Troubleshoot Offline Collector

Symptoms

AssurIQ raises AIQ-COL-001 when a collector has missed its expected heartbeat interval. The site's Collectors panel shows a red status dot, the last-seen timestamp stops advancing, and discovery, scans and evidence collection for that site pause until it recovers.

Quick checks

1. Confirm the host is powered on, not suspended, and reachable on the local network.
2. Check the collector service status locally (see commands below).
3. Confirm outbound connectivity from the host to ingest.assuriq.io on port 443.
4. Check whether a proxy, firewall rule or EDR policy changed recently at that site.
5. If the service is running and connectivity is fine, check certificate validity and re-enroll if needed.

Service checks by operating system

Run the check that matches the collector's form factor.

sc query AssurIQCollector

Expected state is RUNNING. If STOPPED, start it with sc start AssurIQCollector and check the Windows Event Log (Application) for the AssurIQCollector source.

systemctl status assuriq-collector

If inactive or failed, run journalctl -u assuriq-collector -n 100 for the crash reason, then systemctl restart assuriq-collector.

docker logs --tail 100 assuriq-collector

If the container has exited, check docker ps -a for the exit code and confirm the container was started with --network host and a valid AIQ_ENROLL_TOKEN or persisted certificate volume.

Connectivity

The collector only needs outbound 443. Confirm the host can reach the ingest endpoint directly or through its configured proxy.

curl -v https://ingest.assuriq.io/healthz

A TLS handshake failure or connection timeout usually points to a firewall rule change, a new web filtering policy, or an ISP outage at the site. If the site uses an explicit proxy, confirm the collector's proxy configuration still matches the current proxy host, port and credentials.

• Proxy Configuration
  Route collector traffic through an explicit or PAC-defined proxy.

Certificate and mTLS rotation

Each collector holds a unique client certificate issued at enrollment and rotated automatically before expiry. If the host clock is significantly wrong, or the collector was offline through a scheduled rotation window, the certificate can become invalid.

• Confirm the host's system time is correct (NTP sync enabled).
• Check the local collector log for TLS handshake or certificate errors.
• If the certificate is expired or corrupted, the collector cannot self-heal and must be re-enrolled.

Re-enrollment

If the service is healthy, connectivity is confirmed, and the collector still will not report a heartbeat, generate a new enrollment token for the site and re-run the install command for the host's form factor. Re-enrollment reuses the same collector identity in AssurIQ and does not create a duplicate record.

• Enrollment Tokens
  Create, scope, expire and revoke enrollment tokens.
• Deploy Your First Collector
  Install a collector, enroll it with a token and confirm the first heartbeat.

Escalation

If the collector remains offline after a full check cycle (service restarted, connectivity confirmed, certificate valid or re-enrolled), open a support ticket referencing AIQ-COL-001, the collector ID, and the timestamps of the last known-good heartbeat.

Reference

• AIQ-COL-001Collector offline
  The collector has not sent a heartbeat within the expected interval. Discovery, scans and evidence collection for its sites are paused.

• Collector health states explained
  Healthy, Degraded, Offline, Enrollment Pending, Update Required and Revoked — what each state means and what to check.
• mTLS and Connectivity
  Outbound-only mutual TLS, endpoints to allow-list, certificate rotation.
• Proxy Configuration
  Route collector traffic through an explicit or PAC-defined proxy.