Operation

Day-to-day systemctl and journalctl commands for checking your sensor's status, reading its logs, restarting it, and stopping it cleanly.

The Imunify sensor runs as a systemd service named imunifyai-sensor on every host where you installed it. The four commands below cover everything you will do day to day: checking that it is alive, reading what it has been doing lately, restarting it after a config or rule change, and stopping it when you need to take the host out of enforcement.

These commands need sudo on most hosts. Run them as root or with sudo in front.

Check status#

systemctl status imunifyai-sensor

A healthy sensor shows Active: active (running) with a recent start time. If the status is inactive, failed, or activating and not moving on, jump straight to Troubleshooting.

View recent logs#

journalctl -u imunifyai-sensor --since "10 min ago" --no-pager

Adjust --since to whatever window you need. The sensor logs registration with the server, rule reloads, policy decisions it surfaced, and any errors it ran into. The most useful filter when something is wrong is journalctl -u imunifyai-sensor -p err --since "1 hour ago" — that limits output to the error-level lines.

Restart the sensor#

sudo systemctl restart imunifyai-sensor

Restart the sensor after editing its on-disk config under /etc/imunifyai/sensor/ (the on-disk YAML is the cold-boot fallback — once the sensor reconnects, the Panel’s ruleset is the source of truth). A restart causes a short enforcement gap of a few seconds while the sensor reattaches.

Stop the sensor#

sudo systemctl stop imunifyai-sensor

Stopping the sensor removes all syscall monitoring on that host. Processes the sensor was watching keep running, but without any policy enforcement. Use this only when you know you want enforcement off — for example, during a planned maintenance window. Start it again with sudo systemctl start imunifyai-sensor (or just sudo systemctl restart imunifyai-sensor).