Sensor

Operate, upgrade, and troubleshoot the Imunify sensor on your Linux hosts — systemd commands, upgrade behavior, and recovery.

The Imunify sensor is the small system service that runs on each of your Linux hosts. Once installed, it sits in the kernel and watches the system calls that matter most for security — file reads, process execution, outbound network connections, and file deletion — and runs each one through the policy you defined in the Panel. Depending on the matching rule, the call is allowed, blocked, or held for your approval. See Your first event for the full list of intercepted system calls and what the Panel shows you when the sensor catches one.

The sensor keeps itself up to date through a maintenance-window upgrade flow. When a new release is published and an administrator pushes it to your host, the sensor stops itself, replaces its binary, restarts, and reports back. There is a short enforcement gap during the swap and no action is required from you. See Upgrades for what an upgrade looks like from your side and how to verify the new version is healthy afterwards.

Pages in this section#

• Install the sensor — the one-line install command, prerequisites, and a checklist that confirms the sensor is connected. (Installation lives in Getting Started so you can finish onboarding without leaving that section.)
• Operation — the day-to-day systemctl and journalctl commands for checking the sensor’s status, reading its logs, and restarting it.
• Upgrades — what happens during a sensor upgrade, how to watch one happen live, and the post-upgrade checks you can run to confirm the new version is healthy.
• Troubleshooting — what to do when the sensor fails to start, can’t reach the server, or refuses to attach because LSM BPF isn’t enabled in the running kernel. The LSM BPF GRUB fix is here.

Pages in this section

• Operation — Day-to-day systemctl and journalctl commands for checking your sensor's status, reading its logs, restarting it, and stopping it cleanly.
• Upgrades — What happens when your sensor upgrades, how to watch one live, and how to confirm the new version is healthy afterwards.
• Troubleshooting — What to do when the sensor fails to start, can't reach the server, or refuses to attach because LSM BPF isn't enabled — including the one-time GRUB fix.