Troubleshooting Sophos Linux Sensor
Troubleshoot common errors in Sophos Linux Sensor (SLS).
Download errors
"error": "Unauthorized" when trying to generate the SLS package repository API token.
SLS isn't available with evaluation licenses. Your Sophos Central account must have one of the following qualifying product licenses:
- Intercept X Advanced for Server with XDR
- Intercept X Advanced for Server with MDR Complete
"error": "BadServerResponse" when trying to generate the SLS package repository API token.
SLS needs API credentials created by a SuperAdmin in a Sophos Central Admin dashboard. Ensure the configuration is done in a Sophos Central Admin dashboard and not in a Partner or Enterprise dashboard.
The repository 'https://packages.sophos.com/sophos-linux-sensor/release stable InRelease' is no longer signed.
Your SLS package repository API token is expired. You must generate a new token. See Generate an SLS package repository API token.
Installation errors
Zero policies configured
SLS default detection content isn't installed. You must install both SLS and the default content for detections and alerts to function. See Install Sophos Linux Sensor.
Alert output errors
Unable to start analytics: 400 Failed to validate registration auth token on SLS startup.
SLS logs this error message and fails to start based on invalid token configurations for alert output. See Generate an SLS package repository API token.
Unable to start analytics: error writing alert to MCS on SLS startup.
SLS logs this error message and fails to start when it can't communicate with the Sophos Central MCS API. You must connect to the same MCS region as your Sophos Central account. See Finding your MCS URL.