# Monitor a deployment URL: /deploy/operations Watch a deployment from signals the console already shows. The status bar, the sidebar counts, sources, collectors, runs, Hosting and the audit log each point to where to act. Foxborne reports the state of a deployment in the console itself. Start at the status bar, follow the sidebar counts, then read **Sources**, **Runs**, **Hosting** and the audit log. The table at the end of this page maps each signal to what to do. ## Before you start [#before-you-start] * You need the **Admin** role for **Sources**, **Vehicle collectors** and **Hosting**. * Admins and auditors can read the audit log. ## Check a deployment [#check-a-deployment] The status bar runs along the bottom of every screen. From left to right it shows: * The marking, such as **CUI**, when the banner is on. * The environment and the enclave, **AWS GovCloud (US-West)** and **CUI enclave** in the example. Hovering shows the network note, **No outbound internet. Egress is denied at the VPC.** * **No outbound internet**. * The collectors, such as **13 of 15 collectors reporting**: online collectors out of those enrolled. The dot is green only when every enrolled collector is online, and selecting it opens **Vehicle collectors**. * The version, **Foxborne 1.4.2** in the example. * A UTC clock that ticks every second, with a **Z** after the time. Windows narrower than 1,180 px hide **No outbound internet** and the version. * **Incidents** counts the incidents that are not closed. * **Runs** reads *n* **parsing** while imports are being parsed. * **Sources** shows an amber count of sources that need attention or report an error, with a tooltip such as **1 source needs attention**. * **Integrations**, under **Connect**, counts deliveries in the dead-letter queue in amber, with a tooltip such as **1 delivery is in the dead-letter queue**. * **Automations** counts automation runs waiting for a named approver, with a tooltip such as **1 held for approval**. A count disappears at zero. The deployment button at the foot of the sidebar reads **Self-hosted, CUI enclave** in the example, and it opens **Hosting**. Open **Sources**. Each connection shows **Last sync**, a **Today** count of new files and a **Status**: **Healthy**, **Needs attention**, **Paused** or **Error**. Open a row to read its drawer, with the connection details, the activity and any status note. Open the **Vehicle collectors** tab. The summary strip counts **Enrolled**, **Online**, **Buffering offline**, **Offline** and **Clock warnings**, and gives the **Collector version**. **Clock warnings** turns amber when any collector's clock is not synchronized. Each row shows the vehicle's **Clock**, **Local spool**, **Last upload**, **Dropped** and **State**. Open **Runs** and filter by **Needs attention**, which shows quarantined and rejected runs. Each run page states the reason, and **Replace the file** opens **Import files**. On **Hosting**, confirm **Signature verified** beside **Version** and **Healthy** on each row under **Nodes**. Then read the **Last backup** and **Restore tested on** line, the key's last rotation and the **Outbound connections** list. **Outbound connections** opens with four fixed rows: Foxborne, Inc., map and tile services, the identity provider and your SIEM. Below them, each destination whose egress an admin turned on in **Integrations** gets a row. The row names what goes there, the host and the data class. A destination inside your network reads **Internal**, and one reached outside it reads **Outbound** in amber. The panel's footer reads **Egress is off by default, and an admin turns on each one.** The audit log records every import, view, edit, export and administrative change. Filter it by **Administration** to see changes to hosting, access, sources, rules and settings. **Verify chain** recomputes every hash, and the note reads **Chain intact** when every entry matches. ## What a healthy deployment shows [#what-a-healthy-deployment-shows] * The collectors segment of the status bar has a green dot. * The sidebar shows no count on **Sources** or **Integrations**, and each connection reads **Healthy** or a **Paused** state you chose. * **Runs** shows nothing under **Needs attention**. * **Hosting** shows **Signature verified**, every node **Healthy** and a **Last backup** inside your schedule. * The four fixed rows of **Outbound connections** read **None**, **None**, **Inbound** and **Internal**. Every row after them is a destination your program approved. * The audit log reads **Chain intact**. ## Signals and what to do [#signals-and-what-to-do] | Signal | Where it shows | What to do | | -------------------------------------------------- | ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Amber dot on the collectors segment | Status bar | Select it to open **Vehicle collectors**, then read the **State** column. | | Amber count on **Sources** | Sidebar | Open **Sources** and find the row that reads **Needs attention** or **Error**. | | Amber count on **Integrations** | Sidebar | Open **Integrations**, **Delivery ledger**, read why the delivery failed and select **Replay** once the destination answers. See [Egress, data classes and the delivery ledger](/integrate/egress-controls). | | Count on **Automations** | Sidebar | An automation run is **Held for approval**. A named approver reviews it, as [Automations](/integrate/automations) describes. | | **Needs attention** | **Sources**, **Status** | Open the source. The note in its drawer says why, for example a buffering vehicle or an unsynchronized clock. | | **Error** | **Sources**, **Status** | Check **Location**, **Access** and **Credential** in the drawer, then select **Sync now**. | | **Paused** | **Sources**, **Status** | Select **Resume** when the source is ready. Files already imported stay as they are. | | **Last sync** older than the schedule | **Sources** | Compare it with the source's **Schedule**, such as **Poll every 5 minutes**, and select **Sync now**. | | **Buffering** | **Vehicle collectors**, **State** | Wait for the link. Uploads resume on their own, and nothing is lost unless the spool budget fills. | | **Offline** | **Vehicle collectors**, **State** | Read the note under the chip, such as **In maintenance since 24 Sep** in the example. | | **Clock warnings** above 0 or **Not synchronised** | **Vehicle collectors** | chrony on that vehicle has no reachable time source. Fix it, and [align recorded runs by hand](/investigate/align-a-clock). | | **Dropped** in amber | **Vehicle collectors** | The spool budget filled, and the oldest low-priority samples were dropped and marked. Raise the budget in **Collector policy**, **Edit policy**. | | **No SYSTEM\_TIME** beside a version | **Vehicle collectors**, **Collector** | Select **Update**, then **Schedule update**. | | **Quarantined** or **Rejected** | **Runs**, **Needs attention** | Open the run, read the reason and select **Replace the file**. | | **Partial** | **Runs**, **Import** | A source is missing. Findings that depend on it are not produced, and reports list the gap under Limitations. | | *n* **parsing** | Sidebar, **Runs** | Nothing. Parsing finishes on its own. | | **Signature verified** | **Hosting**, **Version** | Confirm the version is the release you installed. | | **Healthy** on each node | **Hosting**, **Nodes** | The application, workers and database rows should each read **Healthy**. | | **Last backup** | **Hosting**, **Nodes** footer | If it is older than your schedule, check the job in your backup service. | | **Restore tested on** | **Hosting**, **Nodes** footer | Test a restore on your schedule, as in [Backups and recovery](/deploy/backup-and-restore). | | **Rotation**, with its last date | **Hosting**, **Encryption key** | Confirm the last rotation matches your key policy. | | **Outbound connections** | **Hosting** | Compare every row with your egress rules. Foxborne, Inc. and map and tile services must read **None**, and each added row must be a destination your program approved. | | **Outbound** in amber | **Hosting**, **Outbound connections** | The destination is reached outside your network. Confirm its data class and host with the admin who turned it on in **Integrations**. | | **License** seats and renewal | **Hosting**, summary | Plan the renewal before the date shown, 30 Jun 2027 in the example. | | **Last sync** under **Provisioning** | **Access**, **Sign-in** | If it is old, check SCIM in your identity provider. Removing someone there removes them here within five minutes. | | **Chain intact** | **Audit log** | Select **Verify chain** on your schedule. The check is recorded as **Verified audit chain**. | | A break-glass sign-in | **Audit log** and your SIEM | Confirm it was planned. Every break-glass sign-in is audited and raises an alert in your SIEM. | ## Next [#next] * [Backups and recovery](/deploy/backup-and-restore) covers the checks after a restore. * [Install an update](/deploy/upgrades) covers the **Updates** panel and collector updates. * [Import statuses and fixes](/collect/troubleshoot-imports) explains each quarantine and rejection reason. * [Statuses and states](/reference/statuses) lists every status the console shows. * [Audit log](/security/audit-log) explains the hash chain, filters and export.