Status and logs

Run ./theseus from the stack directory, as root. On servers installed with an install command the stack directory is /opt/theseus.

cd /opt/theseus

Status

sudo ./theseus status

Shows the role and release, every container with its state and health, the health probes (up or DOWN each), and the console address. See Verify the install for what to expect.

sudo ./theseus ps              # containers only
sudo ./theseus doctor          # the preflight checks: Docker, memory, vm.max_map_count, ports

In the console: Admin → Platform health.

Logs of a service

Follow a service's log (the last 200 lines, then live; Ctrl-C to stop):

sudo ./theseus logs wazuh.indexer

Several at once: sudo ./theseus logs ageleia-backend enroll. Without a service name, all services.

Print a fixed number of lines and exit (at most 500):

sudo ./theseus logs-tail patch-service 300

Service names

Area	Services
Gateway	web
Wazuh	wazuh.manager, wazuh.indexer, wazuh.dashboard
Sign-in	keycloak, keycloak-db, keycloak-config
Console	ageleia-backend, ageleia-cron, ageleia-frontend, app-db, redis
Enrolment	enroll
Vulnerabilities and patching	vuln-verify, vuln-verify-feeds, patch-service
Pallas	pallas, pallas-ui, pallas-jira-sync
Scanner	scanner, connector-nuclei
Connectors	connector-cloudflare, connector-defender, connector-intune, connector-sophos
Other	ops, reporting, volumes-init

Only services of enabled modules, and of this server's role, run.

Restart a service

sudo ./theseus restart wazuh.dashboard

This recreates the container (the Wazuh images apply their mounted configuration only on a fresh container). Without a name it recreates all.

sudo ./theseus down     # stop the stack (data is kept)
sudo ./theseus up       # start it

theseus-node

sudo systemctl status theseus-node
sudo journalctl -u theseus-node -n 200
sudo cat /var/lib/theseus-node/progress.log     # the last install's steps

On endpoints

Platform	Wazuh agent	Theseus agent
Linux	/var/ossec/logs/ossec.log; systemctl status wazuh-agent	systemctl status theseus-agent; journalctl -u theseus-agent
macOS	/Library/Ossec/logs/ossec.log	/var/log/theseus-agent.log; LaunchDaemon com.theseus.agent
Windows	C:\Program Files (x86)\ossec-agent\ossec.log	Scheduled task \Theseus\Theseus Agent

Theseus agent configuration: /etc/theseus-agent/ (Linux), /Library/Application Support/Theseus/agent/ (macOS), C:\ProgramData\Theseus\agent\ (Windows).

To run one Theseus agent action locally for diagnostics (as root):

sudo theseus-agent action facts