Appliance Settings: Overview, Time, Firewall, Support & Power

On the Athena virtual appliance, Settings → Appliance is where you look after the appliance itself from the web console. You can check its version, health, disk space and network, set the time zone and NTP servers (including an NTP authentication key), open or close the optional firewall ports, collect support bundles and read the logs, and restart, reboot or shut down the appliance. You don't need to open the VM console for any of these. Every change is recorded in the audit log, and the same actions are available over the REST API and in PowerShell.

The tab has these sections, from top to bottom:

Who can use it#

By default only the built-in Admin role has these permissions. A user without appliance.view sees “You do not have permission to view the appliance settings.” A user with appliance.view but not appliance.manage sees the sections read-only, with the note “Read-only: changing this needs the appliance.manage permission.” In the web console, the Reboot appliance and Shut down appliance buttons appear only for users who have both appliance.manage and appliance.power.manage. See Permission Model & Role Bundles.

Appliance overview#

The overview is read-only. The appliance reports its status when you open the tab. Click the refresh button (“Read the appliance status again”) to read it again.

If the appliance does not answer, the section shows “The appliance status is not available: reason”.

Running out of disk#

When the Disk badge turns amber or red, the overview tells you what to do: shut down the appliance, enlarge its virtual disk in your hypervisor, and power it on. When it starts again, the appliance grows into the larger disk by itself. You can shut it down from the Power section.

Time zone and NTP#

Agents, certificates, schedules and audit records all depend on the clock, so set the time before anything else. This matters most on an isolated network, which usually can't reach public time servers.

Time zone#

1. In Time → Time zone, type part of a name in Search time zones (for example London), then pick the zone in the list. The current zone is shown under the list as “Current: zone”.
2. Click Apply time zone.

Zones are IANA names such as UTC or Europe/London. Applying a time zone restarts the Athena web console so it picks up the new zone. The page shows “The appliance is restarting…” and reloads itself when the server is back.

NTP servers#

In NTP servers, enter up to 8 host names or IPv4 addresses, separated by commas (for example ntp1.corp.example,10.0.0.1), and click Save NTP servers. Enter default to go back to the Flatcar OS default time servers. Doing that also removes any NTP key. Changing the NTP servers does not restart Athena.

An entry that is not a valid host name or IPv4 address is refused with “NTP servers must be 1-8 host names or IPv4 addresses, comma-separated (or 'default')”. IPv6 addresses are not accepted. After saving, check the NTP synced badge in the overview. Refresh it after a minute or so.

NTP authentication key#

If your time servers require symmetric-key authentication, set the key after you have saved the NTP servers:

1. Enter the Key ID (1–65535).
2. Pick the Key type: SHA256 (default), SHA512, SHA1 or MD5.
3. Enter the Key: 1–20 printable characters (no spaces and no #), or 22–64 hexadecimal digits.
4. Click Set key.

The key is write-only. Once it is set, the section only shows “Key id (type) is set. The key itself is never shown.” It is never included in the audit log, the server log or any API response. Remove key stops NTP authentication and goes back to unauthenticated time sync. The section then shows “No key set”.

Firewall#

The Firewall section lists the appliance's inbound ports. The two optional port groups are the same switches as the VM console's Network → Firewall menu. A change in one place shows up in the other. Changes take effect at once, and Athena does not restart.

After every change, the section reads the state back from the appliance, so it always shows what is actually in force, even if the change was refused. An older appliance that does not report its firewall switches shows “This appliance does not report its firewall switches. Update it to change them here; until then use the VM console.” For every port Athena uses, see Network Ports & Firewall.

API documentation (Swagger)#

This section turns the interactive REST API documentation on or off and sets the path it is served under. The change is live and Athena does not restart.

• Serve the API documentation switches it on or off. When it is off, the section says “The API documentation is off: both paths answer 404.”
• Path must be 1–40 characters of lowercase letters, digits and dashes, and must not be a path Athena already uses (for example api, login, health, metrics or settings). A path that is taken is refused with “'path' is already used by Athena (/path/...). Choose another path.”
• When it is on, the section shows both addresses: the documentation at /path/ and the OpenAPI document at /path/v1/swagger.json. After a move, the old path answers 404.

If Swagger:Enabled or Swagger:RoutePrefix is also set by an environment variable or on the command line, that value wins. The page then says “Saved, but Swagger:Enabled or Swagger:RoutePrefix is also set by an environment variable or the command line, which wins over this page. Remove it there.” See Configuration Override Warnings and the API Reference.

Support: bundles, server log and OS journal#

Support bundles#

A support bundle collects the appliance's logs and configuration into one file, with secrets redacted, so you can send it to support@sealgrid.ai. Click New support bundle. When it finishes you see “Support bundle name created”, and the bundle appears in the list with its size and creation time. Click Download to save it. Bundles are named athena-support-….tar.gz.

Athena server log#

This lets you read the server log in the browser, with secrets redacted:

• Lines: how many of the latest entries to show (200, 500, 1000 or 5000).
• Minimum level: All levels, Debug, Information, Warning or Error.
• Search the log: show only entries that contain the text.
• Live tail: new entries appear as they are written while the section is open (the view keeps the latest 2,000). The level and search filters still apply.
• Download log: downloads today's server log, redacted (up to its last 50 MB).

For log levels and retention, see Server Logging & Log Retention.

Appliance OS journal#

Show journal displays the last 500 operating-system journal lines of the appliance's Athena services, redacted. Use it when the Athena server itself won't start properly or an appliance-level action (an update, a time change) failed.

Power#

Each button opens a confirmation dialog. The action button stays disabled until you type the word exactly (in capitals). After a restart or reboot the page shows “The appliance is restarting. The web console is unavailable for a few minutes; this page reloads itself when the server is back.” The action is recorded in the audit log before it is sent, so a reboot can't lose the record. For restarting Athena on other kinds of install, see Restarting the Server.

Audit trail#

See the Audit Event Types Reference for every event type.

REST API#

Endpoints return the usual { success, message, data } envelope and answer 404 off the appliance. Invalid input returns 400 with the same message the web console shows. If the appliance refuses a change, the response is 502 with the appliance's reason. If the appliance can't be reached, status, firewall and journal requests return 503.

To authenticate scripts, see API Tokens.

PowerShell#

The Athena PowerShell module wraps the same API.

# Use two internal time servers and authenticate them with key 1
Set-AthenaApplianceNtp -Server ntp1.corp.example, 10.0.0.1
Set-AthenaApplianceNtpKey -KeyId 1 -KeyType SHA256 -Key (Read-Host -AsSecureString 'NTP key')

# Check the clock, the database mode and the free disk
Get-AthenaApplianceStatus | Select-Object ApplianceVersion, Health, DatabaseMode, Timezone, Ntp, Disk

# Open the Prometheus metrics port (trusted networks only)
Set-AthenaApplianceFirewall -Group metrics -Open $true

# Show recent warnings and errors, then take a support bundle and download it
Get-AthenaApplianceLog -Lines 200 -Level Warning
$b = New-AthenaSupportBundle
Save-AthenaSupportBundle -Name $b.Message -Path C:\Temp

Troubleshooting#

Related#

• Appliance Backup & Restore: the Backup, Backup destinations and Restore sections of the same tab.
• Downloads: appliance images, first boot and update bundles.
• Network Ports & Firewall: every port Athena uses.
• Server TLS Certificate: the certificate on port 8443.
• Server Logging & Log Retention: log levels and retention.
• Air-Gapped Operation: running Athena with no internet access.