Docs menu ▾
Alerts
Every alert the fleet server raises: what it means, the usual causes, and what to do. Find an alert by its name on the dashboard.
Two rules apply to all of them: - The server only observes. It can't fix anything on a host; you act on the host. - Repeats are counted, not duplicated. The same alert within an hour bumps Count. If more than 500 new alerts arrive in an hour (usually junk traffic), the rest fold into one row per kind.
Quick reference
| Alert | Severity | In one line |
|---|---|---|
| Missed heartbeat | High | A node stopped reporting |
| Heartbeat gap | Medium | A node was silent for a while, then came back |
| Daemon restarted | Medium | The daemon started again after it had been running |
| Node reports enforcing = false | High | The daemon is up but not enforcing |
| Daemon's baseline differs from the scanner's | High | The host enforces a different baseline than was uploaded |
| Policy / bundle hash drift | High | A node runs a policy or scanner you didn't expect |
| Signature verification failed | High | A message claimed to be from a node but wasn't signed by it |
| Replayed / out-of-order seq | Medium | A message was sent twice, or is very old |
| Envelope from unknown agent_id | Low | Traffic from something that never enrolled |
| Enrollment token reuse | High | Someone presented an already-used token |
| Unknown enrollment token | Low | A token that was never issued |
| Expired enrollment token | Low | A real token, used too late |
| Second baseline for a host refused | Medium | A different baseline was uploaded for a host that has one |
Missed heartbeat
Means: no heartbeat for more than 3× the node's usual interval (about 90 seconds at the default 30). Shown live under Alerts → Silent right now and as a red node.
Usual causes: the daemon was stopped or crashed, the host is down or rebooting, or the network to genossec.com is blocked.
Do: check the host: systemctl status genos-daemon, journalctl -u genos-daemon. If nobody
stopped it on purpose, treat it as a possible attack. Stopping the enforcer is exactly what an
attacker with root would do first.
heartbeat_gap
Means: a node that had been silent past the threshold sent a heartbeat again. The detail says how long it was quiet.
Do: confirm the gap matches a known event (reboot, maintenance, outage). An unexplained gap deserves the same look as a missed heartbeat. During the gap the host may not have been protected.
daemon_restart
Means: the daemon reported daemon_start after it had already been reporting.
Usual causes: someone restarted it, it crashed and systemd restarted it, or the host rebooted.
Do: check journalctl -u genos-daemon around that time. While the daemon is down the hooks are
detached, so nothing is enforced.
not_enforcing
Means: a heartbeat says enforcing: false.
Do: check the daemon log for why the hooks aren't attached. The host isn't protected until this clears.
baseline_mismatch
Means: the hashes in the daemon's signed heartbeat differ from the baseline the scanner uploaded for that hostname. The dashboard labels the baseline Mismatch.
Usual causes: someone uploaded a forged baseline for this host's name before the real scan, the scan record on the host was replaced, or two hosts share a hostname.
Do: compare both hashes on the node's Baseline tab. If you can't explain the difference, treat the baseline as untrusted and reinstall the host's baseline through a trusted path.
hash_drift
Means: a node reports a scanner_version, bundle_sha256 or policy_wasm_sha256 that
differs from the expected value set in the server config.
Usual causes: a rollout in progress, a forgotten config update, or a policy that was swapped on the host.
Do: if it's a rollout, update the expected values (how). If not, find out who changed the host.
bad_signature
Means: a message used an enrolled node's ID but its signature didn't verify. It was rejected.
Usual causes: traffic tampered with on the way, someone forging messages for that node, or the node's key file was replaced.
Do: the message was dropped, so the data is safe. Find where it came from (the Source column). Repeated failures from the node's own address mean its key changed and it needs to re-enroll.
replayed_seq
Means: a message reused a sequence number the server already accepted, or was more than 1024 messages older than the newest. It was rejected.
Usual causes: a captured message being resent, or the node's state file
(/var/lib/genos-inventory/agent_state.json) restored from an old copy.
Do: occasional out-of-order delivery is normal and doesn't raise this. Repeats are worth investigating.
unknown_agent
Means: a message arrived for an agent_id that never enrolled. Grouped by source address.
Do: usually scanning or misconfiguration. Check the source if it persists.
enrollment_token_reuse
Means: someone presented a token that already enrolled a node.
Do: the token was copied after use. Find out where it leaked from. The original node is unaffected.
enrollment_unknown_token
Means: a token the server never issued. Usually a typo or guessing.
enrollment_token_expired
Means: a real token, presented after its 24-hour lifetime. Mint a new one.
baseline_resubmitted
Means: a host that already has a baseline uploaded a second, different one. It was refused, because each host has exactly one install-time baseline.
Do: if the host was rebuilt, that's a new install: remove its old baseline on the server first (how). Otherwise, find out who sent it.