com/en/topic/90198

You can verify the authenticity of the PRTG installer with the Secure Hash Algorithms for the following versions and release channels:

Preview 23.1.83.1742

• sha256_exe 64B149F521E642F129F12746CE341FC1F27C295492AB04AF3EB17531476D301D
• sha256_zip 7F6422082081865010111B0FDF7C3C0CC8D10738D152565F3552054AD15F614F

Stable 23.2.83.1760

• sha256_exe 1BC9CF151400EF422EAAE687CD6CF5E30E598D38848EEB55D409380635FAAFE4
• sha256_zip CB2A73150272D74195DFD1EBF8F92BC202296833A6FE16DD11C30994AC1264CF

Your Docker Container Status sensors may run into an error with the message bad certificate when you update to this PRTG version 23.2.83. We are currently analyzing the issue. 

Solved with PRTG 23.2.84.1566

The update to this PRTG version will in most cases immediately cause a cache recalculation upon starting the PRTG server. While PRTG is usable during the cache recalculation, it will considerably consume more hardware resources like CPU and memory. Depending on your monitoring configuration, you may encounter negative effects on the performance of PRTG during this process. We recommend that you reserve extra time for the PRTG update.

We updated the ITOps to version 3.7.2 to fix an improper access control in the API which could have led to unwanted data leakage (CVE-2023-29488). 

You will now receive the NetApp SnapMirror v2 sensor as a result when you add a sensor to a device on the Add sensor page. The sensor did not appear before when you searched for NetApp sensors and the radio button for Storage and File server was active.

• The REST Custom v2 sensors now support the count function in arrays to get the number of elements that are included in an array.
• We implemented a new value type String (status) which displays three text input fields when you select it for channel strings mapped to the Up, Warning and Down status. The text field input is optional. The channel is assigned to a static lookup file mapping the values for up, warning and down to the according status. The values are mapped to an integer before accordingly.
• Your REST Custom v2 sensors now display the primary channel correctly on the sensor overview page when they are deployed via device template. In the previous PRTG versions, you had to set the primary channel manually afterwards of the device template auto-discovery.
• You can now perform basic calculations on the result of REST queries with the REST Custom v2 sensors without using an extra custom script.

You will now receive results for Redfish sensors when you add a sensor from a device and search for the term Fujitsu on the Add sensor page /addsensor.htm. The sensors listed are Redfish Power Supply sensor (NEW), Redfish System Health sensor (NEW) and Redfish Virtual Disk sensor (BETA).

With this PRTG version we deliver the DLL file for the PRTG probe adapter by default with the PRTG installer, to make the setup and the use of the Multi-Platform Probe easier. For more information about the Multi-Platform Probe please see our Knowledge Base article: https://kb.paessler.com/en/topic/90140

• You can now open the channel graphs page via the context menu button Show Channel Graph. The channel details and channel graph dialogues show error information in case of an error when data cannot be found or loaded.
• You will now get a dialogue pop-up when you click on the Discard button for changing settings. The dialogue offers the options to Cancel or Confirm discarding your changes. You will get a similar dialogue message when you try to navigate to a different page or when you close the page. The dialogues only appear when you changed settings that you did not save.

• We improved the Basic Device Settings by displaying the Monitoring Status and the IP Version options as radio group. This change applies only if there are less than five selections per option.
• You will now see the action bar buttons Discard and Save Settings when you are on the Basic Device Settings page. The action buttons were only visible after you made changes before. After the change, a text appears how many changes you have made, like 1 Change.

• Channel details of a sensor are now displayed when you log in to the new UI again after a logout or timeout.
• Data cache is now cleared when you log out from PRTG in the new UI.
• We fixed an issue for lookups that in some cases displayed an error when you used custom lookup definitions with an unknown type.
• We fixed an issue where the scrolled down position was saved on the sensor overview page. If you now scroll down on a sensor overview page and select another sensor overview page it will be displayed on the top again.
• You now can use the new UI only with a valid license. In case you use an inactive license you will be redirected to https:///activation.htm when you log in to the new UI.

We improved the order of the settings of objects for the experimental section experimental/devices/ID/settings with the most used and most important settings at the top.

You can now run the PRTG application server and activate the new UI with a PRTG Enterprise license. This did not work before in the previous PRTG version when you used a PRTG Enterprise license. The error message returned was The functionality of your PRTG installation is currently limited. License is inactive.

• We fixed an issue for the information text file about open source libraries used in PRTG. You can find the prtgappserver_license_report.txt file in the PRTG installation path. The file contains information about library name, version, notice and license text.
• We fixed an issue where in some cases the application server ran on 32-bit when the core server was operating in 64-bit mode. The application server now uses the same version that the core server runs.
• We improved the startup check of the PRTG application server that in some cases did not come up when it did not receive certain sensor IDs from the PRTG core server.

We fixed an issue with cloning and moving devices that lead to deadlocks of the PRTG server in certain cases as of PRTG 22.4.81, resulting in high CPU load and server crashes and restarts.

The sensor types HPE 3PAR Virtual Volume, HPE 3PAR Drive Enclosure, and HPE 3PAR Common Provisioning Group work again. The sensors showed a down status with the error message 415 Unsupported Media Type after updating to the last PRTG version 23.1.82.2074 due to an issue with HTTP POST requests via REST API. This also affected the experimental REST Custom v2 (BETA) sensor.

HTTP push sensors work with HTTPS again. The sensors remained in unknown status after updating to the last PRTG version 23.1.82.2074 with HTTPS enabled in the sensor TLS settings and did not receive any answers for your sensor requests in this case. Affected sensor types were HTTP Push Data, HTTP Push Data Advanced, HTTP Push Count, and HTTP IoT Push Data Advanced. 

PRTG successfully sends your email notifications again when you use SMTP servers with specific TLS configurations as SMTP relay server, for example Microsoft Office 365. In PRTG version 23.1.82.2074, email notifications did not work with certain servers and showed, for example, the error message Error sending "Email": Connection to SMTP relay server "outlook.office365.com" failed in the logs due to an issue with TLS connections. 

You can activate licenses again when the license name contains an ampersand (&) character. The activation of the license failed with the message License name and key do not match activation file. in the last PRTG version 23.1.82.2074 due to an issue with encoding.

The subject of email notifications is not correctly displayed in the current PRTG version if it contains special characters like diacritics or umlauts. If you primarily use special characters or Asian and Cyrillic characters in your email notifications, we recommend that you do not update your PRTG installation to version 23.1.82. We will deliver a fix for this issue with an upcoming PRTG version.

Solved with PRTG 23.2.83.1760

With PRTG version 23.x.82, reports currently cannot be opened correctly for the option Create and store PDF and data files and Create and store PDF and data files and send them by email when you are logged in to PRTG via Single Sign-On. The opened page shows the message Unauthorized instead of the report data. As a workaround, please use an internal non Single Sign-On user account to view PDF file reports.

Solved with PRTG 23.2.83.1760

In certain configurations, the Windows MSMQ Queue Length sensor reports an error with the message Queuename not found on specified machine. The error may come up during authentication on the target device. We are investigating the cause of this issue.

You can verify the authenticity of the PRTG installer with the Secure Hash Algorithms for the following versions and release channels:

Stable 23.1.82.2175

• sha256_exe 6579651F89D9F168B6FBB56EFB619BFD57CF0EBD74155FF8B582F95EDF2FD2A1
• sha256_zip 11DACE644158A860BCF1301516F2BFFB89435C8EF8705BB6DDA60690243C99F7

The OPC UA Certificate, OPC UA Custom and OPC UA Server Status sensor types now support insecure connections to your OPC UA server with username and password authentication. Note that if you use this configuration, your data including passwords will be transmitted unencrypted.

Thank you for your feedback that the ability to monitor devices with such configurations is needed in several use cases.

Additionally to the Exchange PowerShell, Citrix and EXE sensors in Paessler PRTG version 22.3.79, we also improved the method of password transmission for the following sensor types:

• Active Directory Replication Errors sensor
• FTP Server File Count sensor
• HTTP XML/REST Value sensor
• IP on DNS Blacklist sensor
• Ping Jitter sensor
• Traceroute Hop Count sensor
• Windows Print Queue sensor
• Windows MSMQ Queue Length sensor
• WSUS Statistics sensor

Previously, passwords were sent in clear text. Now they are encrypted, so they are no longer visible in the Windows Event Log or Task Manager.

We fixed a vulnerability that affected certain exe sensors. We thank the reporter who brought this vulnerability to our attention.

PRTG now uses HTTPS by default when downloading new software versions for the PRTG auto-update.

Various other minor fixes and improvements.

We updated the German and Spanish language files.

We fixed an issue with the SMTP&POP3 Round Trip sensor that did not report an error if no email was found in the relevant mailbox. The issue was caused by the sensor matching any email on the mail server.

The SSL Certificate sensor works with a Virtual Host (SNI Name) again even if the SNI name does not contain a dot (.). In previous versions, the sensor showed a down status with the error message Connection reset by peer (socket error # 10054) if the SNI name had no dot. For example, the sensor still worked as expected with example.com but not with example as SNI name. Additionally, the SSL Certificate sensor now supports domains that contain an umlaut (like ü or ä) in the name.

Read-only users can change their password by themselves again if the PRTG System Administrator enables the option Allow user to change the account password in their user account settings.

We fixed an issue where in some cases certain licensee names caused the service for the PRTG core server to stop. The issue occurred during the license activation process.

The automatic update of a large number of remote probes to the latest PRTG version properly works again. In previous versions, remote probes required a manual update after 20 automatically updated remote probes.

You can now watch again the PRTG Tutorial: Creating Maps on the PRTG Welcome page. The link did not work anymore in the previous versions.

You can verify the authenticity of the PRTG installer with the Secure Hash Algorithms for the following versions and release channels:

Preview 23.1.82.2026

• sha256_exe B5A8A06EF616F023E6EFCE31031036ACDB08EC128BAEF5143DD16F36E18DFEE2
• sha256_zip F04C82387B012049633C48CDAAA369A7368D58C3B6CA3B36B654CF79F5F41683

Stable 23.1.82.2074

• sha256_exe 0ACD4ABDE0AA527E417E22148ABE1818639064B06D9D8E48F4281B945AA69710
• sha256_zip F2F262AB9F98919C290B8159BDE1CAF8D1D2377562CC8A692B3E4345E11D0CAF

The new UI is now stable enough to be activated on production systems. Previously, we recommended that you activate the new UI only in test environments. When you activate it, you can use it side-by-side with the classic UI.

Please note that the new UI and PRTG API v2 are still in an ongoing development process and that several features are missing.

For further information about features, requirements and known issues for PRTG API v2 and the new UI please see our Knowledge Base article: I want to use the new UI and API v2. What do I need to know?

• We fixed an issue in the multi-edit menu that caused an error in the required fields validation for the post body. As a result, the Post Body field is no longer marked as a required field when you select POST as Request Method.
• We fixed an issue with the timeout setting in the HTTP v2 sensor. Previously, the sensor did not report an error even if the requested HTTP page did not respond within a certain limit of time.

The Response Time channel is now set as the primary channel for the Ping v2 sensor if you created the sensor with Inverted Error Status disabled and multiple pings. The sensor still shows the Status channel as the primary channel if you enabled the Inverted Error Status feature when creating the sensor.

You can try out the experimental Script v2 sensor that also works on the Multi-Platform Probe. The sensor executes a Python script that returns data in JSON format and shows the exit code. This way you can create your own custom script sensors that may not be available in PRTG by default.

For available example scripts and how to use them, please see the Knowledge Base article: https://kb.paessler.com/en/topic/91349

• You can now change the basic settings of a device in the Basic Device Settings section. The basic settings of a device include Status, IPv4 Address/DNS Name, IP Version, Device Name and Priority.
• You can now resume acknowledged alarms for sensors using the Clear Acknowledged Alarm button via the context menu and bulk edit change.

The mobile view now shows channels with unknown lookup states.

We fixed an issue in the sensor graphs section to avoid the risk of possible cross-site scripting (XSS) attacks.

We fixed an issue for sensor channel values that were sometimes displayed in too large numbers.

• You can now share the graphs page with a URL link.
• You can now see the specific scanning times of a sensor if you have defined them as described in https://https://kb.paessler.com/en/topic/3723. In this case, the scanning interval is named Irregular and shows the scanning times in a tooltip.
• We implemented live graphs for channels that show a down or warning status on the sensor and device overview cards.
• We fixed an issue on the sensor graphs page that caused a reset after an automatic refresh if you interacted with the graphs, such as zooming in.
• You can open graphs in a dedicated, larger view.
• We have updated the content of the PRTG Welcome page to reflect the new features available.

• You can now delete a device with a DELETE request in the experimental section /experimental/devices/{id}. If the request was successful, you will get a 204 response code in return.
  
  Note: You can only delete devices, not probes or groups, for example.
• You can now edit the settings of a device by sending a PATCH request to /experimental/devices/ {id}. Please note that this feature is still in experimental status and does not contain all functionalities yet.

We fixed an issue in the experimental section for the settings endpoints /experimental/sensors/ID/settings and /experimental/devices/ID/settings. The settings were returned empty after you created a device or sensor.

We renamed the scale field in the payload of channels to scaling and improved the description.

We fixed an issue for sensor channel values that were sometimes displayed in too large numbers.