Console FAQ

My data is not showing in the console but the agent and module are running

If both the agent and module are reporting as active within the console, but no data is displayed when requests are processed, then the system time on the agent is likely out of sync. This can cause events to be reported at times significantly in the past or future. This is especially likely in a dev environment using a VM or container that gets in a paused state and is not updated via cron.

To determine whether this condition is occurring:

  1. Log in to the Next-Gen WAF console.
  2. From the Sites menu, select a site if you have more than one site.
  3. Click Agents in the navigation bar.
  4. Click on the name of the agent.
  5. Inspect the graph for Agent clock skew (seconds). The agent clock skew should not be more than a few seconds. If this is a large value updating the system time and maintaining ntpd should rectify the issue.

Requests in the console aren't reporting any signals

Confirm your operating system and web server are supported

Check out our supported versions to confirm which operating system and web server versions are supported.

Confirm your agent and module are running correctly

  1. Log in to the Next-Gen WAF console.
  2. From the Sites menu, select a site if you have more than one site.
  3. Click Agents in the navigation bar.
  4. In the Status column, confirm the agent is listed as online.
  5. In the Module column, confirm the module is listed as detected.
  6. Click on the name of the agent.
  7. Review the listed agent metrics to confirm the console is receiving telemetry from the agent. If the console is not receiving telemetry from the agent, some metrics will be listed as Unknown or 0 ms.
  8. Confirm agent clock skew.

Check NGINX

If NGINX is your web server, you can confirm that NGINX, the agent, and the module are configured correctly by running the following:

$ /opt/sigsci/bin/check-nginx

Contact Support

If you have confirmed any issues with the previous steps, gather any necessary data and reach out to our Support team for assistance.

  1. Enable verbose debug logging by adding the following line to your agent configuration file (by default at /etc/sigsci/agent.conf):

    debug-log-all-the-things = true
  2. Restart the agent and collect the verbose log entries.

  3. Generate an agent diagnostic package by running the following command:

    $ sigsci-agent-diag
  4. Collect the agent configuration file located by default at /etc/sigsci/agent.conf.

  5. Collect server configuration files:

    • NGINX: /etc/nginx/nginx.conf
    • Apache: /etc/httpd/conf/httpd.conf
    • IIS: %SystemDrive%\System32\inetsrv\config\applicationHost.config
  6. Collect server error log files (if applicable):

    • NGINX: /var/log/nginx/error
    • Apache: /var/log/apache2/error.log
    • IIS: %SystemDrive%\inetpub\logs\LogFiles
  7. If NGINX is your web server, collect the output of:

    $ /opt/sigsci/bin/check-nginx
  8. Reach out to our Support team with a detailed description of the issue and all collected logs and configuration files.

Why am I seeing target hosts in the console for domains I do not own?

This can happen if the requester is using a modified hosts file or forged host header. This is done to make it appear as though the target is a foreign host when it has actually been configured to point to one of your IP addresses directly.

How do I report on the right most X-Forwarded-For IP address?

When multiple IP addresses are appended to the X-Forwarded-For header, by default the console reports on the left-most IP address. In some situations (e.g., users of Amazon ELB) you may want to report on the right-most IP address instead. To report on the right-most IP address, make sure you are running the latest version of the Signal Sciences module and agent and then follow the instructions for configuring the X-Forwarded-For header.

Was this guide helpful?

Do not use this form to send sensitive information. If you need assistance, contact support. This form is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.