Troubleshooting

Common issues and how to resolve them. Start with the health endpoints — :18900/api/health on an endpoint and :18901/api/health on the hub — and the service logs (journalctl -u antemure-daemon, RUST_LOG=antemure=debug).

A node doesn't appear in the fleet

  • Confirm the daemon is alive: curl -s http://localhost:18900/api/health and systemctl status antemure-daemon.
  • Confirm the hub URL and token are set (AURA_ENROLL_URL/AURA_ENROLL_TOKEN or ~/.antemure/antemure-enroll.json) and the hub is reachable outbound from the node.
  • Give it ~30 s (heartbeat cadence), then check curl -s <hub>/api/endpoints. Enrollment is self-healing — a bad token logs a 401/403 and retries.

Enrollment fails (401/403)

The join token must match the hub's current token (fleet-wide or per-tenant). Regenerate it from Fleet → Add a node (or rotate via Admin), update the node's enroll env/file, and restart. In multi-tenant mode make sure you used the tenant's token.

Reasoning gateway unreachable / incidents show “heuristic”

If /api/reasoning/latest reports the heuristic backend, the gateway was unavailable or the token budget was spent — detection continues deterministically. Check AURA_LLM_BASE_URL (default gateway.secureinsights.ai) is reachable, the bearer is valid (license key or AURA_GATEWAY_TOKEN), and the daily token budget / rate cap on /api/spend isn't exhausted. For air-gapped sites, point AURA_LLM_BASE_URL at your own OpenAI-compatible endpoint.

Detections fire but nothing is remediated

Expected on a fresh node — the default watch risk tier is observe-only. Raise the tier and either approve the pending action or enable standing autonomy (Administration → Fleet config, admin-password-gated). Also confirm the action is in remediation.allowed_actions and not blocked by a protected-service/path or the operator-lockout guard. See Investigation & Remediation.

SOAR won't start

antemure-soar requires Postgres and Temporal and the required env (AURA_SOAR_DATABASE_URL, AURA_SOAR_WORKER_DATABASE_URL, AURA_SOAR_PROXY_SECRET). Use scripts/install-soar.sh (or the aura-soar Helm chart) rather than running it by hand; it provisions both containers and wires the hub. Check curl http://127.0.0.1:18902/api/soar/health and that the hub has AURA_SOAR_URL + proxy secret so /api/soar proxying works.

License issues

An unlicensed node still detects and reasons (fail-open) but entitlement-gated collectors (credential scan, supply-chain, AI-agent) stay off. Set AURA_LICENSE_KEY=cp_… (or ~/.antemure/license.key) and confirm AURA_ACCESS8_URL is reachable; /api/license shows the current state. The hub can push license_state to managed nodes so they don't each call Access8.

SIEM events not arriving

Confirm siem.enabled (auto-enabled by setting a syslog address or HEC URL), the sink address/token, and that forward_events is on if you expect raw events (not just incidents). Events use a durable retry outbox, so transient outages recover automatically. Remember export is CEF — configure your collector's sourcetype accordingly. See SIEM & Telemetry.

Kubernetes / container collectors are empty

The container, k8s-API, image-scan and cloud-audit collectors self-gate when their tooling or env flag is absent — that is normal, not an error. Enable them with AURA_K8S_CLUSTER_AGENT=1, AURA_IMAGE_SCAN=1, or AURA_CLOUD_AUDIT=gcp|aws|azure, and make sure the CRI socket path is correct (--set nodeSensor.criSocket=… for CRI-O/Docker).

Port conflicts

antemure-soar and antemure-mcp both default to 18902 — don't run both on one host with defaults; change AURA_MCP_PORT or the SOAR --port. Default map: daemon 18900 (admission 8443), hub 18901, SOAR/MCP 18902, Postgres 5433, Temporal 7233 (UI 8233).