Agents not connecting

On the system, start with the agent’s own log:

sudo systemctl status garrison-agent
sudo journalctl -u garrison-agent -n 50

On Windows: Get-ScheduledTask GarrisonAgent and the log in %ProgramData%\VCLocal.

Symptom	Cause and fix
The install command fails at the first curl with SSL: public key does not match pinned public key	The command is reaching something other than your appliance (a proxy, or the wrong address), or the appliance’s certificate was replaced. Get a fresh command from Systems → Add system
curl: (7) Failed to connect … port 8080	The system cannot reach the appliance on TCP 8080. Check firewalls between them
Log says invalid token. Generate a new install command	The install token expired (15 minutes to 1 day) or was mistyped. Generate a new command and run it again
Log says agent identity mismatch	The agent’s saved credential belongs to another system. Re-run a fresh install command
The system appears twice (web-01 and web-01-3f2a)	Two machines share one machine ID (cloned from the same image). They are different systems; that is expected. If it is the same machine, delete the offline one
Online, but commands time out	The system is overloaded or the command runs longer than its timeout. Commands are limited to one hour and eight at a time per system
Offline after the system was deleted and re-added	Run a fresh install command: the agent drops its old credential and registers again
Log says refusing an unencrypted connection	The agent only connects over TLS (wss://), except to localhost. Use the address from the install command

Upgrading an agent

Run a fresh install command from Systems → Add system on the system. The agent is replaced in place and keeps its identity, tags and roles.