search close

Console

access_time Updated Sep 21, 2021

My Data Is not Showing In The Console With Working Module/Agent.

If both the agent and module are reporting as active within the console but no data is displayed when requests are processed there is a good chance that the system time on the agent is out of sync and thus events are being reported at times significantly in the past or future. This can happen especially in a dev environment using a VM or container that gets in a paused state and is not updated via cron.

To determine whether this condition is occurring, open the Agents page in the console and navigate to the graphs section. There is a graph for agent clock skew and this should not be more than a few seconds. If this is a large value updating the system time and maintaining ntpd should rectify the issue.

Checklist When No Signals Appear On The Console

  1. Confirm the versions of your OS and web server are supported versions.
  2. Confirm your agent is online via the console.
  3. Confirm your module is detected via the console.
  4. Confirm the console is receiving telemetry from the agent.
  5. Confirm your systems Clock Skew minimal (see agent clock skew graph). Run NTP update on your system if necessary.
  6. If Nginx is your web server run /opt/sigsci/bin/check-nginx
  7. Collect logs for review by support:
    • Run the agent with the command line argument -debug-log-all-the-things
    • If Nginx is your web server collect your Nginx error.log
  8. Collect configuration files /etc/sigsci/agent.conf and if running NGINX /etc/nginx/nginx.conf

Why am I seeing target hosts in the console for domains I do not own?

Some customers have noticed that foreign domains are showing up in their console views. This can happen if the requestor is using a modified hosts file or forged host header so that it appears the target is a foreign host but has been configured to point to one of your IP addresses directly.

How do I report on the right most X-Forwarded-For IP address?

When multiple IP addresses are appended to the X-Forwarded-For, by default the console reports on the left-most IP address. In some situations (e.g., users of Amazon ELB) you may want to report on the right-most IP address instead. To report on the right-most IP address, make sure you are running the latest version of the Signal Sciences module and agent and then follow the instructions for configuring the X-Forwarded-For header.