What’s New in OpenNMS Horizon 36

The core application frameworks have been upgraded to currently supported versions: Spring Framework 5.3, Spring Security 5.8, Hibernate 5.6, Hibernate Validator 6.2, and Apache Camel 3.22. The OpenNMS-patched forks of Spring, Spring Security, and Hibernate have been removed in favor of stock releases, and Eclipse Gemini Blueprint has been replaced by an OpenNMS Spring OSGi extender.

Most installations require no action, but there are behavior and compatibility changes for installations with custom Spring Security configuration (SSO, LDAP), custom Camel routes, or plugins that use the OpenNMS persistence APIs. See Spring, Hibernate, and Camel Platform Upgrade for details.

The core application frameworks have been upgraded to currently supported versions: Spring Framework 5.3, Spring Security 5.8, Hibernate 5.6, Hibernate Validator 6.2, and Apache Camel 3.22. The OpenNMS-patched forks of Spring, Spring Security, and Hibernate have been removed in favor of stock releases, and Eclipse Gemini Blueprint has been replaced by an OpenNMS Spring OSGi extender.

Most installations require no action, but there are behavior and compatibility changes for installations with custom Spring Security configuration (SSO, LDAP), custom Camel routes, or plugins that use the OpenNMS persistence APIs. See Spring, Hibernate, and Camel Platform Upgrade for details.

The contents of etc/datacollection-config.xml and etc/datacollection/*.xml are migrated into the database during the upgrade process, and the original files are moved to etc_archive/. After upgrade, manage SNMP data collection through the *Administration → Manage SNMP Data Collection Config* page (or the REST API under /api/v2/datacollectionconf). Direct edits to the archived XML files no longer take effect.

The SNMP MIB compiler has a new Vue UI and a REST API under /api/v2/mibs. Use the SNMP MIB Compiler (New UI) page to upload, view, edit, compile, and delete MIB files. From a compiled MIB, you can generate event definitions, an SNMP data collection group, and graph templates. Generated event definitions and data collection groups are stored in the database, the same as manual uploads on the event configuration and SNMP data collection pages. Graph templates are written to etc/snmp-graph.properties.d/. The legacy MIB compiler page remains available.

The contents of snmp-config.xml are migrated into the database during the upgrade process, and the original file is moved to etc_archive/.

After upgrade, manage SNMP configuration through the Integrations → SNMP Agent Configuration page (or the REST v2 API under /api/v2/snmp-config). Direct edits to the archived XML file no longer take effect.

The new UI supports definition lookup by IP address and location, profile management, and supports both IPv4 and IPv6.

The legacy file-based SNMP credential encryption feature (the org.opennms.snmp.encryption.enabled property and the snmp-config-encrypt / snmp-config-decrypt Karaf commands) has been removed. The upgrade handles existing encrypted configurations automatically. For protecting SNMP credentials, use Secure Credentials Vault (SCV) metadata expressions in your SNMP configuration.

See SNMP Configuration REST API for details.

The contents of trapd-configuration.xml are migrated into the database during the upgrade process, and the original file is moved to etc_archive/.

After upgrade, manage trapd configuration through the Integrations → Trap Configuration page (or the REST v2 API under /api/v2/trapd). Direct edits to the archived XML file no longer take effect.

See Trapd REST API (v2) for details.

Individual services in service-configuration.xml can now be enabled or disabled at runtime via environment variables, using the pattern CORE_SERVICE_<NAME>_ENABLED. For example, set CORE_SERVICE_TELEMETRYD_ENABLED=false to disable Telemetryd without editing the configuration file.

This is particularly useful for containerized deployments where service composition is controlled via environment. Existing enabled="true|false" values in the file remain the default when no environment variable is set.

The OSGiBasedTicketerPlugin is now the default ticketer plugin. Ticketing is automatically enabled when an OSGi-based ticketer plugin is installed and disabled when it is removed. The NullTicketerPlugin and the opennms.ticketer.plugin property have been removed.

Horizon can now be accessed by AI agents through the Model Context Protocol (MCP): installing the optional opennms-mcp-server feature exposes tools to query nodes and alarms, acknowledge or clear alarms, and send events, governed by the user’s existing roles. See MCP Server for installation and details.

The Vue-based web UI now supports a light/dark theme toggle, in addition to the system-default option.

The contents of the file eventconf.xml will be stored in the database during the upgrade process and all files in etc/events will be moved to etc_archive. These events will not be imported into the database.

After upgrade, manage event configurations through the Administration → Manage Event Configurations page (or the REST API under /api/v2/eventconf).

See Migrating event files after upgrade for the steps to re-upload your customized event files from etc_archive/events/.

java.io.tmpdir moved from ${OPENNMS_HOME}/data/tmp to ${OPENNMS_HOME}/tmp, and the embedded ActiveMQ broker’s on-disk store (activemq.data) moved from ${OPENNMS_HOME}/data/tmp/activemq to ${OPENNMS_HOME}/var/activemq.

To keep the previous behavior, see Startup Configuration, or Core Docker for container deployments.

The OpenNMS WSMan library has added support for WinRS remote shell commands. A corresponding monitor and detector have been added to leverage these new capabilities.

The OpenNMS WSMan library has added support for Kerberos message encryption over unencrypted channels. The existing configuration has been extended to take advantage of this new feature. This should greatly reduce friction when deploying WS-Man / WinRM-based monitoring on Windows.

A preview interface has been added to eventually replace the previous Ad-Hoc Graphing workflow with a more modern UI that takes advantage of current OpenNMS REST APIs for nodes, resources, and metric measurements.

The notifd daemon has had much of its underlying software infrastructure modernized, including mail libraries, to improve support for modern protocols.

The Kafka producer feature now supports producing metric payloads to Kafka as JSON format.

There are extensive improvements to how our OpenAPI docs are generated and rendered. This includes more reliable rendering with reduced load times as well as expected payloads and responses for many more API endpoints.

Support has been added for configuring Karaf shell authentication using ssh public keys.

The Kafka client libraries have been upgraded to 3.9.1, which adds the org.apache.kafka.sasl.oauthbearer.allowed.urls system property for CVE-2025-27817. Core, Minion, and Sentinel now ship that property with an empty value in etc/opennms.properties and etc/system.properties, so the client contacts no token or JWKS endpoint URL. If you authenticate to Kafka with SASL/OAUTHBEARER, set the property to a comma-separated list of your endpoint URLs before upgrading. Other SASL mechanisms, such as SCRAM, are not affected. See Kafka message broker for the client configuration.

All mail sending and reading now uses Jakarta Mail 2.1 (Eclipse Angus) instead of JavaMail 1.4; existing javamail-configuration.xml and javamail-configuration.properties files load unchanged. The JMTA local-MTA transport is gone (use-jmta is still accepted, but mail is sent over SMTP to the configured mail host), <javamail-property> entries now reach the mail session instead of being ignored, and SSL/TLS connections now verify that the server certificate covers the mail host. See Mail server TLS for the TLS properties, and token authentication for the OAuth2 (XOAUTH2) SMTP authentication that Microsoft 365 and Gmail now require.

BSFNotificationStrategy executes scripts through the Java scripting API instead of the retired Apache Bean Scripting Framework; existing scripts generally keep working, but see Scripted Notifications for the deprecated parameters and behavior changes.

SlackNotificationStrategy and MattermostNotificationStrategy have been removed in favor of WebhookNotificationStrategy, which takes the URL, method, headers, and body from the notification command and so can also target Microsoft Teams, Discord, and non-chat endpoints. The org.opennms.netmgt.notifd.slack. and org.opennms.netmgt.notifd.mattermost. properties no longer have any effect.

Neither strategy shipped as a stock notification command, so this affects only hand-added commands, which fail when a notice is sent until their <execute> element and arguments are updated. See Webhook Notifications for the mapping.

The XMPP notification strategies have been removed and xmpp-configuration.properties is ignored. Existing users.xml files with xmppAddress contacts still load, but no notifications are sent to them.

The IRCcat notification strategy, the stock ircCat notification command, and the irccat.host and irccat.port system properties have been removed. An ircCat command left in an existing notificationCommands.xml still loads, but notices routed to it fail when sent.

The Asterisk notification strategy, the AsteriskGateway daemon, the stock callHomePhone, callMobilePhone, and callWorkPhone notification commands, and the asterisk-configuration.properties and ami-config.xml files have been removed. Those commands left in an existing notificationCommands.xml still load, but notices routed to them fail when sent.

Spring Security 5.8 has no compatible SAML/OpenID extension libraries, so they are no longer shipped. If single sign-on is enabled through a custom spring-security.d/.xml file, the web application fails to start after the upgrade — this affects *all logins, not just SSO. See Spring, Hibernate, and Camel Platform Upgrade for this and other upgrade-related compatibility changes.

The WMI monitor, detector and collector had been removed, as the WS-Man integration offers better support for newer versions of the Windows operating system.

The SNMP implementation JoeSNMP was removed in OpenNMS Horizon.

The C3P0 connection pool factory (org.opennms.core.db.C3P0ConnectionFactory) and etc/c3p0.properties have been removed. HikariCP is now the only supported pool, and has been the default since OpenNMS Horizon 35.

If your opennms-datasources.xml explicitly sets factory="org.opennms.core.db.C3P0ConnectionFactory", remove that attribute before upgrading.

OpenNMS Horizon now requires PostgreSQL 14.x or newer. If you are running an older version, you must upgrade to PostgreSQL 14 or later. Attempting a schema upgrade with install -dis will result in an error. If upgrading PostgreSQL to at least version 14 isn’t possible and you’re completely blocked, the -Q flag lets you skip the version check. Use this only as a last resort, since it may affect compatibility. Be aware that doing so takes you beyond supported configurations — here be dragons.

The OpenNMS Cortex TSS plugin has been renamed to the Prometheus RemoteWrite plugin to reflect that it works with any Prometheus remote_write-compatible time series store, not just Cortex. As part of the rename, the OSGi configuration PID changed from org.opennms.plugins.tss.cortex to org.opennms.plugins.tss.prometheus.

The Karaf feature is now opennms-plugins-prometheus-remotewrite (previously opennms-plugins-cortex-tss), and the KAR file is opennms-prometheus-remotewrite-plugin (previously opennms-cortex-tss-plugin). See the Prometheus RemoteWrite plugin documentation for details.

Newts, the time series store backed by Apache Cassandra, should be considered deprecated. Horizon 36 still ships with Newts support for existing Newts users: if you are already running on Newts, you can continue to do so through this release.

After Horizon 36 reaches end of support, OpenNMS will no longer provide official support for the Cassandra backend, and Newts will not be carried forward into subsequent releases. If you are using Newts, we suggest planning a move to the Prometheus RemoteWrite plugin, which stores metrics in any Prometheus remote_write-compatible time series database. Note that there is no tool to copy existing Newts data into another store, so after a switch the historical metrics remain in Cassandra until its retention period expires.

We have updated the Jasper Reports engine to version 7.0.7. Custom reports created using version 6.x must be updated to work with the new version.

Writing OpenNMS configuration through the REST API (POST/PUT/DELETE on /rest/config/**, including the alarm northbounder configurations) now requires ROLE_ADMIN; previously an account with only ROLE_REST could write these. Update any integration that used a ROLE_REST account to change configuration to use a ROLE_ADMIN account. Reading configuration and all other ROLE_REST data operations are unchanged.

Reading requisitions through the REST API now requires ROLE_PROVISION or ROLE_ADMIN. Give ROLE_PROVISION to integration accounts that read requisitions.

The asset fields password, enable and snmpcommunity are now write-only in the REST API.

The raw SQL query parameter of the v1 REST API now requires ROLE_ADMIN.

Requisition and foreign-source XML that contains a DOCTYPE is now rejected on import. Remove the DOCTYPE from requisitions that external tools write, or set the system property org.opennms.provision.requisition.allowDoctype=true to accept it.

The Vaadin-based Ops Board (operator board) and Wallboard, their dashlets, and the Wallboard Configuration admin page have been removed. These provided auto-rotating, dashlet-composed displays intended for wall-mounted operations screens.

The Ops Board and Wallboard main-menu entries and the admin/wallboardConfig.jsp page no longer exist, and any existing Ops Board configuration is no longer used. There is no drop-in replacement.

The feature formerly labeled KSC Reports is now Graph Collections throughout the web UI (the main-menu entry, page titles, breadcrumbs, the Add to Graph Collection dialog, and the home-page section) and the documentation. The global search category formerly named KSC Report is now Graph Collection.

This is a user-facing label change only. The underlying configuration file (etc/ksc-performance-reports.xml), the REST endpoints under /rest/ksc, the KSC/*.jsp page URLs, and the internal identifiers are unchanged, so existing reports, saved bookmarks, and API integrations continue to work without modification.

The last release of the BeanShell interpreter was in 2016. As such, we are deprecating support for BeanShell and will remove it in Horizon 37. Groovy support remains available everywhere BeanShell was implemented.

The deprecated RT Ticketer plugin was removed in this release.

The deprecated CIFS plugin was removed in this release.

The deprecated NSClient plugin was removed in this release.

The deprecated JMS-Northbounder plugin was removed in this release.

The deprecated Juniper TCA Collector plugin was removed in this release.

New commands have been added to the Karaf shell for provisioning workflows, specifically: add-detector-to-fsd, add-requisitioned-node, delete-detector-from-foreignsource, delete-requisitioned-node, delete-requisition, import-requisition, show-foreignsource-definition, show-requisition, and synchronize-requisition.