Einführung
When something's wrong with a Level agent — a device showing offline, remote connections not working, or an automation failing — the diagnostic command and the automation step output are the two places to start. Level's watchdog handles keeping the service running automatically, so in most cases you're looking for a connectivity or configuration issue, not a service problem.
Running the Diagnostic Command
If a device is showing offline in Level but is actually powered on and connected, run --check on the affected device. It outputs a structured report covering the agent, system info, Level service state, connection checks, sleep settings, and active operations.
Windows |
|
macOS |
|
Linux |
|
Reading the Output
The output is divided into sections. Here's what each one tells you:
Agent — ID, version, build date, platform, and internal state. Confirms the agent is installed and which version is running.
System — Hostname, OS, architecture, and last boot time. Useful context when sharing output with support.
Level checks — Shows whether the agent service and watchdog task are in the expected state (
Running/Ready).Connection checks — The most important section for offline issues. Shows the status of each required endpoint:
Check | What it tests |
| Basic internet-reachable connectivity check |
| Agent's primary communication channel to Level |
| Uptime reporting endpoint |
| WebSocket connection status ( |
If any of these show a failure instead of OK / Connected, that's your root cause.
Sleep settings — Shows the device's current sleep/timeout configuration. Aggressive sleep settings (especially short DC timeouts) can cause devices to appear intermittently offline.
Activity status — Shows active operations currently running on the agent, such as
Remote Management.
Triage by What You See
Connection checks show failures (online.level.io, agents.level.io, etc.):
The agent can't reach Level's servers. The cause is almost always AV/EDR blocking the agent or a firewall blocking outbound traffic. See AV/EDR False Detections and Offline Troubleshooting.
Connection checks are OK but remote sessions are on relay instead of P2P:
The agent can communicate with Level, but direct peer-to-peer connections aren't working. See Relay/P2P Troubleshooting.
Level checks show the service or watchdog not in expected state:
Something is actively preventing the agent from running — most likely AV/EDR quarantine. See AV/EDR False Detections.
Automation or Script Errors
For automation issues, --check won't help directly. Instead, open the automation run and expand the failed step. Each step shows its full output — exit codes, error messages, and any script output written to stdout or stderr.
In most cases the error in the step output identifies the cause without needing to go further.
Contacting Support
If you can't identify the cause from --check or the step output, Level Support can dig in with you. When you reach out, include:
The full output from
--check(for offline/connectivity issues)The automation name and the specific step that failed (for automation issues)
The full error message from the step output
Häufig gestellte Fragen
Level shows a device as offline but I can ping it and reach it via other tools. Where do I start? Run
--checkon the device and look at the Connection checks section. Ifonline.level.iooragents.level.ioshow failures, the agent can't reach Level's servers — most likely AV/EDR or a firewall. If all connection checks pass, send the full output to Level Support.An automation step failed. How do I see what went wrong? Open the automation run and expand the failed step. The full output, including any error message or exit code, is shown there. That's usually enough to identify the problem without needing support.
The device goes offline periodically, then comes back on its own. What causes that? Usually AV/EDR interference — some products block Level intermittently after signature updates without generating a visible alert. Running
--checkwhile the device is in the offline state gives you the clearest picture. See AV/EDR False Detections if the connection checks show failures.