🔧

Agent Troubleshooting Guide

Diagnose and resolve common agent issues quickly with these step-by-step solutions.

● Checking Agent Status

sudo systemctl status soc-agent

Expected output: Active: active (running)

● Viewing Agent Logs

# Recent activity
tail -50 /opt/agentic-soc-agent/agent.log
# Live logs
sudo journalctl -u soc-agent -f
# Actions log (remediation history)
tail -50 /opt/agentic-soc-agent/actions.log

● Common Issues and Fixes

⚠️ Issue: Agent is not running

sudo systemctl start soc-agent
sudo systemctl enable soc-agent # Auto-start on boot

⚠️ Issue: No alerts appearing on dashboard

  1. Check agent connectivity:
curl -X POST https://ayzalai.com/api/ingest/events \
  -H "Content-Type: application/json" \
  -H "X-API-Key: YOUR_KEY" \
  -d '{"events":[{"event_type":"test","raw_event":{"message":"test"}}]}'
  • Expected response: {"processed":1,"alerts_created":1}
  • If connection fails, check firewall: sudo iptables -L
  • Verify API key is active in Settings

⚠️ Issue: Agent is not detecting attacks

  1. Check that auth logs exist: ls -la /var/log/auth.log or /var/log/secure
  2. Trigger a test event: ssh invalid@localhost (try wrong password)
  3. Check agent log: tail -f /opt/agentic-soc-agent/agent.log
  4. You should see: [DATE] SENT: auth_failure

⚠️ Issue: Auto-block not working

  1. Check that auto-remediation is enabled in Settings
  2. Verify the alert severity is CRITICAL or HIGH
  3. Check that the IP is not whitelisted or a private IP
  4. View actions log: tail -f /opt/agentic-soc-agent/actions.log

💡 Quick Tip: Most issues are resolved by checking connectivity, verifying the API key, and confirming logs are being generated. Always start with sudo systemctl status soc-agent to verify the agent is running.