FAQ

Short answers to the questions that come up most often about installing, running, and using Imunify — plus a few notes about this documentation site itself.

If your question is not here, check the Sensor troubleshooting page (for installation and host-side issues) or the Approvals page (for Panel behavior).

Installation#

My install command finishes with HTTP 410. What happened?#

The install token has already been used. Install tokens are single-use by design — once a host consumes one, it cannot be reused. Generate a fresh token from Add Sensor in the Panel header dropdown and run the new one-line command.

I see HTTP 401 or 403 when running the install command. What now?#

The token has likely expired. Install tokens are valid for 24 hours from the time you generate them. Open the Panel, generate a new token from Add Sensor, and run the freshly-issued install command. If it still fails, double-check that the host’s clock is roughly correct — large clock skew can also cause 401 from token validation.

The sensor fails to start with LSM BPF is not active in the running kernel. What does that mean?#

Your kernel was built with LSM BPF (CONFIG_BPF_LSM=y) but bpf is not in the boot-time lsm= list, so the sensor cannot attach. The fix is a one-time GRUB change and a reboot. The full procedure — including the exact lines to edit and the post-reboot check — is in Sensor troubleshooting → LSM BPF not active.

If instead the installer reports Kernel does not support LSM BPF (CONFIG_BPF_LSM is not set), your kernel is too old or was built without LSM BPF. You need a newer kernel package — see Sensor troubleshooting for the per-distribution commands.

imunifyai-sensor: command not found after a successful-looking install#

The installer’s download step probably failed silently. Check /usr/local/bin/imunifyai-sensor — if it is missing, ask an administrator for a new install token and re-run the install command. Re-running with the same token will fail (see HTTP 410 above).

Where do I find the sensor’s logs?#

journalctl -u imunifyai-sensor --since "10 min ago" --no-pager

Drop the --since window to whatever range you need. For just the errors:

journalctl -u imunifyai-sensor -p err --since "1 hour ago"

See Sensor operation for the full set of day-to-day commands.

Panel and approvals#

The Panel keeps asking me to unlock. Why?#

Event and approval content is stored encrypted with a key derived from your password. After sign-in the Panel needs that key in memory to show you the decrypted content, so it asks for your password once per sign-in session. See Encryption — User view for the long version.

I forgot my password. Can I still read my old events?#

No. A password reset is destructive by design: it destroys the key generation that decrypts your old content, and those rows become permanently unreadable. The audit trail (timestamps, decisions, sensors) survives, but the workload content (paths, arguments, reasons) does not. New events created after the reset are encrypted under your new password and remain readable. See Encryption — User view.

Can an administrator see my events?#

Not the content. An administrator sees the operational metadata — which sensor, which timestamp, which decision, which container — but the content fields (path, arguments, reason) appear as Redacted in their view. See Encryption — User view for what an administrator can and cannot do.

The Approvals page shows an amber banner. Is something broken?#

That banner means the live connection between your browser and the Panel dropped — usually a network blip or a server restart. The Panel reconnects on its own and the banner clears as soon as it does. The cards and counts you see during the outage are the last snapshot we had. See Approvals page.

How do I get approval alerts on my phone?#

Two options, and you can use either:

• Telegram or Discord — link your chat account from Settings → Notifications. The bot DMs you a new approval card with Allow/Deny buttons you can tap. See Notifications.
• Web Push — click the bell icon on the Approvals page and grant notification permission. Works on desktop browsers natively; iOS additionally needs the site to be added to your Home Screen as a PWA.

This documentation site#

How is this site deployed?#

We publish this site as a static build. Each release pushes the rebuilt HTML/CSS to docs.imunify.ai behind our standard web frontend. Publishing the exact deploy pipeline is tracked as future work.

Is there an OpenAPI spec for the REST API?#

We publish the REST API surface in your Panel’s authenticated API documentation — every endpoint, its parameters, and its response shape. A machine-readable OpenAPI document and protobuf definitions for the sensor-to-server stream are tracked as future work; for now, use the human-readable reference and the example curl calls on each endpoint page.