One of my agents has stopped updating in the CrowdSec Console for just over 36 hours. The machine was previously working and is still shown as enrolled and healthy, but the console isn’t receiving updates.
Current state:
- Agent + bouncer running fine
- Logs are being parsed and alerts generated
- cscli machines list shows it as enrolled, healthy, and heartbeat recent
- cscli capi status and cscli lapi status both OK
- cscli console status shows alert sharing enabled
- No recent errors in journal or log output related to console/capi/enrolment
So it looks like the agent thinks it’s enrolled and active, but the console isn’t getting or displaying updates.
Haven’t done yet (to avoid breaking state):
- Re-enrol
- Delete or recreate machine
- Reset local state
Could someone advise the next safe step to re-link it without losing data or creating a duplicate entry?
Happy to DM machine ID + workspace details.
Thanks!