Troubleshooting
What to do when a run, a push or a rule check does not go as expected.
Running
"signal live" says it needs an elevated prompt
Open Terminal or PowerShell with Run as administrator and run the command again. Signal prints the exact command to use.
Signal is blocked or quarantined
Allow the release's SHA-256 in your security product. See Antivirus and EDR. Do not turn protection off.
A run takes much longer than a minute
Large event logs and many user profiles take longer; so does -shadow. Run with -v to see which step is slow. -timeout 10m bounds each step - the run then says what was not read.
A warning says part of my profile was left out
The run went on without that part. Run signal profile -check <file> to list every problem, fix them, and run again. The run's profile.problems lists what was left out.
The run went to the screen instead of my file
The -o path could not be written - Signal warned and wrote to the screen instead. Check the path and its rights; a folder path must end in \ or exist.
Pushing
The push is refused (wrong key)
The case's key may have been regenerated - a new key replaces the old at once. Put the current key on the host. Five wrong keys from one address lock it out for 15 minutes.
The console is busy or unreachable
Nothing is lost: the push keeps trying for -push-wait, then the run waits in the outbox. Send it later with signal push -push <url> -push-key-file <file>.
The push fails with a certificate error
The host does not trust the console's certificate. Issue the certificate from your organisation's authority, whose root the hosts trust, and check Settings, HTTPS in the console.
The console refuses a run as too new
The run was written by a newer Signal than the console reads. Update the console; a pushed run waits in the host's outbox meanwhile.
Rules
My rule file is left out of a run
A file with any problem is left out, and the others run. Run signal rules -check -rules <dir>: each problem is named, with its line and column for a JSON mistake.
My rule never fires
Check its outcome in the run's rule catalog: not_run means its data was missing (for example, no command lines recorded). If it is clear, compare its selections with a real record's fields - the field reference lists what each evidence type carries.
My rule file is quarantined
It names an attack tool, and your antivirus scanned the plain JSON. Pack it with signal rules -pack -rules <dir> and give the .pack files to the run.