Troubleshooting
Start with Operations if the symptom is simply that the sensor has stopped checking in at all. This page covers the more specific symptoms underneath that.
Sensor
Sensor checks in, but no devices appear in Inventory. The sensor only sees what its port mirroring interface receives. Confirm the switch side SPAN session is actually configured and pointed at that port, see Sensor configuration for switch specific steps. sudo journalctl -u safetybits shows whether the sensor is receiving any traffic at all on that interface.
Devices appear with an IP and MAC address but nothing else. This is expected for a device the platform does not recognize. If it happens for devices that should be recognized, confirm the sensor’s OT network connection is actually wired and reachable, active identification runs over that connection, not the mirrored feed. See Discovery and the inventory for why partial data happens, and Planning for what that connection needs.
The sensor is not updating. Automatic updates need outbound internet access beyond the console, see Upgrade. sudo journalctl -u watchtower shows whether it can reach the image registry.
The local monitoring dashboard at port 8080 is unreachable. It only listens on the appliance’s management connection. Confirm you are reaching it from a host on that network, not from the OT network or the internet.
Network capture and port mirroring
Flows are missing traffic you expect to see. A SPAN session that only mirrors some VLANs, or mirrors traffic in one direction only, produces exactly this symptom rather than an error. See Network traffic and flows for how coverage depends on the mirror configuration, and Sensor configuration to check the switch side setup.
A requested network capture never finishes or downloads empty. Confirm the sensor is checking in normally first, a capture request is delivered over the same management connection as everything else, and cannot complete while that connection is down.
On-prem console
Nobody can log in. The console’s only outbound dependency is its identity provider, see Data handling and trust. Confirm the console host can reach it before looking anywhere else.
The console UI loads, but nothing in it works. The UI and the API it calls are separate services on the console host. sudo systemctl status on the API and agent manager services shows whether one of them has stopped.
No sensors can register or report. Confirm the console host accepts inbound connections on the ports Planning describes, both from your own perimeter firewall and from the console host’s own firewall rules.