LynxTrac · By · 15 min read

LynxTrac 1.0.0 and what we mean by stable

LynxTrac is 1.0.0. The work that earned the number was bug fixing, not features, and the kind of bug we were still finding is the reason we finally cut it.

Update, September 2026: two things worth separating. The LynxTrac console is browser-delivered, so you can already run it from a Mac and manage supported fleets from there. What is not yet released is the managed-endpoint agent for macOS, which remains in final validation. Windows and Linux endpoint agents are validated and generally available. The macOS references below describe agent work in progress. This post is otherwise left as written in August.

LynxTrac is 1.0.0.

Version numbers get used to manufacture news. This one is worth being precise about. It is not a feature. In the stretch leading up to it we shipped roughly four bug fixes for every new capability, and that ratio is the announcement.

This is the platform version. It is not a version of any single module, and in particular it has nothing to do with the deployment feature, which has always had releases of its own.

What a 1 is actually made of

The useful signal is not how many bugs you fixed. It is which ones you were still finding.

Early on, the list reads: this does not work. Later it reads: the Docker timestamp shows UTC when the operator is in IST. Reports break if a device was deleted last month. A long folder name overflows the input and the API rejects it. The reboot-pending count on the patch overview disagrees with the patch list. An icon disappears against the dark theme. A 502 from upstream surfaces as a raw warning instead of a handled error.

None of that is glamorous and none of it makes a changelog anyone reads. But you cannot find bugs like that until real people have used the thing for a long time, in timezones you do not live in, on fleets with history in them. My favourite from this run was a UID collision between cloned VMs, which is a bug you only get after somebody templates a machine you monitor and stamps out forty copies of it.

When your remaining list is made of that, you are done arguing about the shape and you are into the long tail. That is what the 1 is for.

A leading zero is a disclaimer. Through all of 0.x we reserved the right to change our minds: move a concept, rename something you had scripted against, decide a data model was wrong and redo it. We used that right more than once, and it usually cost somebody a morning. Dropping the zero gives it up. The shape of the product is settled, along with the tenant hierarchy and the permission model sitting on top of it.

What follows is the inventory, because people keep asking for one page that says what is in the box and we have never written it down properly.

Seeing the fleet, and noticing when it stops talking

Devices and the applications inside them send heartbeats every one to five minutes, reporting online, offline or degraded. A device that goes quiet raises its own alert. Nobody has to spot the gap first.

Health checks run from the platform for HTTP, API, page speed, ping, TCP, UDP, DNS, NTP, WHOIS, FTPS, SSH, SMTP, IMAP, POP, SSL and TLS. A target with nothing installed on it can still be watched. The SSL and TLS checks report how long a certificate has left against a threshold you set, with an option to accept self-signed ones.

The agent handles the checks that only make sense on the machine itself: a Windows service or Linux daemon, a file that should have been written recently, a Docker container, a database connection, a custom command.

CPU, RAM, disk usage and disk IOPS each carry a warning threshold and a critical threshold, with their own intervals and an evaluation window over recent samples. A newly registered device arrives with CPU and disk thresholds already set. Nothing starts life unwatched. Thresholds can be capped so a device sitting on the line does not notify all night, and both users and devices can be suppressed individually.

Alerts go to email, Slack, an in-app hub or a generic webhook. That webhook path also files Jira issues and ServiceNow incidents, carrying the device, the triggering event and a link back. Mapping happens on the Jira or ServiceNow side, so your schema stays yours. It runs one direction only: closing the issue there does not resolve anything here.

Software that stays installed

A software policy declares that something should be present or absent on its targets, then re-evaluates on an interval you set. When reality has drifted, it corrects it and records why.

What makes it trustworthy is the step after the install: a separate verification command runs against the package manager and captures what comes back. An installer exiting zero is not proof. Finding the package afterwards is.

One catalog entry can be satisfied by several packages, each carrying the platform, distribution, architecture and version it applies to. That covers MSI, Winget, Chocolatey, EXE, Scoop and MS Store on Windows, deb, rpm and tar on Linux, pkg, brew and tar on macOS. When two candidates tie on version, a fixed per-platform preference decides. The same policy resolves the same way on every machine.

One caveat that belongs to Winget and not to us: running as SYSTEM, it only sees machine-scope packages. A user-scope application can resolve and then fail to appear afterwards, which is exactly the case the verification step is there to catch.

We wrote this one up properly in software policies: desired state, not one-off installs.

The patch that installed and did nothing

We track patch state and reboot state separately. A patch that has installed but needs a restart is not protecting anything yet, and counting it as done is how a fleet reports 97% patched while the vulnerability is still live. So a device reports installed, missing, failed and reboot-pending as four independent numbers.

A patch policy picks its targets, whether that is every device, a group or a filtered set, runs on a schedule inside a maintenance window, and carries its own approval step and rollback plan. Windows patch data comes from the Microsoft MSRC catalog, Linux from distro-aware catalogs.

A reboot goes into a queue as a request with a record attached. It is one of schedule, defer, force, notify or suppress, and carries a deferred-until date plus a short reason that can reach the person at the keyboard in the on-device prompt. Before disruptive work is queued, the console says whether somebody is signed in right now. We went further into that in patched is not protected: the reboot gap.

Getting onto the machine

You can drive a Windows or Linux desktop from a browser tab, on Windows, macOS or Linux, with nothing for the technician to install first, because the agent dials out to us instead of waiting to be dialled. The screen arrives as H.264 and is decoded in the browser on Chrome or Edge, falling back through software H.264, VP9 and JPEG when hardware decode is not available.

Multi-monitor, clipboard sync, drag-and-drop file transfer and audio all work. Printer redirection works against Windows targets and we would not build a workflow on it. The piece we reach for most is the latency readout, because it settles the argument about whether the link is slow or the machine is pegged.

For protocol access there is a browser gateway covering RDP, VNC, SSH and Telnet, which is how you reach a switch or an appliance console that will never run an agent. The RDP options are the ones you already know: drive redirection, audio in and out, printing, keyboard layout, colour depth and resolution, RemoteApp, a gateway host and TLS or NLA security.

A real shell on the device runs through the agent. No SSH port has to be open for it. You get several tabs on one connection, command history, and whichever shells the machine actually has. Command Prompt, PowerShell or Git Bash on Windows. Bash on Linux. SFTP gets a full file browser, and files cut and paste between windows, including between a remote SFTP host and the managed device’s own filesystem.

Those tools can open as movable, resizable windows on a desktop surface, with an icon grid, a launcher and a taskbar. A technician can work in several side by side. Each has a permission code behind it, and people see only what their role allows. That is Lynx Desktop, and Advanced Remote checks the port before you connect, so a hung session tells you something useful instead of nothing.

Credentials live in a vault, encrypted per record, private or shared, with a logged reason required on each use. Sessions record and play back. Access history keeps who connected to what, when, from where. You can also wake a powered-off machine by picking any online agent on its network and having it send the magic packet.

Shipping a change and proving it landed

A release moves through five recorded stages: created, approve, prepare, apply, verify. Prepare and apply are deliberately separate, because staging an artefact and activating it fail in different ways. Verify is a separate stage. The pipeline does not assume it on your behalf.

A release shows how many of its tasks are approved out of the total, with the step that is actually blocking approval called out. Rollouts can be handed to the auto deployment service, which advances the prerequisite, task-assignment and apply steps on a schedule and records itself as the trigger in the audit trail.

While a rollout is applying you can abort it from the row. Verify and downgrade sit on that same row afterwards. Rolling back takes two clicks and leaves a record. The live console interleaves parallel targets with per-line timestamps and host names. If machines are offline when a scheduled rollout fires, an offline gate blocks the whole thing instead of half-applying it across the fleet.

Artefacts can be fetched from GitHub, GitLab, Bitbucket, S3, Azure Artifacts or SFTP. Triggering directly from GitHub Actions, GitLab CI or Jenkins is not in this release.

Saved scripts run under Command Prompt, PowerShell, Git Bash or Bash, either as an inline command or as a file the platform writes out on the device, each with its own timeout and its own approval state. A run binds to a customer and optionally to a ticket reference, targets devices in parallel or in sequence, and reports completed, failed and in-progress separately, because partial failure is the normal outcome across a real fleet and one overall status hides it.

A release is not finished when it is applied covers the release side of that, and ad-hoc scripts still need a paper trail the scripting side.

Logs that arrive with a name attached

The agent bundles Fluent Bit and writes its tail configuration, buffering to disk so shipping survives a dropped connection, and spreading the retry backoff so a fleet does not reconnect all at once. Windows event logs pull on a daily schedule into their own Event Viewer tab, with Event ID statistics alongside the application log views.

The viewer does real-time streaming with severity filtering, regex search, a time-range picker and CSV export. Above that sits the analysis. We derive an expected volume per time-of-day bucket, flag a spike when observed volume runs above that band, then score every source against its own typical volume and order by the size of the gap. The top row is usually the answer.

None of that is AI and we are not going to call it that. It is arithmetic against a baseline, which is the only reason it can attribute anything.

Silent-after is configurable: six hours, twenty-four hours, forty-eight hours, seven days. Quiet means different things for a nightly batch job and a request path. The application roster ranks by error rate, not count, and exports to CSV. Mark an exception resolved with a note, or several at once, and the error trend then separates resolved from unresolved. A ticket can be raised straight from an exception with the customer, device and application context attached. Your logs spiked, which service actually caused it walks through the mechanics.

The cloud accounts nobody was watching

AWS, Azure and Google Cloud connect with no agent involved. Each account is inventoried across every region you configure, covering compute, databases, storage, networking, serverless, containers, registries and secret stores. Resources that disappear between syncs are recorded as removed. A deleted instance leaves a trace.

Spend breaks out per account, per region, per service and per day, read from AWS Cost Explorer, Azure Cost Management and Google Cloud Billing, with a further breakdown by tag on AWS and Azure. A rules engine flags idle and underused resources daily. Every saving it reports is an estimate, and we would rather write that than let a number imply otherwise.

A daily scan checks configuration against built-in encryption, network, access and availability rules. Drift detection compares live state against a Terraform baseline. Live resources can also be exported back out as Terraform, with the caveat anyone who has used an importer already expects: the HCL comes out valid but ugly, and you will be editing it before it goes anywhere near a module.

You can open an SSH session to an EC2 or GCE instance from the console with no agent on it. The key is generated for that one session, expires by itself on EC2, and is removed from the instance when a GCE session ends. Lifecycle actions run against discovered resources, start, stop, reboot and terminate on EC2 and the equivalents elsewhere, each recorded against the person who ran it.

Cloud accounts are counted separately from endpoints. The free tier includes one account with single-region inventory, multi-region discovery starts on Solo, and cost analytics, compliance scanning, drift detection, Terraform export, tag policy and Cloud Shell begin on Business.

Who gets in, and what the log remembers

Sign-in goes through your identity provider over SAML 2.0 or OpenID Connect, with SCIM 2.0 provisioning and just-in-time account creation, on Enterprise. Second-factor sign-in has always covered TOTP apps with recovery codes. New since the SSO release are WebAuthn and FIDO2 hardware keys, alongside TOTP and not replacing it. Both are on every plan, Free included.

Security monitoring runs on the same agent, powered by Wazuh, on Business and up: threat detection, CVE-matched vulnerability detection, file integrity monitoring across files and the registry, CIS configuration assessment, MITRE ATT&CK mapping, system inventory and audit-logged active response.

Underneath it, every query is scoped by tenant at the data layer. Roles are built from permission templates on every plan including Free, and access can be restricted by CIDR allowlist. The audit trail is append-only and covers platform actions, patches, agents, remote sessions, file transfers and cloud activity, kept for thirty days on Free and up to a year on Business.

Your own LynxTrac subscription is managed in the console: plan changes with prorated upgrades, invoices, payment retries, failed-payment handling, refunds, major card networks. That is your subscription to us. LynxTrac does not bill your customers on your behalf.

There is a mobile app for iOS and Android covering dashboards, logs, status and running saved scripts. It is read-mostly by design and not a full admin console.

What we still do not do

An inventory that only lists strengths is a brochure.

The agent needs outbound network access to reach our relay, which rules out air-gapped environments. It also means egress is worth checking before a rollout: if your proxy terminates TLS, the agent needs to trust your inspection certificate, and if it does not, it fails the handshake and looks like a dead install rather than a config problem. A policy interval means drift can persist for up to that interval. Fine for licence compliance. Not fine for anything you would page someone over. Lock-screen unlock over remote desktop is Windows only. The H.264 pipeline needs Chrome or Edge.

No mobile device management, and no SNMP for network gear. We decided against bundling a signature antivirus engine, since a second scanner mostly costs CPU on a machine the security suite is already watching. Endpoint filesystems are not backed up either, though we do handle database backup across PostgreSQL and MySQL, with full, incremental and differential backups, chain validation and restore planning. Tickets stay staff-side; there is no public portal for your customers. Rollback is the only deployment recovery strategy we offer. If you need canary or blue-green, we are not that tool yet.

What 1.0.0 changes from here

One thing, practically: we now owe you an upgrade path. Renames get aliases, moved concepts get redirects, and breaking a script you wrote against us stops being a decision we get to make quietly.

Everything else carries on, including the bug fixing, which is not a phase that ends. The section above is the short version of what we are not happy with yet. But the product underneath has been running in production with real customers long enough that calling it 0.something had started to feel like false modesty.

Thanks to everyone who ran it while it still had a zero in front, and especially to the people who filed the boring bugs.

LynxTrac is free forever for up to 2 servers, no card required. If you want to try it on real infrastructure instead of reading about it: app.lynxtrac.com.

Related posts