Operations

Day to day, a healthy sensor needs no attention. This page covers what to check when you want to confirm that for yourself, and what the platform keeps and for how long.

Health checks

The console is the first place to look, since it reflects what the sensor has actually reported rather than just whether the appliance is powered on. The Overview dashboard shows Last check-in and Sensor version for the facility; a Last check-in that keeps advancing means the sensor is up, connected, and on a version you recognize.

On the appliance itself, check the service and the local dashboard covered in Monitoring and metrics:

sudo systemctl status safetybits

A unit that is repeatedly restarting rather than settling into active (running) is failing to start, see Troubleshooting.

Log locations

The sensor and its supporting services all run under systemd, so their logs are in the journal:

sudo journalctl -u safetybits -f      # the sensor itself
sudo journalctl -u watchtower -f      # automatic updates
sudo journalctl -u prometheus -f      # local metrics collection

An on-prem console runs its services under systemd too. journalctl -u <service> on the console host works the same way for its API, worker, and agent manager services.

What “the sensor stopped checking in” means

Last check-in on the Overview dashboard stops advancing when the sensor cannot reach the console, not necessarily when it has stopped working locally. Work through these in order:

1. Confirm the appliance is powered on and its management link light is active.
2. Confirm the appliance can still resolve and reach the console’s address on its management connection, see Planning for what that connection needs.
3. Check sudo systemctl status safetybits. A crash looping unit usually means the sensor ID in /etc/safetybits does not match a facility the console still has, or the console rejected the connection outright.
4. Check sudo journalctl -u safetybits for the actual error the sensor logged on its last attempt to connect.

None of this affects discovery or detection running locally on the appliance while it is disconnected. It resumes reporting automatically once connectivity is restored, nothing needs to be replayed by hand.

Capacity and retention

Inventory size counts against the license limit shown on Inventory as Inventory capacity. Contact your Safetybits contact if a facility is approaching its limit.

Snapshots, alerts, alert groups, and resource change history are kept for 90 days. Network flow records and the traffic views built from them are kept for shorter windows depending on how aggregated they are, from a day up to three months, see Network traffic and flows for the detail. None of this is configurable per facility today, if your compliance obligations need a longer window, talk to your Safetybits contact.