Troubleshooting

Troubleshooting

No events / no traffic on the dashboard

• Is the log path right and readable? Check paths.access_log (or your log_sources entries). secwatch must be able to read the file. The dashboard's Log sources card shows a live/idle dot and a line count per source — an idle source with 0 lines usually means a wrong path or a permissions problem.
• Right format? A traefik parser won't read an nginx log. Use Scan for logs (it sniffs the format for you) or set log_source.type correctly.
• Edge-silence alert firing? That means the log stopped advancing — the proxy is down, or access logging was turned off.

Bans aren't actually blocking

• Check the actuator. ban.actuator: none only alerts. nftables/nginx need root. traefik needs proxy.bans_file pointing at a directory Traefik loads.
• Traefik + HTTPS: secwatch writes both a web and a websecure (TLS) ban router — if you templated your own, remember a Traefik router is TLS or non-TLS, so you need one of each.
• Shared-edge exemption: IPs in ban.exempt_nets (e.g. Cloudflare) are never banned by design — banning one would block every visitor behind that edge.

I got locked out / a legit device got banned

• Widen network.trusted_nets to include the host, and/or unban it from the dashboard. Keep trusted nets narrow otherwise (see Detection and Bans).
• If internal false-positives are the issue, ensure autoban_private: false (the default) so LAN anomalies alert without auto-banning.

Dashboard login problems

• The password is stored only as a hash — if you've lost it, re-run python -m secwatch.install (or regenerate auth.password_hash).
• Too many failed logins triggers a short lockout per source IP; wait it out.
• Behind a proxy that should bypass login? Confirm the proxy's source is in auth.trust_proxy_from.

CVE card is empty

• CVE scanning needs Docker reachable by secwatch. Without it, scanning idles.
• The first scan runs after a startup delay; give it a few minutes.

LLM analysis card shows an error

• Verify llm.base_url is reachable from the secwatch host and the model name exists on that endpoint. For remote APIs, set the API key (SECWATCH_LLM_API_KEY). It's optional — disable with llm.enabled: false.

A change to secwatch.yaml didn't take effect

• Restart secwatch (systemctl restart secwatch). YAML changes are read at start. Exception: log sources added from the dashboard apply live, no restart.

Diagnosing further

• Logs: journalctl -u secwatch -f (or --user for a user unit).
• Health: curl http://localhost:PORT/api/health reports the self-check (database, disk, KEV freshness, ban actuator, edge liveness).
• Still stuck? Open an issue — include your format/actuator and a redacted sample log line. Please don't post third-party exploit details.