Troubleshooting

Start with service state

sudo systemctl status axiom --no-pager
sudo journalctl -u axiom -n 200 -l --no-pager
sudo ss -ltnp
sudo ss -lunp
ip -br addr
ip route

Confirm the process is running, the configured IP exists on the selected NIC, and no other process owns the required port.

Node does not appear in Management

1. Verify /etc/axiom/axiom.toml contains the correct management_url and enrollment token.
2. Confirm the URL scheme matches the active Management listener.
3. Test TCP 8443 from node to Management.
4. If HTTPS uses a private CA, install trust correctly. Use invalid-certificate acceptance only for controlled lab testing.
5. Review logs for HTTP 401, TLS, timeout, or runtime-config errors.
6. Confirm license node limits have not been reached.

Policy saves but node does not acknowledge

1. Confirm the node reports a current heartbeat.
2. Test TCP 9443 from Management to the node control IP.
3. Confirm firewall source restrictions permit the Management IP.
4. Verify the node ID in Management matches the installed node.
5. Wait for pull recovery and compare the applied generation.

SMB traffic counters are too small

Confirm the Windows client is connected to the Axiom IP, not a cached backend path. On the SMB node, use ss -tnp to verify one connection from the client to Axiom and one from Axiom to the backend. Check that direct client-to-backend TCP 445 is blocked and that SMB multichannel did not discover another path.

Reputation event says Block but file remains

Check the SMB node log for blocked SMB frame by known bad reputation hash and stream blocked. Confirm the node loaded the current known-bad feed, the active action is Block, and the client started a new SMB connection. Verify the file hash exactly matches the reputation entry and inspect the backend share directly.

DNS is slow or intermittently fails

• Test UDP and TCP separately with dig.
• Verify both upstream protocols are allowed by the firewall.
• Check upstream error, timeout, and cache counters.
• Remove unreviewed threat feeds during diagnosis.
• Confirm routing uses the intended upstream egress NIC.
• In AD, verify the forwarding chain does not loop between the DC and Axiom.

Installer or repair fails

Retain the complete terminal output. Confirm free disk and memory, DNS/package repository reachability when installing dependencies, system time, compiler and linker packages, pkg-config, and libssl-dev. Re-run only after resolving the first reported error.

Support bundle

From Management, open Support and export diagnostics. Include the affected node ID, time window, client IP, file path or domain, expected policy, and exact client-visible result. Do not send passwords, enrollment tokens, private keys, or unrelated customer data in a ticket.