Troubleshooting

The server doesn’t show up in the dashboard

• Check the service is running: systemctl status atalince-agent.
• Look at the agent log: journalctl -u atalince-agent -n 100.
• Confirm outbound HTTPS: curl -sI https://agent.sentinnel.com.br.
• The token is single-use and expires in a few minutes. Generate another one in the dashboard and run again; if the server was already registered, use --reregister.

The Sensor signal says “Not reading”

The agent can’t read the log source.

• On servers without /var/log/auth.log or /var/log/secure, SSH is read from journald.
• If rsyslog was removed or stopped, the agent switches to journald on its own.
• Under Settings › Agent and sources, see which source each sensor is reading.

The block stays “Awaiting confirmation”

The dashboard asked, but the agent hasn’t sent the receipt yet.

• Check the server is in protection mode, not Monitor only.
• Check the agent is communicating (the Communication signal).

The firewall read says the block isn’t there

The trail shows the reason:

Reason	What it means
The IP is not in the block set	The IP left atalince-bans.
The set’s drop rule is missing	Someone removed the --match-set atalince-bans src -j DROP rule.
INPUT does not go through the block chain	Another tool’s reload removed the jump to ATALINCE-BANS. The agent restores it on the next cycle.
The firewall for this IP family is unavailable	The server’s firewall lacks IPv4 or IPv6 support.

Still stuck? Write to [email protected].