On-demand or scheduled
Trigger a run manually from the UI, or schedule recurring runs with a cron expression, using the built-in editor that shows a human-readable description and the next occurrence.
Diagnostics
In the menus of the application the module is named Diagnostic.
Automated health checks and infrastructure diagnostics for Proxmox VE, built on the cv4pve-diag library. Each issue is reported with a gravity (Info / Warning / Critical), a context (cluster, node, storage, qemu, lxc) and a sub-context that pinpoints what to look at.
Features
Section titled “Features”Issue Detection
Detects misconfigurations, hardware problems, end-of-life software, snapshot/backup hygiene and resource pressure across cluster, nodes, storage, QEMU VMs and LXC containers.
Per-context thresholds (CPU, Memory, Network, Health Score, PSI pressure) editable from the settings UI, with separate values for Node, Qemu and Lxc, and a usage threshold for Storage. Optional checks for S.M.A.R.T. disk attributes (temperature, SSD wearout), ZFS pool detail and LVM-thin metadata.
Snapshot & Backup Hygiene
Per-VM checks for snapshot count and age, backup recency (RPO violation) and stale backup files that waste storage. Each check can be turned off, and its thresholds can be changed.
CVE Tracking
Optional NVD lookup for Proxmox VE specific CVEs via CPE filter. Filter by minimum CVSS v3 score (default 7.0 = HIGH + CRITICAL only).
Hide known or accepted issues from the active result. They still appear in a dedicated section at the bottom of the report, so they stay traceable.
Parallel Scanning
The Max parallel requests setting (default 5) speeds up scans on large clusters; set to 1 to fall back to sequential mode. A failure on one resource is isolated to that item: the rest of the scan keeps running.
Export PDF / Excel
Download results as PDF (colored table with footer and page numbers) or Excel (autofilter-enabled sheet for slicing, pivoting and sharing). Format chosen from a split-button dropdown.
Help Links
Each issue can link to the relevant Proxmox documentation page (e.g. QEMU Guest Agent, VirtIO drivers, end-of-life OS tracking).
Executive SummaryEE
The Enterprise PDF adds an Executive Summary block at the top of the report, right after the cover page. The block shows the issue counts by gravity (Critical / Warning / Info) and the first 5 critical issues, in order of resource id. Useful for management or MSP customer reports.
Each diagnostic check carries its mapping to normative controls across 18 standards (ISO 27001, ISO 22301, NIS2, DORA, GDPR, PCI DSS, AgID, ACN, ENS, BSI C5, BSI IT-Grundschutz and more). The Enterprise PDF appends one section per standard. Each section is a new page that starts with a summary table (control, title, findings by gravity, status) and continues with the failing checks grouped by control. Excel exports get one extra sheet per standard, with the same data flattened for filtering and pivoting.
Notifier Integration
Attach the generated report to a notification using any of the configured Notifier channels: handy for nightly cron-based runs.
Why scan automatically when you can check things by hand?
A scan covers every node, storage, QEMU VM and LXC container of the cluster. You do not need to open the PVE UI of each node.
Every issue tagged for triage
Each issue has a gravity (Info / Warning / Critical), a context and a sub-context. Sort by gravity, filter by context, and fix the right things first.
Known false positives go to the Ignored Issues list. They still show in the report (audit trail) but no longer clutter the active scan.
Stored scan history plus PDF and Excel reports: give them to auditors or customers, with no need for screenshots of the UI. For a dated inventory of the whole cluster see System Report.
Sections
Section titled “Sections”- Overview: introduction to the module and its dashboard widgets
- Scans: the history of scans. Expand a row to see the scan detail: an Issues tab with the detail of each issue, and a Compliance tab EE with the findings grouped by standard and control. From this page you also download the report as PDF or Excel and start a new on-demand scan. Both reports open with a cover page: report information and a table of contents. In the PDF the table of contents has page numbers, is clickable and is listed in the bookmarks panel of the viewer
- Ignored Issues: the issues hidden from the active results (they are still shown in the report’s Ignored section). See Ignored issues
The grid lists the stored scans with the number of Info, Warning and Critical issues, start, end and duration. Ignored issues are not counted.
| Action | What it does |
|---|---|
| Scan | Starts a scan immediately in the background. Progress and log are in the global Task Tracker |
| Download | Split button: downloads the report of the selected scan as PDF or Excel. Disabled until a scan is selected |
| Delete | After confirmation, deletes the selected scan |
| Refresh | Reloads the grid |
Expanding a scan shows two tabs: Issues and Compliance EE. The Issues tab lists gravity, code, resource id (a link that opens the resource in a new tab), context, sub-context and description of each issue. The Ignore Issue button on an issue row adds it to the ignored issues.
Two things happen at the end of every scan, scheduled or started by hand. The oldest scans beyond the Number to keep setting are deleted, and the notification is sent (see Settings).
Ignored issues
Section titled “Ignored issues”An ignored issue is a rule with Id Resource, Error Code, Gravity, Context, Sub Context and Description. Gravity and Context are optional: left empty, they show Any. A rule needs at least one of Id Resource, Error Code, Sub Context and Description: otherwise saving shows a warning and the rule is not saved. It is created with the Ignore Issue button of a scan, which copies the values of that issue. On the Ignored Issues page click the Id Resource of a row to edit the rule, or select rows and use Delete to remove them.
The rules are applied when a scan runs: an issue is marked as ignored when it matches every field of the rule. Id Resource, Error Code and Sub Context must be equal to the value of the issue, Description must be contained in the description of the issue, and an empty field matches any value. Changing the list does not change the scans already stored.
Compliance reportsEE
Section titled “Compliance reports”Each check in the cv4pve-diag library declares which normative controls it covers, and the Enterprise PDF and Excel reports add one section per standard. The standards covered, the layout of those sections and the limits of the mapping are in Compliance Reports.
Settings
Section titled “Settings”The settings of the module (9 groups, from the general options to the thresholds and the snapshot, backup and CVE checks) are in Settings.
Widgets
Section titled “Widgets”| Widget | Content |
|---|---|
| Status | Diagnostic status, with the date of the last scan |
| Check | Critical issues of the last scan of each cluster, grouped by resource, with a link to the scan |
Check covers the clusters where Enable scheduling is on, and those where a scan was started by hand. It shows “Module not configured!” only when no cluster has the schedule on and no scan was ever made.
Permissions
Section titled “Permissions”Assign these to a role under Security.
| Permission | Allows |
|---|---|
| Diagnostic | Open the module and its Overview page |
| Scans, Ignored Issues | Open the page with that name (one permission per page) |
| Status, Check | Use the dashboard widget with that name (one permission per widget) |
| Scan: Scan | Use the Scan button |
| Scan: Export | Download the report of a scan |
| Scan: Delete | Delete a scan |
| IgnoredIssue: Create / Edit / Delete | Ignore Issue on a result (Create); change and delete the rules of the Ignored Issues page (Edit, Delete) |
| Edit Settings | Change the module settings |
The built-in role of the module includes all of them. A custom role has to be given them explicitly: without the permission the button is hidden.
The module also follows the cluster permissions (VM: Read, Node: Read and Storage: Read, see Security):
- The details of a scan list only the findings of the nodes, guests and storages the user can read. The findings about the cluster itself (users, cluster settings) need Read on every VM, node and storage of the cluster. The same holds for the compliance view EE.
- The counts of the Scans grid, the report download, Scan, deleting a scan, Ignore Issue and the Ignored Issues page need Read on the whole cluster: an ignored issue hides the finding to every user.
- The widgets and the Overview count all the findings of a cluster: they are shown only on the clusters where the user can read every VM, node and storage.
Proxmox VE privileges: the base (PVEAuditor) plus the following.
| Privilege | Used for | Without it |
|---|---|---|
Sys.Modify | List of the updates available on each node, in every profile | The checks on the updates fail |
VM.Backup, Datastore.AllocateSpace | Backup checks, Standard and Full profiles | The backup checks are skipped |
These are more than read-only privileges: Proxmox VE asks for them also to read these data.
The base and the rules common to all modules are in Proxmox VE Permissions.
