InfraFenceInfraFence

Live Security Operations

Get Started

Troubleshooting

Fix common InfraFence problems - a server not reporting, install and registration errors, expired tokens, missing logs, firewall conflicts, ipset and country blocking - with the real messages to look for.

Last updated:

Read the agent's log

bash
journalctl -u infrafence-agent -f
journalctl -u infrafence-agent -n 50 --no-pager

With upstart or sysvinit the agent logs to syslog: tail -f /var/log/syslog | grep infrafence-agent. Lines are tagged by part: [firewall], [webwatcher], [api], [updater], [protection] and so on.

The read-only check is often the fastest diagnosis:

bash
sudo infrafence-agent preflight

The server shows "Not reporting"

  1. Is the service running? systemctl status infrafence-agent. If not, journalctl -u infrafence-agent -n 50 --no-pager says why.
  2. Can the server reach the dashboard? curl -sI https://infrafence.com from the server. A line like [main] warning: could not resolve API host points to DNS.
  3. Is the dashboard refusing the agent? Look for [api] ERROR: the dashboard refused the agent token (401) (the server was removed, or its token revoked: install again with a new token and --force-register) or the dashboard says this organization is SUSPENDED (403). See When the dashboard is unreachable.

The agent sends a heartbeat every 60 seconds, so a server comes back within a minute once the cause is fixed.

Install and registration errors

Message What to do
Install token is required Add --token <TOKEN>. Only a server already registered, or a dry run (--dry-run), can run the installer without it.
This script must be run as root Run it with sudo.
Unsupported architecture Only x86-64 and ARM64 are supported.
No supported init system found The server needs systemd, upstart or sysvinit. Use Docker otherwise.
No package manager found (apt-get, yum, dnf) Install curl, iptables and ca-certificates by hand, then run the installer again.
Another package operation is running — waiting for it to finish... The installer waits up to 5 minutes for apt, dnf or yum to finish. If it gives up, finish that operation and run it again.
Dependency installation failed The box shows the command to run by hand (for example apt-get update --fix-missing && apt-get install -y ca-certificates curl iptables).
Download failed The server cannot reach GitHub. The agent is downloaded from github.com and release-assets.githubusercontent.com only: both must be reachable over HTTPS. Check the firewall, any proxy and the CA certificates (ca-certificates).
Could not download the checksum from … The release checksum is required, so nothing was installed. Same checks as for Download failed, then run the installer again. --skip-checksum installs without verifying the binary: unsafe, only if you know why the checksum cannot be fetched.
Checksum mismatch: the downloaded agent is not the published release and was not installed. The download was altered or truncated, often by a proxy. Nothing was installed. Run the installer again.
The Let's Encrypt root CA in this script does not match its fingerprint; not using it. The installer itself was damaged on the way. Download it again.
Registration failed The box lists the usual causes: Invalid or expired install token, Server URL is unreachable, Server limit reached for your plan.

The token expired

Install tokens are single-use and valid for one hour. Generate a new one under Servers › Add server and run the command again. On Starter, an unused, unexpired token counts against the one-server limit until it expires or you revoke it under Settings › Install tokens.

No web attacks detected

If the log says [webwatcher] no access logs found — web attack detection disabled (set WEB_LOG_PATH to override), the agent did not find your access logs. Point it to them:

bash
sudo systemctl edit infrafence-agent
ini
[Service]
Environment=WEB_LOG_PATH=/path/to/access.log,/path/to/other.log
bash
sudo systemctl restart infrafence-agent

No SSH attacks detected

The agent log names the source it reads: reading authentication messages from …. On systemd it uses the journal. If your SSH daemon logs to an unusual file, set AUTH_LOG_PATH the same way as WEB_LOG_PATH.

Firewall conflicts

The agent checks its chains every minute, and every 5 seconds whether its jump in INPUT is still there, so when another tool removes them (csf -r, a ufw or firewalld reload) it puts them back within seconds ([firewall] guard: restored …; within a minute before agent 1.0.33). While CSF rebuilds the firewall it waits for CSF to finish, for at most 2 minutes. If repairs come back to back, or three or more times in an hour, it reports firewall_conflict: another tool keeps rewriting the firewall (ufw, firewalld, CSF, netfilter-persistent or a configuration-management run). Bans keep working; find the tool that reloads the firewall so often. See Coexistence.

To see the agent's rules:

bash
sudo iptables -L INFRAFENCE -n --line-numbers
sudo ipset list infrafence-bans | head

ipset is missing

[firewall] ipset not found — falling back to iptables (limited capacity): bans still work, up to 500. Country blocking and blocking of threat lists then only detect. Install ipset with your package manager and restart the agent.

Country blocking does nothing

not blocked yet: geoip database not loaded in the log (geoblocking disabled before agent 1.0.33) means the server has no country database yet, and country database not updated says why the download failed: see Country blocking. country blocks NOT applied at kernel level means ipset is missing.

A legitimate address was banned

On the server's Network tab, Unban now, then Add to whitelist so it never happens again. For web false positives, turn off the pattern or change the attack type's mode on Web firewall.

Update problems

[updater] v<version> available — automatic updates are not turned on (notify only) is expected with Notify only: use Install now or the manual command. [updater] signature check FAILED means the download did not verify: nothing was installed. See Updating the agent.

I don't receive the confirmation or reset email

The email usually arrives within a minute. If it doesn't:

  • Look in the spam or junk folder, and in tabs such as Promotions or Updates. A company mail filter can hold it in quarantine: ask your IT team to allow emails from InfraFence.
  • Check the address for typos. After Forgot password? the page says the link has been sent if an account uses this address: for your security it reads the same whether or not an account exists, so an address with a typo, or without an account, gets nothing. Try the address you signed up with.
  • We couldn't send the email to this address. Check it's correct, or try again in a few minutes. means the email did not leave: the address was refused or sending failed for a moment. Check the address and ask again a few minutes later.
  • This address can't receive email (when you sign up): the address's mail server refused it, or its domain has no mail server. Use another address.
  • Ask for a new email only once a minute: a request that comes too soon is refused. Each new link replaces the previous one, so use the most recent email.

Still nothing after that? Write to us from the contact page with the address you used.

InfraFence emails don't reach an address

The dashboard shows We couldn't deliver email to … when that address's mail server refused InfraFence's emails for good: the mailbox doesn't exist, or the domain has no mail server (no MX record). The weekly summary, the monthly report, the protection and trial notices and the email alert channels then skip the address for 7 days and try it again after that.

  • If it's your address: check the mailbox exists and that the domain receives email (its MX record). To use another address, change it under Settings › Account (Change your email address): the current address can't receive its confirmation link, so open the one sent to the new address and write to info@infrafence.com, and we complete the change.
  • If it's another owner's or admin's address: let them know another way.
  • An email alert channel with that address shows recipient_rejected. Send test tries it again at once.

Temporary problems (a busy or unreachable mail server) are not remembered: the email is tried again on the next run.