October 2026 has been an unusually heavy month for security. Two events matter directly for LogMan.io operators: a critical vulnerability in the Linux kernel, and a supply-chain incident in third-party components that forced emergency LogMan.io releases.
The practical takeaway is short: patch the host kernel on every LogMan.io deployment, and plan an upgrade to the upcoming emergency LogMan.io release.
The LogMan.io Receiver keeps an immutable copy of every raw log in its archive. The archive is your long-term store, but it does not keep data forever: by default, partitions are deleted from the cold phase after 18 months. If you need to retain raw logs longer, i.e. for compliance, forensics, or as an off-site copy, the simplest approach is to continuously upload the archive to S3-compatible object storage.
This guide describes a one-way, scheduled sync from the receiver cold phase to an S3 bucket using the AWS CLI. The same procedure works with AWS S3 and with S3-compatible providers such as Oracle Cloud Object Storage.
This guide describes how to forward logs from the system tenant on a satellite TeskaLabs LogMan.io deployment to a supersystem tenant on a central TeskaLabs LogMan.io system.
The satellite keeps collecting and processing its own system logs. In parallel, LogMan.io Integration Service (lmio-integ) forwards raw events over TCP to a dedicated LogMan.io Collector on the satellite. That collector is provisioned to a receiving tenant on the central system (recommended name: supersystem) and ships the data over CommLink.
A Ubiquiti UniFi Dream Machine (UDM) is a popular choice for small and mid-sized networks. It handles routing, switching, and Wi-Fi from a single appliance — but by default, it is something of a black box for your SIEM. Its NetFlow/IPFIX export is an excellent way to lift the hood: every conversation that crosses the gateway can be analyzed, searched, and correlated inside TeskaLabs LogMan.io.
This guide walks through the full path, from enabling NetFlow export on the UDM to monitoring the collected flow records in LogMan.io. The setup described here is the exact configuration we run in production at TeskaLabs on our own office router, so every step below is verified to work.
TeskaLabs LogMan.io v26.12 ships with Elasticsearch 7.17.28 by default and supports upgrading to 8.19.12. This guide describes a rolling upgrade: one instance at a time, tier by tier.
Release date: 22.06.2026
LogMan.io v26.12 brings major enhancements to Alert Management, including ticket compression, unified severity levels, SLA monitoring, and push notifications. Discover defaults to the last 4 hours, supports up to 1,000 rows with infinite scroll, and lets you filter by alert ticket and navigate back. Parsec adds processors for VMware Aria Operations for Logs and SAP SAL logs and automatic parsing of Windows Event Access fields.
More than 57% of developers' time is spent in war rooms solving application performance issues rather than building new features (Cisco/Splunk Developer Survey, 2024). That's not a skills problem. It's a logging problem.
The logs your application writes today were crafted for the developer sitting at the keyboard. Someone who knows the code structure, remembers which module emits which message, and understands the internal state machine. When an incident hits at 02:00 in the morning, the person staring at those logs isn't that developer. It's an on-call engineer who doesn't know your code, or an AI agent parsing them for patterns.
Microsoft has changed the way Message Trace data is retrieved from Exchange Online. The original Reporting Webservice API that TeskaLabs LogMan.io used for Message Trace collection is being deprecated and replaced by a new Microsoft Graph API. If you collect Microsoft 365 Message Trace logs, you must update your Azure / Entra ID configuration, otherwise Message Trace collection will stop working.
The Explore module in TeskaLabs LogMan.io is the part of the product where users build their own charts on top of raw log data.
One of the chart types Explore offers is the Region Map.
A region map takes the result of a group by query and colours regions of an image (typically a map) to reflect the value associated with each group.
The image is a regular SVG file that you upload to the LogMan.io Library and reference from your chart definition.
Over the past few months, the landscape of open-weight large language models has changed dramatically. New models are being released at a pace that makes systematic evaluation difficult, yet increasingly necessary.
Most LLM comparisons still rely on synthetic benchmarks. While useful, they often fail to answer a more practical question:
How do these models perform in a real, production-like task?
This article presents a structured evaluation of local LLMs based on a concrete, repeatable, and measurable workload: autonomous code generation. Specifically, we focus on how well an autonomous agent, backed by these models, generates production-ready log parsers, and how that performance scales in terms of quality vs. speed.