Litmus Edge Manager 3.0.0
12 min
Release Date: October 16, 2026
Review the current list of Limitations.
New features
- Industrial asset hierarchy management:
- Model your physical operations with industry-standard level schemas such as ISA-95 (Enterprise > Region > Site > Plant > Area > Work Center > Work Unit). Define a hierarchy template, build a tree of nodes that follows it, and bind Digital Twin models and instances to the hierarchy. Enable the feature in Experimental Features, then manage it under Company List > Asset Hierarchy. Asset Hierarchy replaces Sites, which are deprecated.
- Restrict who maintains specific levels of an asset hierarchy with role-based access control (RBAC), for example central users on every level and operational users on Area, Work Center, and Work Unit only. A new Operator role grants edit permissions on a branch of the hierarchy.
- Central log streaming:
- Stream logs from Litmus Edge devices to Litmus Edge Manager. Start or stop log forwarding for one device or in bulk, set log retention and maximum disk usage in Integration > Action Log in the Admin Console, and include action logs in support bundles. Streaming logs support the Litmus Edge 4.4.x JSON log format. Requires Litmus Edge 4.4.x.
- CA certificate management:
- Add a custom certificate authority (CA) certificate bundle to the trusted certificate chain, at the instance level or the project level.
- Marketplace (Catalogs and Applications):
- Add a container registry once and use it in every catalog. The new Shared Registries page lets you manage container registries that every catalog can use. Docker Hub, Elastic, and Microsoft are now shared registries, and you can add your own. Shared registries are used by every catalog on the instance, across all companies, with one set of credentials. Shared registries are labeled Shared in the Repository list of a release component.
- Control who can change Marketplace. Marketplace now enforces the Observer and Administrator roles. Observers can view but not change catalogs, applications, releases, and registries. Administrators have full access. Users with neither role cannot open Marketplace. Assign roles on the user profile in the Admin Console. When you upgrade from 2.x, all existing users receive the administrator role.
- Templates:
- Apply solution templates to your edge devices with more control. Requires Litmus Edge 4.4.x or later. Enter the values a template needs, such as device-specific settings, when you apply it.
- Choose Merge & Apply to combine the template with the device’s current configuration, or Apply & Reset to reset the template-managed configuration before the template is applied.
- Preview what an apply would change before you commit. The preview does not change the device.
- Audit logs:
- See who did what, when, and to which resource. Litmus Edge Manager now records an audit log.
- A new audit review screen in the Admin Console lets administrators filter by event category, sub-category, company, project, edge device, and date range, search by free text, and export results as CSV or PDF.
- Edge Devices:
- Create, view, and manage Litmus Edge OAuth clients from the new OAuth Clients tab on the edge device details page. Litmus Edge Manager passes key values through to the edge device and does not store them. The tab is disabled while the edge device is offline. Requires Litmus Edge 3.16.0 or later.
- High Availability management:
- Configure, monitor, and manage High Availability pairs of Litmus Edge devices from Litmus Edge Manager. Each pair has a Primary (active) node and a Backup (standby) node. Litmus Edge Manager polls the status, detects failover events, and updates device roles. To open it, go to Edge Devices, select a device, and then select High Availability. Requires Litmus Edge 4.0.5 or later.
- Digital Twins:
- Start from a ready-made model. The new Asset Hub lets you browse the Litmus catalog of Digital Twin models and import them into your environment.
- Model an asset that is made up of other assets, such as a production line and its machines. Add a Nested Model dynamic attribute to republish another Digital Twin instance's output inside the parent model's payload, or splice its keys in using Skip Key. Deploying the model also deploys the nested model, and you then bind a nested instance in Litmus Edge. Requires Litmus Edge 4.4.x.
- Getting Started:
- Get started faster with the new Getting Started button on the main page. It opens a guide that walks you through creating a company and project, activating edge devices, setting up alert triggers, running apps, and using the AI assistant.
- APIs:
- Look up device IDs, device status, and gateway friendly names in a single batch request.
- Check whether an activation succeeded, and why it failed if it did. The approval response returns device_id, the cloud activation request response returns entry_id, and a new activation status endpoint returns activation and provisioning states.
- Keycloak:
- Litmus Edge Manager now uses Keycloak 26.7.x, which enables SCIM provisioning.
Enhancements and improvements
- Company:
- Company names can now include spaces.
- Edge Devices:
- Organize and filter edge devices with Labels, which replace Groups. Labels sync automatically between Litmus Edge and Litmus Edge Manager. You add labels on the Info tab, and labels created in Litmus Edge show a lock icon because you cannot edit them.
- Litmus Edge templates now sync with encrypted credentials by default, which keeps secrets out of Git. Requires Litmus Edge 4.0.4 or later.
- An incident is now triggered when an edge device upgrade fails.
- Instance dynamic attribute topics edited in Litmus Edge now display correctly in Litmus Edge Manager.
- Restore a Litmus Edge backup from Litmus Edge Manager and follow the progress. Litmus Edge Manager shows the progress and the device reboot, and reports the final result when the device is back online. A restore that takes a long time no longer shows an error while the device is still restoring.
- MQTT credentials are removed and invalidated when you deactivate an edge device.
- Back up Litmus Edge instances that run as Docker containers. Litmus Edge Manager can retrieve Litmus Edge templates from managed edge devices and save them as JSON files alongside your cloud backups, because the standard backup does not cover these instances.
- Templates:
- Template Statistic now shows template details, a list of associated assets (devices, flows, connectors, and analytics), and a filterable audit log of who deployed or modified the template.
- Parameterized templates now use parameter objects in a single JSON format, and the template interface matches.
- Certificates:
- Enable an already-uploaded user-defined SSL certificate with a new API endpoint.
- Remote Access:
- Litmus Edge Manager caches the Litmus Edge Web UI to improve the performance and reliability of remote access.
- The maximum upload size for Remote UI client_max_body_size is now 512 MB.
- Marketplace (Catalogs and Applications):
- A new left navigation has the Catalogs, Shared Registries, and Events pages. A catalog's Applications, Registry, and Synchronization pages are now tabs, and the Registry tab lists only that catalog's private registries.
- Registries that you add to a catalog are now private to that catalog's company. Other companies cannot see them.
- The Catalogs page has new Company and Project filters that narrow the list of catalogs.
- Private variables are masked in Marketplace Catalog API responses, which protects credentials during upgrades.
- Set the Litmus Edge Manager API endpoint URLs with the LEM_API_URL_COMPANIES and LEM_API_URL_PROJECTS environment variables. This resolves connectivity issues in Kubernetes deployments with non-default endpoint paths.
- The currently deployed release is preselected in the Update Application dialog.
- Variable values are restored when a variable is switched from private to public during an application upgrade.
- A new secret management service provides an API to store and retrieve secrets by key or path. Secrets persist across reboots and upgrades, and an environment variable toggles Marketplace Catalog authentication.
- Digital Twins:
- System variables in transformations and static attributes now use single curly braces, for example {EDGE_DT_SYSTEM_TIME}, {EDGE_DT_MODEL_VERSION}, and {EDGE_DT_MODEL_NAME}. The new {EDGE_DT_MODEL_ID} and {EDGE_DT_INSTANCE_ID} variables reference a model's and an instance's identifiers.
- Deploy Digital Twin instances to Litmus Edge from Litmus Edge Manager, including batch deployment through CSV files.
- Litmus Edge Manager applies the same model validation rules as Litmus Edge. It rejects models with whitespace in the model name, special characters in unit fields, or empty parameter values. Dynamic attribute dataType values are stored and returned in lowercase.
- The previous limits on static and dynamic attributes are removed.
- Static attribute keys seeded from the asset hierarchy no longer contain spaces.
- Asset hierarchy metadata is now an ordered JSON array instead of an object, so the payload preserves the order of the levels. Update any integration that reads this field as an object. For example, "asset_hierarchy_metadata": [{"Enterprise": "Enterprise A"}, {"Region": "EMEA"}, {"Site": "LE"}].
- Asset Hierarchy:
- Bind Digital Twin models and instances at any level. Work Units are optional, only the top (Enterprise) level is required, and you can delete any non-root level.
- The code field is removed, so you no longer maintain a separate unique code for nodes, templates, and template levels.
- CSV import uses flat name, levelName, and parentName columns, and you can attach a Digital Twin to any node that has no children.
- Digital Twin data includes its place in the hierarchy. Each bound instance's hierarchy path and metadata synchronize to Litmus Edge, which resolves the {EDGE_DT_HIERARCHY_PATH} and {EDGE_DT_HIERARCHY_METADATA} tokens in payloads. New models include these two attributes by default. Requires Litmus Edge 4.0.15 or later.
- The Add Work Unit dialog lists only Digital Twin instances tied to a governed Litmus Edge Manager model.
- You can sort the instance list, scroll dynamic attributes that were unreachable, and drag and drop instances to any level.
- Long-term token support:
- Create long-term tokens for Litmus Edge Manager API access, with permissions scoped by company and project.
- License Server Management:
- Litmus Edge Manager now prompts you to switch the license type when you add a Core (Site) license, and the licenses API exposes licenseCoreName.
- Integration:
- Git Provider configuration templates are committed as alphabetically ordered, pretty-printed JSON without createdAt and updatedAt. Changes appear as line-level diffs, and syncing an unchanged template no longer creates a spurious commit.
- Events:
- The new Async Tasks page in Events in the Admin Console shows asynchronous tasks and background operations.
- Alerts:
- A new Incidents page in the Admin Console shows and manages incidents at the instance level.
- Global rules monitor system events across all companies and projects. You can apply them to projects, override them per platform, and spot them by the Global badge on incidents.
- Incidents Resolution automatically resolves incidents created by edge devices based on trigger conditions. At the instance level, Enable Automatic Incident Resolution turns automatic resolution off, and a badge on the Incidents page reminds you.
- Litmus Edge Manager license expiration is available as an instance source for alert triggers.
- Incident retention deletes closed and active incidents, with their fired actions, once they exceed a set age. Set it at the instance level or override it per project. The default is 90 days for both, and cleanup is off by default.
- Admin Console Settings:
- Download open source licenses in Settings > Support for security audits.
- Support bundles include license usage details and a runtime snapshot of the instance, licensing, and activated devices, and capture thread, garbage collection (GC), and heap dumps when an application hangs. You can generate key Prometheus metrics through SSH or the CLI even when the Admin console is down.
- APIs:
- These endpoints now support pagination: GET Company List with Details https://{EM_IP_address}/api/v1/company/list, GET Projects within Company https://{EM_IP_address}/api/v1/project?companyName={company_name}, and GET Project Roles https://{EM_IP_address}:8446/admin/v1/user/project/roles.
- Performance and security improvements:
- Reduced the volume and cost of dashboard metrics calls.
- Updated third-party components and dependencies, and addressed findings from platform vulnerability scans.
Azure deployment
- Deploy Litmus Edge Manager on Azure using an Azure Resource Manager (ARM) template, from the Azure Portal, the Azure CLI, or Azure PowerShell. The template creates:
- A virtual machine from the Azure Marketplace image.
- A network security group.
- A virtual network and subnet.
- A public IP, if you choose to create one.
- The template accepts only an SSH public key for the administrator account. Password-based login is not available.
- Fixed an issue where the EMQX pod failed its internal health check and was marked unhealthy in Kubernetes environments with IPv6 enabled for pods.
Resolved issues
- Edge Devices:
- Fixed an edge device provisioning failure that required a Litmus Edge Manager restart after device deactivation and factory reset cycles.
- Fixed static IP persistence so a configured static IP is retained after reboot.
- Fixed MQTT staying connected for deactivated edge devices.
- Fixed the Manage tab for an offline device being shifted to the left.
- Fixed an edge device status stuck at Activation request approved after activation completed.
- Fixed newly added edge devices staying pointed at lem.local instead of the configured remote endpoint.
- Fixed an unexpected error instead of a not-found message when opening a Docker appliance device that no longer exists.
- Fixed saving multiple edge devices at once failing unexpectedly.
- Activation:
- Fixed a Status change failed notification during activation with template provisioning.
- Templates:
- Fixed downloading a parameterized template failing with Template download failed when a variable was not referenced in the template.
- Fixed an encrypted template that could not be created for edge devices earlier than 4.1.0.
- Fixed a template audit message that printed null for company and project on instance-scoped uploads.
- Certificates:
- The error for a user-defined SSL certificate set without a CA now names the missing CA certificate.
- Fixed the Admin console not allowing a switch back to an earlier uploaded SSL certificate.
- Fixed a Could not parse certificate error on the Project Credentials/Settings page.
- Software Update:
- Fixed the firmware upgrade status check getting stuck reporting an error count.
- Events:
- Fixed a MEMORY_LIMIT_EXCEEDED error on the Events page.
- Alerts:
- Fixed an extra empty clickable tab in Alerts when hovering over Notification Settings.
- Fixed an edge device disconnection sending repeated notifications instead of one.
- Fixed an error loading the Incidents page caused by a ClickHouse memory limit.
- Fixed audit log entries that showed null default values for global alert rules.
- Marketplace (Catalogs and Applications):
- Fixed .udp file entries and formatting not being preserved in the Docker Compose editor in Containers > Advanced.
- Fixed private variables not being hidden in application deployment logs.
- Fixed the Application Update window not showing variable default values from the API response.
- Fixed the release list failing to load when a release had no submittedAt value.
- Fixed pulling a Docker image from an external registry succeeding with invalid credentials.
- Fixed cloning a release with spaces in its name failing without an error. Litmus Edge Manager now validates the release name and shows an error message. It also checks if the name contains spaces or other characters that are not allowed, and does not allow an empty name.
- Fixed variables in short-syntax Compose port mappings, such as ${UI_PORT}:3130, being dropped so Docker assigned a random host port. Releases submitted before the fix keep the empty host port. Clone the release and submit the clone.
- Grafana Dashboards:
- Fixed a Grafana synchronization error after removing and creating a company with the same name.
- Settings:
- Fixed settings data that could not be exported and imported.
- Digital Twins:
- Fixed Digital Twin models with duplicate sibling node names failing to deploy to edge devices running Litmus Edge 4.x.
- Admin Console Dashboard:
- Fixed Fleet Manager getting stuck on Application is initializing in production.
- Fixed Litmus Edge Manager initialization getting stuck after an Azure Linux Agent update.
- Fixed a backup from Litmus Edge to Litmus Edge Manager failing because the upload URL could not be retrieved.
- Fixed users whose username contains uppercase letters not seeing their company after being added to a team. Litmus Edge Manager now saves usernames in lowercase, and the upgrade converts existing usernames and team members to lowercase.
- Data Lifecycle:
- Fixed MySQL binary log retention not being configured on Kubernetes deployments, which could fill the disk.
- License Server Management:
- Fixed an issue where you could not change a device's license type from Node Locked to Site License.
- Fixed a 500 error when setting a FLOATING license type if the licensing server held duplicate host ID API keys.
- Integration and Docker Registry:
- Fixed an error during Git Provider validation.
- Fixed certificate verification failures when connecting to a Docker registry that requires authentication.
- Platform and security:
- Fixed multiple high-severity OpenSSH vulnerabilities, with CVSS scores above 7.0, reported by security scanners.
- Fixed changing the SSL certificate in the Admin Console deleting the custom CA certificate.
- Fixed the log storage retention setting not updating.
- Fixed a user without the required privileges being able to change the instance API token.
- Fixed MQTT allowing anonymous connections.
- Fixed project team roles being duplicated.
- Fixed a single sign-on (SSO) user not being assignable the Admin role needed to create a new company.
- Fixed an instance continuing to run an outdated image after a point upgrade.
- Addressed vulnerabilities in third-party components, including CVE-2025-59952.