Status & troubleshooting

One command answers “is everything actually working?” This page shows how to read it, and what to do about each answer.

show status — the health picture

innovexus> show status
SERVICE                            STATE       DETAIL
nginx                              running     since 2026-08-25 09:47:04
postgresql                         running     since 2026-08-25 09:47:10
ssh                                running     since 2026-08-25 09:47:03
innovexus-flask                    running     since 2026-08-25 09:47:10
innovexus-next                     initiating  starting up — run 'show status' again shortly
innovexus-relay                    running     since 2026-08-25 09:47:02
innovexus-syslog-processor         failed      see 'show logs innovexus-syslog-processor'
…

--- web ui
https listener :443   open (nginx is accepting connections)
local page probe      HTTP 307 — the application is answering
web ui                running

FAILED: innovexus-syslog-processor
Try 'application restart'; if it fails again, 'show logs <service>' has the reason.

State	Meaning	What to do
running	Active since the shown time.	Nothing.
initiating	Starting up right now.	Wait a few seconds and run `show status` again. Normal briefly after boot or `application restart`.
failed	The service gave up.	`show logs <service>` for the reason, then `application restart`. Persistent failures: capture `show tech` for support.
stopped	Loaded but not started.	Everything stopped + a first-boot note → finish `configure all`. Otherwise `application start`.

The web ui section at the bottom is the ground truth — it checks that something is listening on port 443 and that the application answers a real HTTPS request from inside the appliance:

web ui line	Meaning
`running`	Listener open and the app answered (2xx/3xx). If a browser still fails, the problem is between the client and the appliance — DNS, routing, firewall.
`initiating … or failed` (HTTP 502/503/504)	nginx is up but the application behind it isn’t answering — check the service table above; usually `innovexus-next` or `innovexus-flask` is still starting or has failed.
`failed — run 'application start'`	Nothing is listening on 443 at all. Browsers show “connection refused”. See the walkthrough below.

“Connection refused” in the browser

show status. If it ends with “NOTE: first-boot setup has not completed — the web UI is not served”, that is the whole story: run configure all and finish the wizard. The web UI deliberately does not start until setup passes.
Setup complete but the nginx row isn’t running? show logs nginx 50 — a broken or missing certificate is the usual cause (show certificate to confirm, configure tls to fix) — then application restart.
Web ui says running but the browser still can’t connect? The appliance is fine. Check from the client side: does the FQDN resolve to this appliance (nslookup on the client and show network on the appliance for the address), is a firewall between them blocking 443, are you using https://?

Certificate warnings & login problems

Browser warning on a fresh appliance is expected until the root CA is installed — install steps. Verify fingerprints with show certificate.
“WebAuthn is not supported” — the three requirements, in order: https, FQDN not IP, trusted CA.
Locked out of an account — Recovery & break-glass covers every case.

Feed sync stopped: “no headend API key” (HTTP 401)

Since October 2026 the Innovexus headend delivers CVE/KEV catalogues and threat-IP feeds only to enrolled appliances. If vulnerability or IOC sync reports “refused this appliance (HTTP 401): no valid headend API key” — and retrying never helps — the appliance is simply not activated yet:

Get your organization’s activation code from innovexus.io → Dashboard → Appliance Activation (sign in with your account; the first code is issued automatically).
Enter it on the appliance under Settings → Software Updates → Activation — enrollment and feed access are verified on the spot. Appliances older than v2026.10.21 have no Activation card: update the appliance first (update notices still reach un-enrolled appliances).
A healthy headend health check does not prove feed sync works — the health endpoints are open on purpose so you can tell “my key is wrong” from “the service is down”.
Enrollment later revoked, or key rotated? Re-enroll from the same Settings card with a fresh code.

Network diagnostics from the appliance

innovexus> ping 10.0.0.1          # can the appliance reach the gateway?
innovexus> nslookup ntp1.corp.example   # does DNS resolve from here?
innovexus> traceroute 10.20.0.5  # where does the path break?
innovexus> show time             # clock synchronized? (cert validity!)
innovexus> show disk             # full filesystems cause odd failures

Collecting data for support

One command gathers version, status, network, certificate, disk and recent logs of every core service:

$ ssh [email protected] show tech > innovexus-tech.txt

Attach innovexus-tech.txt to your support case. It contains no passwords or key material.