Status and logs

Run ./theseus from the stack directory, as root. On servers installed with an install command the stack directory is /opt/theseus.

cd /opt/theseus

Status

sudo ./theseus status

Shows the role and release, every container with its state and health, the health probes (up or DOWN each), and the console address. See Verify the install for what to expect.

sudo ./theseus ps              # containers only
sudo ./theseus doctor          # the preflight checks: Docker, memory, vm.max_map_count, ports

In the console: Admin → Platform health.

Logs of a service

Follow a service's log (the last 200 lines, then live; Ctrl-C to stop):

sudo ./theseus logs wazuh.indexer

Several at once: sudo ./theseus logs ageleia-backend enroll. Without a service name, all services.

Print a fixed number of lines and exit (at most 500):

sudo ./theseus logs-tail patch-service 300

Service names

Area	Services
Gateway	web
Engine (manager, indexer, SIEM dashboard)	wazuh.manager, wazuh.indexer, wazuh.dashboard
Sign-in	keycloak, keycloak-db, keycloak-config
Console	ageleia-backend, ageleia-cron, ageleia-frontend, app-db, redis
Enrolment	enroll
Vulnerabilities and patching	vuln-verify, vuln-verify-feeds, patch-service
Schildmark Analyst	pallas, pallas-ui, pallas-jira-sync
Scanner	scanner, connector-nuclei
Connectors	connector-cloudflare, connector-defender, connector-intune, connector-sophos
Other	ops, reporting, volumes-init

Only services of enabled modules, and of this server's role, run.

Restart a service

sudo ./theseus restart wazuh.dashboard

This recreates the container (the engine images apply their mounted configuration only on a fresh container). Without a name it recreates all.

sudo ./theseus down     # stop the stack (data is kept)
sudo ./theseus up       # start it

Leitstand node

sudo systemctl status theseus-node
sudo journalctl -u theseus-node -n 200
sudo cat /var/lib/theseus-node/progress.log     # the last install's steps

On endpoints

Platform	Monitoring agent	Schildmark Agent
Linux	/var/ossec/logs/ossec.log; systemctl status wazuh-agent	systemctl status theseus-agent; journalctl -u theseus-agent
macOS	/Library/Ossec/logs/ossec.log	/var/log/theseus-agent.log; LaunchDaemon com.theseus.agent
Windows	C:\Program Files (x86)\ossec-agent\ossec.log	Scheduled task \Theseus\Theseus Agent

Schildmark Agent configuration: /etc/theseus-agent/ (Linux), /Library/Application Support/Theseus/agent/ (macOS), C:\ProgramData\Theseus\agent\ (Windows).

To run one Schildmark Agent action locally for diagnostics (as root):

sudo theseus-agent action facts