When the license changes
A license is a set of features and limits. Whenever it changes, the server works out why, and acts on the answer:
- The license server cannot be reached. Nothing is switched off. Everything keeps running on the last check-in, and only changes that need a feature beyond the Community edition wait - for the license's offline days, 14 unless the license says otherwise. After that the server runs unregistered until a check-in gets through.
- The license cannot be read or verified. A fault, not a downgrade: nothing is switched off. Everything keeps running on the last license the server could verify, with exactly what the license server last confirmed for it, for 14 days - or until the license's offline days since its last check-in run out, if that comes first - while a critical alert and the banner ask you to install a newly issued license.
- The license carries less. A lower edition was installed, or a check-in brought a license with fewer features or lower limits. Every feature it no longer carries is switched off, and whatever runs above a lower limit is stopped or disabled.
- No license applies any more. The subscription ended, the license server refused the license (for example because it was moved to another server), the license server was not reached for longer than the offline days, the license was removed, the trial ended, a fault lasted longer than its 14 days, or the server never held a valid license to run on. The server runs unregistered, and everything an unregistered server does not carry is switched off.
Whatever is switched off keeps its settings, and comes back by itself when a license carries it again. Two things do not come back by themselves, because they moved or removed something: databases moved back from an external PostgreSQL server, and Enterprise add-ons. You re-do those, and the console says so.
When a subscription's term ends, the server does not step down to the Community edition: it runs unregistered. Backups, mail, Fail2Ban blocking, firewall rules and every other licensed feature are switched off, and every instance but one is stopped. Renew before the end date; the license expiry warning and the banner over every page say when it is.
The five situations
| In the diagram | What the License page says | What is switched off |
|---|---|---|
| Licensed | The edition, with no Situation row | Nothing |
| Unreachable | Situation: License server unreachable. Licensed: Running on the last check-in | Nothing |
| Fault | Situation: License cannot be read or verified. Licensed: Running on the last valid license | Nothing |
| Downgraded | The lower edition, licensed | What the license no longer carries, and the excess above its lower limits |
| Unregistered | Situation: No check-in for too long, Subscription ended, Refused by the license server, License removed, Never confirmed by the license server, Trial ended, No license installed or License refused. Licensed: No - running unregistered | Everything an unregistered server does not carry, and every instance but one |
Downgraded is not a state of its own on the License page: it is a license that grants less than the one before it. A server installed without a license starts out unregistered, and so does one that never held a valid license when a license it cannot read is put on it.
What happens on a change
Detected. Every way the license can be read raises the change: installing or activating a license, removing one, the scheduled check-in, the hourly re-check, and the moment the server's hardware identity becomes known after a start. The first reading after a start is the baseline: nothing is switched off and nothing is alerted before it.
Classified. The server tells an unreachable license server and a license it cannot read apart from a license that carries less. The first two keep everything running; every other loss switches off what is no longer carried.
Acted on. Each feature is switched off by its own job, the same job you would run to switch it off yourself, queued by the license with the reason in its description. The license acts within a minute of a change, again every hour, and a minute after the server starts, so a change that happened while it was down is not missed. A switch-off that fails is tried again after thirty minutes.
Told. An alert, a banner on every page, a list on the License page, a notice on each panel that lost something, and a row in the audit trail per switch-off. See What you see.
Restored. When a license carries the feature again, exactly what was switched off is switched back on, each by its own job, and the job history and the audit trail record the return.
When the license server cannot be reached
A subscription that cannot check in keeps working on its last signed receipt, and the banner says Operating on receipt grace with the day the receipt runs out. When it runs out without a check-in getting through, the License page's Situation reads License server unreachable.
This applies to a running subscription whose license server was not reached, and only for the license's offline days: 14 unless the license says otherwise, counted from the last check-in that got through. A license server that answered and refused the license is a decision, not an outage: the server runs unregistered. A trial whose check-in window runs out is not an outage either: it is a fault, which runs on the last valid license for 14 days and then unregistered.
What keeps working
Everything the last check-in carried. Nothing is switched off: scheduled backups and their off-site copies, alert delivery, analytics, certificate renewals, Fail2Ban blocking, CrowdSec, firewall rules and every other licensed feature carry on as before.
What is refused
A change you make that needs a feature beyond the Community edition: switching a licensed feature on, adding an off-site target, writing a firewall rule. It is refused with a message that names the cause rather than the edition:
Saving web and API access rules and rate limits cannot be changed while this server cannot reach the license server. This server has not reached the license server since 2026-10-05 08:00 UTC. Everything keeps running on its last check-in until 2026-10-19 08:00 UTC, and changes that need a feature beyond the Community edition wait until a check-in succeeds; after that this server runs unregistered. Check that it can reach the license server.
The first words name what was refused, so they differ from one change to the next. A feature the last check-in never carried is refused the ordinary way, naming the edition that carries it.
What stays possible
- Work the Community edition carries: a backup by hand, a database restore, starting an instance within the limit.
- Every switch-off and every reduction: switching a feature off, removing a target, loosening or removing a firewall rule, deleting a credential.
How it ends
By itself, with the first check-in that gets through: the daily one, or Check in now on the banner or on the License page's License check-in card. Installing a license that reaches the license server ends it too. A License changed alert at Warning marks the start, and the banner names the day the offline days run out.
When the offline days run out
The outage lasts at most the license's offline days after the last check-in that got through. The license server signs that day into every receipt; a receipt from a license server that does not state it counts 14 days. Winding the server's clock back does not stretch it.
When they run out without a check-in getting through, the Situation reads No check-in for too long, and the License page and the banner say how long and since when:
No check-in for 16 days: the license server was not reached since 2026-10-05 08:00 UTC, longer than the 14 days this license may run without it. This server runs unregistered and what the license carries is switched off until a check-in succeeds; check that it can reach the license server.
The server then runs unregistered, as in When the license carries less: what the license carries is switched off, the GeoIP and Fail2Ban sponsorships included, and a License changed alert at Critical says so. The first check-in that gets through - Check in now is on the banner - makes it licensed again, and what was switched off comes back by itself.
This is also what stops a server whose license was moved to another server while it was off the network: it never hears of the move, and stops when its offline days run out. A server that is online when its license is moved stops at its next check-in, refused by the license server.
If the subscription's term ends while the license server is still out of reach, the subscription has ended: the server runs unregistered, as in When the license carries less.
When the license cannot be read or verified
A license the server can no longer read is not a decision anybody made about the server. It happens when an update brings a build that does not read the file's format any more, when a file is corrupt or signed with a key the build does not know, when the license no longer fits this machine, this build or the server's clock, when the check-in window of a trial runs out, or when the server cannot establish what its license carries for any other reason. On a server that held a valid license, all of these are a fault, not a downgrade.
A verified loss is not a fault: an ended term, a refusal by the license server, a removal, offline days that ran out or an activation window that ran out act at once, as this page describes.
A fault is bridged on the last valid license only while all of these hold:
- the license file is still on the server;
- the license server's last receipt for that license is there and verifies;
- the record of the last valid license was written on this server, not copied from another one.
Otherwise the server runs unregistered at once, as a server that never held a license. A server whose license file was deleted, or whose license has not checked in with the license server yet, is therefore not kept running during a fault: install the license again on the License page.
What keeps working
Everything the last valid license carried. The server remembers what the last license it could read and verify granted, and keeps running on exactly that: Odoo Enterprise, backups and their off-site copies, mail, alert delivery, firewall rules, the accounts and every instance. Nothing is switched off and nothing is stopped.
What is refused
Only a new change that needs a feature the last valid license did not carry, refused the ordinary way, naming the edition that carries it. Everything the last valid license carried can still be changed, and every switch-off and reduction stays possible.
What you see
- A License changed alert at Critical, titled The license cannot be read or verified, naming the cause the server found, the day the fault ends, and what to do. It is raised when the fault begins, also when the server starts into one after an update.
- A banner on every page: The license cannot be read or verified, since when, that nothing is switched off, and until when everything keeps running.
- On the License page, Situation: License cannot be read or verified, Licensed: Running on the last valid license, and the cause in full.
ohm license statusprints when the fault began and when it ends.
How it ends
Install a newly issued license on the License page. Once the server can read and verify a license again it is licensed; nothing was switched off, so nothing has to come back.
A fault lasts 14 days from the moment it began, whatever the license's offline days are, and a restart does not move that date. If the server still has no license it can read and verify by then, the fault counts as the license's expiry: the server runs unregistered and what the license carried is switched off, as in the next section.
A server that never held a valid license has nothing to keep: a license it cannot read leaves it unregistered at once.
When the license carries less
Every capability the license no longer carries is handled as below. The names, the groups and the editions are the console's own, from its feature catalogue; Carried by lists every edition that has the capability, Unregistered included where it does.
| Capability | Switched off | Kept | Comes back |
|---|---|---|---|
| Odoo hosting | |||
| Odoo Enterprise readyCarried by Community, Developer, Professional, Provider | Moved and removed. Every instance on Odoo Enterprise is switched to the Community edition, and its Enterprise add-ons are removed.Once a license carries Odoo Enterprise again, switch the edition back to Enterprise on the instance's Configuration tab and save; the apply installs the Enterprise add-ons again. The notice on the instance goes by itself once the instance runs Enterprise again. | The instance and its databases. A database with Enterprise modules installed loses those modules' code until they are back. | You re-do it |
| Automatic updates from gitCarried by Professional, Provider | Stopped. Automatic updates from git stop: a new commit no longer queues an update. | Every instance's and module's automatic update setting. | By itself |
| Zero-downtime deploymentsCarried by Professional, Provider | Nothing to switch off. Nothing runs between deployments, so nothing is switched off. A new zero-downtime deployment is refused. | - | Nothing to bring back |
| Backups | |||
| Backups on the serverCarried by Community, Developer, Professional, Provider | Disabled. Every instance whose backups are switched on is set to Disabled, so no backup runs, by hand or on a schedule. | The targets, the schedule and the backup mode, which is put back. Backups and dumps already on the server stay listable and downloadable. | By itself |
| Complete instance backupsCarried by Community, Developer, Professional, Provider | Nothing to switch off. Nothing runs, so nothing is switched off. A new complete instance backup is refused. | Every archive already written. | Nothing to bring back |
| Scheduled backups and staging refreshesCarried by Professional, Provider | Disabled. Every enabled backup and restore schedule, server-wide and per instance, is disabled. | Each schedule's times and label. | By itself |
| Off-site backups to FTPCarried by Community, Professional, Provider | Disabled. Every FTP backup target and restore source that is switched on is switched off.Archives already on the FTP server cannot be listed, downloaded or restored from here until a license carries FTP again.A backup that reaches the target before it is switched off skips it and records a failed result for that target. A backup whose every target was refused fails rather than reporting success. | The address, the credentials and the retention. | By itself |
| Off-site backups to Amazon S3Carried by Professional, Provider | Disabled. Every S3 backup target and restore source that is switched on is switched off.Archives already in the bucket cannot be listed, downloaded or restored from here until a license carries S3 again. Your own S3 client still reaches them.A backup that reaches the target before it is switched off skips it and records a failed result for that target. A backup whose every target was refused fails rather than reporting success. | The endpoint, bucket, prefix, keys and retention. | By itself |
| Off-site backups to AzureCarried by Professional, Provider | Disabled. Every Azure backup target and restore source that is switched on is switched off.Archives already in the container cannot be listed, downloaded or restored from here until a license carries Azure again.A backup that reaches the target before it is switched off skips it and records a failed result for that target. A backup whose every target was refused fails rather than reporting success. | The storage account, container, key and retention. | By itself |
| Managed backup storage on AzureCarried by Professional, Provider | Refused. Adding an Azure backup storage account, making a container and binding one to an instance are refused.Containers already bound keep their targets; those are governed by the Azure and S3 backup features, each with its own notes.Nothing at any provider is touched; the rows, the retentions and the credentials stay, and the nightly measurement goes on, because a retired bucket that is still billed must stay visible. | The accounts, the containers, their bindings and the minted tokens. | By itself |
| Managed backup storage on HetznerCarried by Professional, Provider | Refused. Adding a Hetzner Object Storage account, making a bucket and binding one to an instance are refused.Containers already bound keep their targets; those are governed by the Azure and S3 backup features, each with its own notes.Nothing at any provider is touched; the rows, the retentions and the credentials stay, and the nightly measurement goes on, because a retired bucket that is still billed must stay visible. | The accounts, the buckets, their bindings and the keys. | By itself |
| Managed backup storage on Backblaze B2Carried by Professional, Provider | Refused. Adding a Backblaze B2 account, making a bucket and binding one to an instance are refused.Containers already bound keep their targets; those are governed by the Azure and S3 backup features, each with its own notes.Nothing at any provider is touched; the rows, the retentions and the credentials stay, and the nightly measurement goes on, because a retired bucket that is still billed must stay visible. | The accounts, the buckets, their bindings and the minted keys. | By itself |
| Managed backup storage on S3-compatible storesCarried by Professional, Provider | Refused. Adding an S3-compatible backup storage account, making a bucket and binding one to an instance are refused.Containers already bound keep their targets; those are governed by the Azure and S3 backup features, each with its own notes.Nothing at any provider is touched; the rows, the retentions and the credentials stay, and the nightly measurement goes on, because a retired bucket that is still billed must stay visible. | The accounts, the buckets, their bindings and the keys. | By itself |
| Managed backup storage on Cloudflare R2Carried by Professional, Provider | Refused. Adding a Cloudflare R2 account, making a bucket and binding one to an instance are refused.Containers already bound keep their targets; those are governed by the Azure and S3 backup features, each with its own notes.Nothing at any provider is touched; the rows, the retentions and the credentials stay, and the nightly measurement goes on, because a retired bucket that is still billed must stay visible. | The accounts, the buckets, their bindings and the minted tokens. | By itself |
| Encrypted backupsCarried by Professional, Provider | Refused. Creating a backup key and switching backup encryption on are refused, and an instance that encrypts writes each new backup unencrypted, with a warning in the backup's result.Opening an encrypted backup is never refused: restoring, importing, moving, a decrypted download, importing a key and ohm backup decrypt work on every edition.Backups encrypt again from the first backup after the license carries the feature; the unencrypted ones written meanwhile stay as they are. | The keys, each instance's switch and instance key, and every archive already encrypted. | By itself |
| Restore, cloning and staging | |||
| Restore a databaseCarried by Community, Developer, Professional, Provider | Nothing to switch off. Nothing runs, so nothing is switched off. A new database restore is refused. | Every backup on the server. | Nothing to bring back |
| Clone, move and restore whole instancesCarried by Developer, Professional, Provider | Disabled. Every instance whose restore mode is switched on is set to Disabled. Cloning, moving and restoring a whole instance are refused from then on. | The restore sources, the schedule and the restore mode, which is put back. | By itself |
| Import and export PostgreSQL dumpsCarried by Developer, Professional, Provider | Nothing to switch off. Nothing runs, so nothing is switched off. Loading or exporting a PostgreSQL dump is refused. | Dumps already on the server stay listable and downloadable. | Nothing to bring back |
| Upgrade Enterprise databasesCarried by Professional, Provider | Nothing to switch off. Nothing runs on this feature, so nothing is switched off. Preparing, rehearsing, re-running the modules and upgrading production for an Enterprise instance are refused, when queued and again when the job starts. | The plan, its rehearsal history and the prepared instance, which stays an ordinary instance. What was upgraded stays upgraded. | Nothing to bring back |
| Upgrade Community databasesCarried by Professional, Provider | Nothing to switch off. Nothing runs on this feature, so nothing is switched off. Preparing, rehearsing, re-running the modules and upgrading production for a Community instance are refused, when queued and again when the job starts. | The plan, its rehearsal history and the prepared instance, which stays an ordinary instance. What was upgraded stays upgraded. | Nothing to bring back |
| Security and intrusion prevention | |||
| Automatic attack blocking (Fail2Ban)Carried by Community, Professional, Provider | Withdrawn. This server's sponsorship of the Fail2Ban service is withdrawn. The service then lifts every ban it holds and goes on detecting, writing each ban it would make to its log as WOULD BAN.Bans lifted while the sponsorship was withdrawn are not put back; the jails ban again from the moment it returns. | The jails, the thresholds and the notification settings. | By itself |
| Block an address by handCarried by Community, Professional, Provider | Nothing to switch off. Nothing is switched off: a ban made by hand ends with its jail's ban time, or when the Fail2Ban sponsorship is withdrawn. A new ban by hand is refused; lifting a ban never is. | - | Nothing to bring back |
| Access rules by address, country and pathCarried by Professional, Provider | Reset. Every instance's firewall is put back on the product's baseline, Odoo open to everyone and the database manager closed, and the server firewall on its own: the Web console open, the management API closed to everything outside this server's network.An instance restricted to an office opens to everyone, and an address admitted to the management API, a console that manages this server as an environment included, is no longer admitted until the rules come back. | The rules you wrote, which are put back. Rate limits are left as they are. | By itself |
| IP location data (GeoIP)Carried by Professional, Provider | Withdrawn. This server's sponsorship of the GeoIP service is withdrawn. The service then answers every lookup with a placeholder that places no address, and stops refreshing its databases. | The MaxMind account and the databases on disk. | By itself |
| Community threat intelligence (CrowdSec)Carried by Provider | Removed. CrowdSec is switched off and removed: the engine and the bouncer go. | The settings, the enrolment key and the data volumes. | By itself |
| Pre-authentication sign-in pageCarried by Professional, Provider | Switched off. Pre-authentication is switched off on every instance that has it on, and each site is applied without it. | The credentials, the session length and the exemptions. | By itself |
| HTTPS certificates | |||
| Let's Encrypt for servers behind a firewallCarried by Professional, Provider | Self-signed. Every instance on a Let's Encrypt certificate obtained by DNS-01 is put on a self-signed certificate. | The DNS provider and its credential. | By itself |
| Bring your own certificateCarried by Professional, Provider | Self-signed. Every instance serving an uploaded certificate is put on a self-signed one. | The uploaded certificate and its key. | By itself |
| Monitoring and alerts | |||
| Performance and uptime historyCarried by Professional, Provider | Not readable. The performance and uptime history can no longer be read. | The samples. | By itself |
| Resource usage (CPU, memory and storage)Carried by Professional, Provider | Stopped. The hourly disk measurement no longer runs, and Resources > Usage and Resources > Storage are not shown. | The schedule. | By itself |
| Alerts to email, Slack, Discord and webhooksCarried by Professional, Provider | Stopped. Delivery to e-mail, Slack, Discord and webhooks stops. Events are still recorded and the console's bell still shows them; each delivery is written to the delivery log as skipped, with the reason, rather than failing silently or pretending it was sent.Adding or changing a channel is refused, but an existing channel can still be turned off - an unlicensed server must be able to stop trying. | The channels and the rules. | By itself |
| Email notifications | |||
| Outgoing mailCarried by Community, Professional, Provider | Switched off. Outgoing mail is switched off: the SMTP profile is turned off and the relay removed, so no notification mail leaves the server. | The SMTP profile: host, account, password and recipients. | By itself |
| Backup and restore reportsCarried by Professional, Provider | Stopped. Backup and restore reports by e-mail are no longer sent; the backup's result says why. | Each instance's report settings. | By itself |
| Security noticesCarried by Professional, Provider | Skipped. Security notices by e-mail are skipped silently, and the sign-in goes ahead. They are sent on the sign-in path, where refusing would lock people out. | - | By itself |
| Attack blocking noticesCarried by Professional, Provider | Withdrawn. This server's recipients are taken off the Fail2Ban service's ban notices. | The recipients on this server and the relay. | By itself |
| Database performance and analytics | |||
| Connection pooling (PgBouncer)Carried by Professional, Provider | Removed. Connection pooling is switched off: every instance routed through the pooler is pointed at PostgreSQL directly, then the pooler is removed. | Each instance's own routing choice and the pooler's settings. | By itself |
| Slow query insightsCarried by Developer, Professional, Provider | Stopped. Slow query sampling stops; the samples already taken age out as usual. | The settings. | By itself |
| Standby database (read replica)Carried by Professional, Provider | Removed. The standby database is removed and its replication slot dropped, so the primary stops holding changes for it. | The standby's data directory and its settings. | By itself, from a fresh base backup |
| PostgreSQL version upgradesCarried by Professional, Provider | Nothing to switch off. Nothing runs, so nothing is switched off. A PostgreSQL major version upgrade is refused. | - | Nothing to bring back |
| Bring your own PostgreSQLCarried by Provider | Moved. Every instance on an external PostgreSQL server has its active database moved back to the bundled PostgreSQL: dumped, restored, checked and re-pointed.Once a license carries it again, move the database back to its profile yourself. The copy the move left on the external server has to be dropped there first. The notice on the instance goes by itself once the database is on its profile again. | The copy on the external server, and the PostgreSQL profile. | You re-do it |
| Business analytics (Metabase)Carried by Professional, Provider | Stopped. The analytics service is held: stopped rather than removed.Removing analytics, and the sync that keeps its access in step with this console, stay available: an unlicensed server must be able to take it off and to stop granting access it can no longer manage. | The questions, dashboards and collections in it. | By itself |
| Developer tools | |||
| Developer workspaceCarried by Developer, Professional, Provider | Switched off and converted. The SSH gateway is switched off, the code editor on a live instance is switched off, and every development instance is converted back.A conversion is refused, and tried again later, while a module holds work that has not been pushed: nothing unpushed is thrown away.Editor sessions do not survive the conversion. | The gateway's host key and port, and each module's git history. | By itself |
| VS Code in the browserCarried by Developer, Professional, Provider | Stopped. Every open browser editor is stopped.Nothing reopens an editor by itself: it is a person's window, and they open it again where they left off. | Each editor's session, settings and open files. | Reopened by its user |
| Live debuggingCarried by Developer, Professional, Provider | Closed. The published debugger ports of every development instance are closed. | The debug mode and the port numbers. | By itself |
| Team editor profilesCarried by Developer, Professional, Provider | Not applied. Nothing is switched off: an editor opens with the default settings instead of its profile's. The profile still decides who may open one. | The profiles. | By itself |
| Team access and accountability | |||
| Roles and permissionsCarried by Professional, Provider | Disabled. Every console account holding a role other than Administrator is disabled. Administrators are untouched. | Each account's role, instances and password. | By itself |
| Multi-server and cloud provisioning | |||
| Manage many servers from one consoleCarried by Professional, Provider | Disabled. Every registered environment is disabled: the console no longer connects to it or manages it. | The registration, its key and its pin. | By itself |
| Server administration | |||
| Command line in the browserCarried by Developer, Professional, Provider | Nothing to switch off. Nothing is switched off: an open command line in the browser ends by itself within eight hours, and a new one is refused. | - | Nothing to bring back |
| Support and integrations | |||
| AI diagnosticsCarried by Professional, Provider | Nothing to switch off. Nothing runs on this feature, so nothing is switched off. A new Diagnose is refused, when it is asked for and again when its job starts, and the button is greyed. | The AI assistant settings, the server's and every account's own keys for every provider, and every diagnosis already made, which stays readable with what was sent and can still be deleted. | Nothing to bring back |
A server that moves to the Developer edition also puts every instance on a Let's Encrypt certificate on a self-signed one, because Developer does not obtain publicly trusted certificates. The Let's Encrypt settings are kept, and the certificate comes back by itself when the edition allows it again. Where several things hold one switch - an instance's certificate held self-signed by two features, an account disabled both by the roles feature and by the account limit - it comes back only when nothing holds it any more.
Backups and dumps stored on the server stay listable and downloadable in every situation, the unregistered state included. Archives on an off-site target, and the performance and uptime history, are suspended with their feature and cannot be read here until a license carries it again.
Switching off is always free. Every switch-off and reduction is allowed in the console and through the API whatever the license: a panel whose feature the license does not carry still lets you turn it off, never on.
An upgrade to a newer Odoo version
Both features come with Professional and Provider only, so a move to Community or Developer, or a server that runs unregistered, loses them. When a license stops carrying Upgrade Enterprise databases or Upgrade Community databases, nothing is switched off, because nothing runs on either feature. A plan stays, with its rehearsal history, and so does its prepared instance, which is an ordinary instance under the limits below. What was upgraded stays upgraded.
Runs are refused. Preparing, rehearsing, re-running the modules, taking on a prepared instance for a production on another server and upgrading production are refused for the instance's engine, and the Upgrade tab opens on the reason: Prepare upgrade, Rehearse, Re-run my modules and Use as prepared instance are off, and the Upgrade production card shows the sentence instead of its button. The license is asked when a job is queued and again when it starts, so a job waiting in the queue is refused too. No switch-off job touches a run that has already started.
A rollback is not refused for these two features. It needs Restore a database, and after an upgrade in place Clone, move and restore whole instances too, so a license without those refuses it for them.
A lower license can also lower the size of a Community database it upgrades: a run on a larger one is refused and names the size. When a license carries the feature again, the plan carries on where it stood. See Upgrading an instance to a newer Odoo version.
The limits
A lower license can also lower a limit. What runs above it is suspended at once, never deleted:
| Limit | Above a lower limit | Comes back |
|---|---|---|
| InstancesUnregistered 1, Community 2, Developer Unlimited, Professional 5, Provider Unlimited | The instances above the limit are stopped. Production keeps running first, then Staging, then Development, then an instance with no role; within each, the oldest. A stopped instance stays stopped across a reboot. | Started again by itself, in the same order |
| Console accountsUnregistered 1, Community 1, Developer 1, Professional Unlimited, Provider Unlimited | The accounts above the limit are disabled, the newest first. The account created at setup is always kept, then one Administrator, then the oldest. | Enabled again by itself, the oldest first |
| Databases per instanceUnregistered 1, Community 1, Developer Unlimited, Professional Unlimited, Provider Unlimited | Each instance keeps its active database. The others above the limit are kept but not served, and activating one is refused. Nothing is dropped. | By itself |
| Host names per instanceUnregistered 1, Community 1, Developer Unlimited, Professional Unlimited, Provider Unlimited | Each instance keeps its first web address; the others are no longer served. | Served again by itself |
| Custom modules per instanceUnregistered 0, Community 1, Developer Unlimited, Professional Unlimited, Provider Unlimited | Counted as installed in each database, however a module arrived. The git modules above the limit are frozen: not pulled and not updated, by hand or automatically. Once a database holds more than the limit, every git module of the instance is frozen. Nothing is unloaded or uninstalled. | Thawed by itself |
| EnvironmentsUnregistered 1, Community 1, Developer 1, Professional 3, Provider Unlimited | The registered environments above the limit are disabled, the newest first. | Managed again by itself, the oldest first |
The limits are read from the license the server holds. The Editions tables show what each edition's offer carries, and a license can carry its own value for any of them, which then applies. A license that states no limit for databases, custom modules or host names per instance, or for concurrent jobs, gets the unregistered value. A check-in that brings a lower value for one limit alone is a change like any other, acted on within a minute.
Going over a limit never switches backups off, never uninstalls a module and never drops a database: it stops, disables, stops serving or freezes, as the table says.
Which instances keep running
When more instances run than the license allows, the ones that keep running are chosen in this order:
- Production instances, then Staging, then Development, then an instance with no role.
- Within each role, the oldest first: the order the instances were created in.
The others are stopped, each with its own stop job. A stopped instance stays stopped when the server reboots. An instance you stopped yourself takes no place in the count, and the license never starts it.
While the server is at its limit, starting another instance is refused. Restarting an instance that already runs never is, and an operation that stops and starts an instance on its own - moving a database, a restore, a reinstall - always finishes. When a license allows more, the stopped instances are started again by themselves, in the same order.
Accounts, databases, web addresses, environments and modules
- Console accounts above the limit are disabled, the newest first. The account created at setup is always kept, then one Administrator, then the oldest. An account you disabled yourself takes no place and is never enabled by the license.
- Databases above the limit stay where they are. Each instance keeps serving its active database, the others are listed as kept and not served, and activating one is refused until the limit allows it. Nothing is dropped.
- Web addresses above the limit are no longer served; each instance keeps its first one.
- Environments above the limit are disabled, the newest first: the console stops connecting to them, and their registration and key are kept.
- Custom modules are counted as installed in each database, every module that does not ship with Odoo however it arrived, and the instance counts its fullest database. While only the instance's git modules go beyond the limit, the first ones in its module list keep their place and the rest are frozen. Once a database holds more installed custom modules than the limit, every git module of the instance is frozen until it is back under. A frozen module is not pulled or updated, by hand or by automatic updates from git, and stays loaded in the instance: nothing is uninstalled. A module added by hand or through Odoo's Import module counts, but only git modules can be frozen, so an instance whose excess came that way is reported over the limit with nothing to freeze. When the databases cannot be read, the git modules alone are counted.
Each comes back by itself when a license allows it.
What you see and what you do
The alert
Every license change raises a License changed alert:
| Severity | When | What it says |
|---|---|---|
| Critical | Features or limits were lost, or the server became unregistered | Which features the license no longer carries, that they are switched off, and that lower limits suspend the excess |
| Critical | The license cannot be read or verified | The cause, that nothing is switched off, until when everything keeps running, and to install a newly issued license |
| Warning | The license server cannot be reached | That everything keeps running and licensed changes wait for a check-in |
| Critical | The license server was not reached for longer than the offline days | How many days, since when, and that what the license carries is switched off until a check-in succeeds |
| Info | Features came back | Which features the license carries again, and that they come back by themselves |
Sending alerts to e-mail, Slack, Discord or a webhook is itself a licensed feature. A license that no longer carries it, an unregistered server above all, still raises the alert, but only the console's bell shows it. The banner below is there for exactly that case.
The banner
While anything is switched off, every page carries a banner: The license switched off so many item(s) it no longer carries - they come back by themselves when a license carries them again, and the License page lists them. While the license server cannot be reached, a second banner says so, with the day the offline days run out and a Check in now button; once they have run out, the banner says The license server was not reached for too long, with the same button. While the license cannot be read or verified, a banner says so, with the day the fault ends.
The License page
The License tab opens with a card, Switched off by the license, listing every feature, instance, account and other item the license holds off:
| Column | What it shows |
|---|---|
| What | The item: an instance's firewall rules, a backup target, an account, an instance |
| Feature or limit | The feature the license no longer carries, or the limit that is lower |
| Since | When it was switched off |
| Why | The reason, in one sentence |
| State | Switched off; comes back by itself, Switched off; yours to re-do when it is back, Coming back, or Back on the license; yours to re-do |
Note, Situation and Switch-off job are further columns behind the column picker. The Active license card below shows the Situation whenever the server is not simply licensed.
On each panel
A panel that lost something says so where its switch is: the item, switched off by the license on its date, and the reason. While it comes back it reads coming back; once the license carries something you re-do, it reads back on the license, yours to re-do, with what to do.
What the edition does not include
Nothing your edition does not include is hidden. A control the license switches off stays where it is, greyed, with a badge naming the edition that has it, and its tooltip says Not in this server's license, which feature is missing and which edition has it. On a server whose license does not carry the development tools, for example:
- an instance's Code tab is still there, greyed, and opens on a notice naming the edition rather than on the editor; the console search still finds it, marked not in this server's license;
- the Development section of the menu stays, greyed, and its pages open on the same notice;
- the Git tab of My account shows each half the edition leaves out (the commit identity, git credentials and SSH keys, or the GitHub account) as its heading, the badge and the notice;
- the Code editor and Publish for your own machine settings on the Configuration tab are greyed switches.
The same holds for the Update and upgrade buttons and Auto update switches on an instance's Modules tab, CrowdSec's Reinstall, the SSH gateway's port and Save, a backup storage provider in Add a backup storage account (listed, marked and not choosable), an uploaded certificate, and Restore from a dump, whose form is disabled before anything is uploaded.
When the server itself refuses something for the license, the message reads Not in this server's license: followed by the reason, with a link to compare the editions on the License page.
Jobs and the audit trail
Every switch-off and every return is a job on the Jobs page, with the license named as the reason in its description. Security > Audit records the license change itself and one row per item switched off and per item restored, under the License category.
From the command line
pelmo$ ohm license statusohm license status prints the situation, the edition, the day an outage's offline days or a fault
run out and how many items the license has switched off; ohm license suspensions lists them with when and why.
Bringing back what does not return by itself
Once a license carries the feature again, the item reads Back on the license; yours to re-do:
- Odoo Enterprise. Switch the edition back to Enterprise on the instance's Configuration tab and save; the apply installs the Enterprise add-ons again. Until then, a database with Enterprise modules installed is missing those modules' code.
- External PostgreSQL. Move the database back to its PostgreSQL profile. The copy the earlier move left on the external server has to be dropped there first.
Once it is done - the instance runs Enterprise again, or its database is on the profile again - the entry and the notice on the instance go by themselves. If you decide not to re-do it, take the entry off the list: the cross in its State cell, for an Administrator, or from the command line:
pelmo$ ohm license suspensions dismiss 42The services
Fail2Ban
Fail2Ban's blocking is licensed to it by this server, as a sponsorship. When the license stops carrying automatic attack blocking - a lower edition, a server that runs unregistered after its offline days, a license moved to another server - the sponsorship is withdrawn, and the Fail2Ban service then:
- lifts every ban it holds, once, so addresses that were blocked can reach the host again;
- keeps its jails running and matching, and writes each ban it would make to its log as
WOULD BANinstead of to the firewall.
When a license carries it again, the sponsorship is offered again and blocking resumes. Bans lifted in between are not put back. This server's recipients are also taken off the service's ban notices while the license does not carry attack blocking notices. The Fail2Ban manual describes the same from the service's side: see Related.
GeoIP
The GeoIP service's data is sponsored the same way. When the license stops carrying IP location data, the sponsorship is withdrawn and the service answers every lookup with a placeholder that places no address. Its databases stay on disk and are no longer refreshed. Location rules therefore cannot place any address until the sponsorship returns, which it does by itself. The GeoIP manual describes the same from the service's side: see Related.
Related
- Editions
- Installing and activating a license
- The audit trail
- Alerting
- Licensing Fail2Ban, in the Fail2Ban manual
- Licensing GeoIP, in the GeoIP manual