netdata · Ancairon · Jun 3, 2026 · Jun 3, 2026
diff --git a/docs/Collecting Metrics/Collectors/Containers and VMs/VMware vCenter Server.mdx b/docs/Collecting Metrics/Collectors/Containers and VMs/VMware vCenter Server.mdx
@@ -888,18 +888,21 @@ No additional configuration is required.
 
 #### Returns
 
-Cached vSphere inventory topology payload. Actors represent discovered inventory objects and links represent parent-child, host-runs-VM, or host/VM-connects-network relationships.
+Cached vSphere inventory topology payload using the netdata.topology.v1 schema. Actors represent discovered inventory objects and links represent inventory ownership, VM-to-host runtime placement, and host/VM network attachment relationships.
 
 | Column | Type | Unit | Visibility | Description |
 |:-------|:-----|:-----|:-----------|:------------|
 | schema_version | string |  |  | Topology payload schema version. |
-| source | string |  |  | Topology source identifier. |
-| layer | string |  |  | Topology layer identifier. |
-| agent_id | string |  |  | Netdata Agent identifier for the node serving the function. |
+| producer | object |  |  | Producer metadata identifying the vSphere topology source, selected collector job, plugin, and local node when available. |
 | collected_at | datetime |  |  | Time when the cached topology response was built. |
-| view | string |  |  | Topology view identifier. |
-| actors | array |  |  | vSphere inventory actors, including datacenters, clusters, ESXi hosts, VMs, datastores, optional networks, datastore clusters, and resource pools. |
-| links | array |  |  | Topology links between vSphere inventory actors. |
+| view | object |  |  | Topology view metadata. |
+| dictionaries | object |  |  | Compact-table dictionaries used by actors, links, evidence, and detail tables. |
+| types | object |  |  | Actor, link, evidence, table, and presentation type registry. |
+| presentation | object |  |  | Graph-level presentation metadata. |
+| actors | object |  |  | Compact actor table for vSphere inventory objects, including datacenters, clusters, ESXi hosts, VMs, datastores, optional networks, datastore clusters, and resource pools. |
+| links | object |  |  | Compact link table for relationships between vSphere inventory actors. |
+| evidence | object |  |  | Relationship evidence tables backing the rendered links. |
+| tables | object |  |  | Actor detail and label tables used by topology modals. |
 | stats | object |  |  | Counts of discovered inventory objects, actors, and links included in the response. |
 
 

diff --git a/docs/Collecting Metrics/Collectors/Networking/SNMP devices.mdx b/docs/Collecting Metrics/Collectors/Networking/SNMP devices.mdx
@@ -662,7 +662,7 @@ Current BGP peer and peer-family details from cached normalized SNMP data. Each
 
 Provides the agent-wide SNMP topology view built from all currently running topology-enabled SNMP jobs.
 
-This function reads cached LLDP/CDP data collected by the independent topology refresh loop and returns a topology schema (devices, links, and stats). No additional SNMP requests are triggered when calling this function.
+This function reads cached LLDP/CDP, bridge, FDB, ARP, and STP data collected by the independent topology refresh loop and returns a netdata.topology.v1 payload with compact actor, link, evidence, and detail tables. No additional SNMP requests are triggered when calling this function.
 
 Use cases:
 - Discover Layer 2 neighbors and link mapping
@@ -694,16 +694,22 @@ No additional configuration is required.
 
 #### Returns
 
-Agent-wide topology data in a JSON schema suitable for cross-agent aggregation.
+Agent-wide SNMP topology data using the netdata.topology.v1 schema, suitable for cross-agent aggregation.
 
 | Column | Type | Unit | Visibility | Description |
 |:-------|:-----|:-----|:-----------|:------------|
-| schema_version | integer |  |  | Topology schema version. |
-| agent_id | string |  |  | Netdata Agent or vnode identifier that collected the data. |
-| collected_at | string |  |  | Collection timestamp in RFC 3339 format. |
-| devices | array |  |  | List of devices (local and discovered). |
-| links | array |  |  | List of discovered links (LLDP/CDP). |
-| stats | object |  |  | Summary stats (device/link counts). |
+| schema_version | string |  |  | Topology schema version. |
+| producer | object |  |  | Producer metadata identifying the SNMP L2 topology source, plugin, and local node when available. |
+| collected_at | datetime |  |  | Collection timestamp in RFC 3339 format. |
+| view | object |  |  | Topology view metadata, including selected mode and focus parameters when present. |
+| dictionaries | object |  |  | Compact-table dictionaries used by actors, links, evidence, and detail tables. |
+| types | object |  |  | Actor, link, evidence, table, and presentation type registry. |
+| presentation | object |  |  | Graph-level presentation metadata. |
+| actors | object |  |  | Compact actor table for managed devices, discovered devices, inferred endpoints, and network segments. |
+| links | object |  |  | Compact link table for LLDP, CDP, bridge, FDB, STP, ARP, SNMP, and inferred L2 relationships. |
+| evidence | object |  |  | Relationship evidence tables backing the rendered links. |
+| tables | object |  |  | Actor detail, port, path, and label tables used by topology modals. |
+| stats | object |  |  | Summary stats for collected observations, actors, links, and pruning/filtering decisions. |
 
 ### Licenses
 

diff --git a/docs/Collecting Metrics/Collectors/Networking/Windows Network Protocols.mdx b/docs/Collecting Metrics/Collectors/Networking/Windows Network Protocols.mdx
@@ -93,9 +93,46 @@ There are no alerts configured by default for this integration.
 
 ## Live Data
 
-This collector exposes a real-time function for viewing Windows TCP and UDP stack statistics.
+This collector exposes real-time functions for viewing Windows network connections and TCP/UDP stack statistics.
 
 
+### Network Connections
+
+Shows active network connections on Windows with protocol details, states, addresses,
+ports, and process information.
+
+Each row represents one TCP connection or UDP endpoint and includes the socket direction
+(listen/inbound/outbound), protocol (tcp4/tcp6/udp4/udp6), TCP state, owning process
+(PID and name), username, server port name, local and remote addresses and ports,
+address space classification (loopback/private/public/multicast/zero), and server port number.
+
+Data is collected using the Windows IP Helper API (GetExtendedTcpTable,
+GetExtendedUdpTable) with process and user resolution via standard Windows APIs.
+
+
+| Aspect | Description |
+|:-------|:------------|
+| Name | `Perflibnetworkprotocols:network-connections` |
+| Require Cloud | no |
+| Performance |  |
+| Security |  |
+| Availability |  |
+
+#### Prerequisites
+
+No additional configuration is required.
+
+#### Parameters
+
+This function has no parameters.
+
+#### Returns
+
+
+
+| Column | Type | Unit | Visibility | Description |
+|:-------|:-----|:-----|:-----------|:------------|
+
 ### Network Protocols
 
 Shows Windows TCP and UDP stack counters grouped by transport protocol (TCP/UDP)

diff --git a/docs/Dashboards and Charts/Tabs/Logs.mdx b/docs/Dashboards and Charts/Tabs/Logs.mdx
@@ -20,6 +20,12 @@ The Logs tab displays log entries from the following sources:
 - **otel-logs** — displays logs received via OpenTelemetry (OTLP) log ingestion. See the [OpenTelemetry Signal Viewer plugin](https://github.com/netdata/netdata/blob/master/src/crates/netdata-log-viewer/otel-signal-viewer-plugin/README.md) for setup and configuration.
 - **Windows Event Logs** — reads Windows event logs on Windows Nodes. See the [Windows Events Plugin Reference](/docs/logs/windows-event-logs/windows-events-plugin-reference) for supported event channels and configuration.
 
+:::note
+
+On Linux systems without systemd (such as Alpine Linux), the systemd-journal source is unavailable. You can still send logs to Netdata by using `systemd-cat-native --url` to forward to a remote `systemd-journal-remote`, or by using OTLP log ingestion. See [Working with Logs](https://github.com/netdata/netdata/blob/master/docs/category-overview-pages/working-with-logs.md) for details.
+
+:::
+
 You can also display custom application logs, such as web server access logs, under the systemd-journal source by piping them into `systemd` journald using [log2journal](/docs/logs/log2journal) and [systemd-cat-native](/docs/logs/systemd-cat-native). For example, use the built-in `nginx-combined` log2journal configuration to pipe nginx access logs.
 
 :::tip

diff --git a/docs/Netdata Agent/Versions & Platforms.mdx b/docs/Netdata Agent/Versions & Platforms.mdx
@@ -75,8 +75,8 @@ Our [static builds](#static-builds) are expected to work on these platforms if a
 
 | Platform                 | Version        | Official Native Packages      | Notes                                                                                                          |
 |--------------------------|----------------|-------------------------------|----------------------------------------------------------------------------------------------------------------|
-| Alpine Linux             | 3.23           | No                            | The latest release of Alpine Linux is guaranteed to remain at **Core** tier due to usage for our Docker images |
-| Alpine Linux             | 3.22           | No                            |                                                                                                                |
+| Alpine Linux             | 3.23           | No                            | The latest release of Alpine Linux is guaranteed to remain at **Core** tier due to usage for our Docker images. Alpine uses OpenRC and does not include systemd, so the systemd-journal plugin and local systemd integrations are unavailable. Logs can be forwarded to a remote `systemd-journal-remote` endpoint using `systemd-cat-native --url=URL`. |
+| Alpine Linux             | 3.22           | No                            | Alpine uses OpenRC and does not include systemd, so the systemd-journal plugin and local systemd integrations are unavailable. Logs can be forwarded to a remote `systemd-journal-remote` endpoint using `systemd-cat-native --url=URL`. |
 | Alma Linux               | 9.x            | x86\_64, AArch64              | Also includes support for Rocky Linux and other ABI compatible RHEL derivatives                                |
 | Alma Linux               | 8.x            | x86\_64, AArch64              | Also includes support for Rocky Linux and other ABI compatible RHEL derivatives                                |
 | Amazon Linux             | 2023           | x86\_64, AArch64              |                                                                                                                |
@@ -223,6 +223,14 @@ When you use static builds, you'll miss certain features that require specific o
 
 Many of our systemd integrations are not supported in our static builds. This is due to a general refusal by the systemd developers to support static linking (or any C runtime other than glibc), and is not something we can resolve.
 
+Beyond static builds, some operating systems (notably Alpine Linux) do not include systemd at all — they use OpenRC as their init system. This OS-level absence of systemd affects:
+
+- The **systemd-journal plugin** for log viewing, which requires a local `systemd-journald` installation.
+- **log2journal** output delivery — while log2journal itself is a standalone text processor with no systemd dependencies, its Journal Export Format output must be piped through `systemd-cat-native` to reach a journal. Without a local `systemd-journald`, use `systemd-cat-native --url=URL` to forward logs to a remote `systemd-journal-remote` endpoint instead.
+- Local systemd service management integrations.
+
+The `systemd-cat-native --url` mode is the supported workaround: it sends logs directly to a remote systemd-journal-remote and does not require any local systemd components.
+
 ### Impact of Platform End-of-Life (EOL)
 
 When a platform is removed from the Binary Distribution Packages list: