Collector is offline

The connection pill in the top bar says "Collector offline" in red. Here's the order to check things.

Start on Health: the collector's card shows its recent warning badges and last self-check results (click Run checks if it's online). Each failed check names its AFW code and the fix, and Logs → Collector shows the diagnostics timeline leading up to the problem.

1 — is the collector running?

SSH to the collector host:

systemctl status kilasec-collector

Healthy:

● kilasec-collector.service - kilasec collector
     Loaded: loaded (/etc/systemd/system/kilasec-collector.service)
     Active: active (running) since ...

If inactive / failed:

sudo systemctl restart kilasec-collector
sudo journalctl -u kilasec-collector -n 100 --no-pager

The journal will tell you why the last start failed. Common causes:

• Docker image gone (was deleted from /var/lib/docker/). Pull again:

  sudo docker pull ghcr.io/blox-24/kilasec-collector:latest

• /etc/kilasec/collector.env corrupted / missing.
• Port 8080 or 9443 taken by another process.

2 — can the collector reach the cloud?

From the collector host:

curl -fI https://kilasec.com/api/healthz

Healthy:

HTTP/2 200

If you get a connection refused / timeout, the host can't reach kilasec.com. Check egress firewall, DNS, etc.

If you get HTTP/2 401, that's actually fine for /healthz — it means cloud is reachable but auth is required (only /healthz allows anon). The real test is:

curl -fI -H "Authorization: Bearer $(sudo cat /etc/kilasec/collector.env | grep AGENTFW_CLOUD_TOKEN | cut -d= -f2)" \
  https://kilasec.com/api/healthz

A 200 here means the credential is valid.

3 — is the collector's token revoked?

If you suspect the token was revoked (e.g. by another admin or by the cloud due to being stillborn — see a033398 and follow-up commits):

curl -H "Authorization: Bearer $TOKEN" \
  https://kilasec.com/api/v1/collectors/<collector-id>/status

If the response includes "status": "revoked", you'll need to re-enroll:

# Get a fresh enrollment code from your admin / the UI:
curl -X POST -H "Authorization: Bearer $TENANT_TOKEN" \
  https://kilasec.com/api/v1/collectors/codes

# Then re-run the installer with the new code:
curl -fsSL https://kilasec.com/install | sh -s -- --enroll <new-code>

4 — UI shows green but no rows arriving

That's a different situation — the cloud-side SSE is alive, but no decisions are coming in.

• Watch the collector's live decision stream:

  sudo docker exec kilasec-collector kilasec events -f

  If decisions show here but not in the cloud, the uplink is broken — check Logs → Collector for AFW-510 (sync failing) or AFW-511 (token rejected), or journalctl -u kilasec-collector for upload errors.
• If nothing shows, no agents are routing through the proxy. Verify with curl --proxy http://<collector-ip>:8080 https://api.openai.com.

5 — collector is online but the pill stays "Connecting…"

That's the SSE connection in the SPA itself, not the collector. Hard-refresh the browser (Cmd-Shift-R) — sometimes a stale tab gets stuck in connecting after an internet hiccup.

→ Related: Install a collector, Architecture.