Troubleshooting & FAQ

Before you open a ticket

Most issues can be narrowed down in a couple of minutes from the console:

1. Dashboard: are Events and Latency non-zero? If everything is zero, traffic is not reaching the appliance.
2. System › Service Control: are lucien.service and lucien-intercept.service active / running? Stop → wait → Start to restart one.
3. System › Hardware Diagnostics: is the FPGA card ONLINE and cool? Is the network link up?
4. TLS Interception: is the destination domain actually on the intercepted list, and is Score prompts on?

Common questions

Clients get certificate warnings for claude.ai / chatgpt.com. The client does not trust Lucien's CA. Download the public certificate (rootCA.pem) from TLS Interception › Step 1 and install it in the client's trust store. Bypassed (non-listed) domains never need this.

A prompt is being blocked that should be allowed. Paste it into the Security Lab and read which detectors fired. If a single policy keyword is the cause, edit that policy (or set it to Testing while you tune), re-test, then promote it back to Active. To soften enforcement globally, turn Block on violation off to run monitor-only.

A prompt is NOT being blocked that should be. Confirm Block on violation is on and the policy's status is Active, not Testing. Check Scoring Config thresholds: a MONITOR verdict is recorded but not dropped.

I edited policies.conf by hand and nothing changed. Restart the Scoring Service from Service Control; the store is read at start.

I changed the IP settings and lost the console. Wait: the 60-second auto-revert restores the previous configuration. Reconnect at the old address.

I set up Jira / ServiceNow sinks but no tickets appear. Configuring sinks does not start the connector. Start lucien-ticket.service from Service Control and confirm the Middleware URL is reachable from the appliance.

Who can make changes? Only members of the lucien-admin group on the appliance. Everyone else is a read-only Viewer; add the account to the group to promote them.

What to include in a ticket

Open a ticket at Submit a ticket and include:

• Appliance hostname and uptime (System › Hardware Diagnostics header).
• The page and action you were performing.
• The verdict from the Security Lab if the issue is a scoring question (classification, action, score, chips).
• Relevant service states from Service Control.
• Any error text shown in the console.

Please do not paste API keys, CA private keys, or passwords into a ticket. We will never ask for them.