A machine shows offline
Offline means the agent's connection is not currently established. It does not mean the machine stopped sending metrics — silence is normal for a machine nobody is looking at, and does not mark it offline.
So if the console says offline, the connection really is down.
Is the agent running?
systemctl status wt-agent
Get-Service WatchtowerAgent
If it is not running, start it and check why it stopped. If it is running, continue.
Was the machine revoked?
A revoked machine is refused when it reconnects, and the agent retries forever without ever succeeding. Its log will show the refusal.
Check the machine's Summary → Security card in the console. If it shows as
not enrolled, either re-enroll it — delete the
credential file and restart the agent with
WT_API_KEY set — or leave it, if revoking was deliberate.
Do IP rules still allow it?
Changing IP rules on a key re-checks machines enrolled through it, and disconnects any that no longer pass. This is the usual explanation for several machines going offline at once shortly after you changed something.
The refusals appear as security events on the Overview page.
Can it reach the broker?
The agent keeps one outbound WebSocket connection open. Networks that allow plain HTTPS sometimes still interfere with long-lived WebSocket connections — particularly captive portals, inspecting proxies, and some corporate firewalls.
Check WT_BROKER_URL is correct and reachable from the machine.
WT_BROKER_URL should be wss:// for any broker that is not on the machine
itself. A plain ws:// against a real endpoint is both insecure and likely to be
blocked or downgraded by proxies and captive portals — which looks exactly like
this symptom.
Does it flap between online and offline?
An agent that repeatedly connects and drops usually means an unstable network path or something closing idle connections — a NAT with a short timeout, or a proxy with an idle limit.
The agent reconnects with a growing delay, so a machine that flaps will look intermittently online rather than steadily offline.
Is it just asleep?
A laptop that suspends disconnects, and shows offline until it wakes. This is correct, if occasionally surprising. The Availability grid is the place to see whether that is the normal daily pattern for that machine.
It shows online but the data is old
That is expected. Detailed metrics only stream while the machine's card is on screen. Open the machine's page and current values arrive within a few seconds.
See No metrics.