search close

Console

access_time Updated Dec 5, 2022

My data is not showing in the console but the agent and module are running

If both the agent and module are reporting as active within the console, but no data is displayed when requests are processed, then the system time on the agent is likely out of sync. This can cause events to be reported at times significantly in the past or future. This is especially likely in a dev environment using a VM or container that gets in a paused state and is not updated via cron.

To determine whether this condition is occurring:

  1. Click Agents in the navigation bar. The agents page appears.

  2. Click on the name of the agent. The agent metrics page appears.

  3. Inspect the graph for Agent clock skew (seconds). The agent clock skew should not be more than a few seconds. If this is a large value updating the system time and maintaining ntpd should rectify the issue.

Requests in the console aren’t reporting any signals

Confirm your OS and web server are supported

See supported versions to confirm what OS and web server versions are supported.

Confirm your agent and module are running correctly

  1. Click Agents in the navigation bar. The agents page appears.

  2. In the Status column, confirm the agent is listed as online.

  3. In the Module column, confirm the module is listed as detected.

  4. Click on the name of the agent. The agent metrics page appears.

1.Review the listed agent metrics to confirm the console is receiving telemetry from the agent. If the console is not receiving telemetry from the agent, some metrics will be listed as Unknown or 0 ms.

  1. Confirm agent clock skew.

Check Nginx

If Nginx is your web server confirm Nginx, the agent, and the module are configured correctly by running

/opt/sigsci/bin/check-nginx

Contact Support

If you have confirmed any issues with the previous steps, please gather any necessary data and reach out to our Support team for assistance.

  1. Enable verbose debug logging by adding the following line to your agent configuration file (by default at /etc/sigsci/agent.conf):

    debug-log-all-the-things = true

  2. Restart the agent and collect the verbose log entries.

  3. Generate an agent diagnostic package by running

    sigsci-agent-diag

  4. Collect the agent configuration file located by default at /etc/sigsci/agent.conf.

  5. Collect server configuration files:

    • Nginx: /etc/nginx/nginx.conf
    • Apache: /etc/httpd/conf/httpd.conf
    • IIS: %SystemDrive%\System32\inetsrv\config\applicationHost.config
  6. Collect server error log files (if applicable):

    • Nginx: /var/log/nginx/error
    • Apache: /var/log/apache2/error.log
    • IIS: %SystemDrive%\inetpub\logs\LogFiles
  7. If Nginx is your web server, collect the output of:

    /opt/sigsci/bin/check-nginx

  8. Reach out to our Support team with a detailed description of the issue and all collected logs and configuration files.

Why am I seeing target hosts in the console for domains I do not own?

This can happen if the requester is using a modified hosts file or forged host header. This is done to make it appear as though the target is a foreign host when it has actually been configured to point to one of your IP addresses directly.

How do I report on the right most X-Forwarded-For IP address?

When multiple IP addresses are appended to the X-Forwarded-For header, by default the console reports on the left-most IP address. In some situations (e.g., users of Amazon ELB) you may want to report on the right-most IP address instead. To report on the right-most IP address, make sure you are running the latest version of the Signal Sciences module and agent and then follow the instructions for configuring the X-Forwarded-For header.