Troubleshooting

The most common cases – and how to narrow them down.

The device does not appear in the dashboard #

First check whether the agent is connected at all:

node64-agent status

If it says "not connected", the enrollment is missing:

node64-agent enroll --token=your-token

A token is usable once and expires. When in doubt, get a fresh one from the dashboard.

The agent reports, but nothing arrives #

systemctl status node64-agent
journalctl -u node64-agent -n 50

Common messages:

401 unauthorized: Invalid or revoked device key The key is no longer valid – the device was deleted in the dashboard, or it was re-enrolled elsewhere. Running enroll again creates a new key.

Server not reachable DNS or outbound connectivity. Test:

curl -sS https://app.node64.de/api/v1/openapi.json | head -c 100

Upload rejected: too large Very large package inventories. Get in touch – that is a case for us, not for you.

The container only sees itself #

If the agent runs in a container without NODE64_HOST_ROOT, it reports the container – few packages, no services, no firewall. Technically correct and usually not what you meant. Correct:

-e NODE64_HOST_ROOT=/host -v /:/host:ro

After a restart it is a new device #

Then a persistent volume for /var/lib/node64 is missing. That is where the identity lives. Without a volume the agent re-enrolls on every start.

Findings do not disappear although fixed #

Three common reasons:

The service was not reloaded. Changed sshd_config but forgot systemctl reload ssh – then the old configuration still applies, and NODE64 measures the old one.
A reboot is pending. Updated libraries only take effect once processes load them again.
The next run has not happened yet. Trigger it with node64-agent once.

A finding keeps coming back #

If a change is reverted on every run, configuration management (Ansible, Puppet, cloud-init) is usually writing it back. Adjust the template there – otherwise it wins every night.

The agent finds no firewall #

limited: firewall (no firewall tool found) means: neither nft, iptables, ufw nor firewalld is installed. In a container that is normal – the firewall belongs to the host.

The agent honestly reports what it could not collect instead of passing gaps off as "all fine".

The public address is wrong #

Behind a reverse proxy or in an internal network the agent does not see the address your service is reachable under. In that case answer the question on the device ("Is this system reachable from the internet?") – your own statement is the more accurate information here.

Nothing helps #

Send us the output of node64-agent status and the last lines of journalctl -u node64-agent. Neither contains secrets – but do say if you removed something. Contact