Reading Status
Learn what each row of conflux status means, and what to check when two machines are up and cannot reach each other.
Running as Root
conflux status shows the state of the service, the credential and the anchor on this machine. Run it with sudo, or from an elevated PowerShell on Windows:
$ sudo conflux status conflux 1.0.0-pre (f47de0fac83d24489664ca15fc6a317ac9c9f683) linux/amd64 service active (systemd: conflux.service, enabled at boot) mode tun — interface anchor0 taint brhk-2mq9-tzva-6pjs-k4xe-nw7d-qf ipv4 10.128.0.1/24 anchor anchor6btpa3gn6w4stipba4hekzho7caw6srfyy5puvbz7mfanaiept5a credential valid until 2026-10-06T06:35:43Z (8d 4h) renewal failing since 2026-09-26T08:10:00Z: dial tcp: no route to host api https://api.veilnet.com.au telemetry none — nothing is exported until an endpoint is set anchor: …
Without root, the command cannot read /etc/conflux/conflux.json and fails with exit code 1.
The command prints only the rows that apply to this machine. Under anchor:, it prints the output of anchorctl status from the running anchor.
Read the output from top to bottom: the service, the mode, the credential, then any renewal or clock row. Next, run sudo conflux peers and check the DATA column.
When a command fails, conflux prints the error to standard error with the prefix conflux: . To look up a message, see Error Messages.
Status Rows
conflux status prints its rows in the order below. A row marked “Always” appears on every configured machine. The other rows appear only when they have something to report.
| Row | Printed | What it says |
|---|---|---|
conflux … | Always, first | The version, commit, operating system and architecture. conflux version prints the same line. |
service | Always | Whether the boot service is registered and running. The wording differs by platform, as the next table shows. |
uplink | On a machine configured for an uplink | The device and line speed, such as /dev/ttyUSB0:115200 — no host network under it. |
mode | Always | tun — interface anchor0 or proxy — userspace, no host interface. On macOS and the BSDs, it reads the first free utunN, which darwin numbers itself; ifconfig names it (or tunN), unless you chose a unit such as utun7 with --interface. |
exit | Only when this machine serves or uses an exit | serving a way out to the public internet for the realm with --serve-exit, or sending this machine's internet traffic over the overlay with --use-exit. |
taint | Always | The taints in conflux.json, separated by commas. They match what the credential grants. With no taints, the row reads none: the realm's default compartment. The row does not show a move made by another member's Taints order, one of the realm controls. |
peers | Only when you overrode the bootstrap list | The entries you passed to --peers, followed by — overriding the enrolled list. Without this row, the machine uses the bootstrap list in its credential. |
ipv4 | When the machine has an IPv4 address | The machine's IPv4 address, with its prefix length if you gave one, such as 10.128.0.1/24. |
forwarding | One row per network this machine forwards | Each --subnet entry. If another member's Subnets order replaced the list, one row shows the order's networks, who sent it and when: 10.9.0.0/24@lab — set by an order from anchor… at 2026-10-06T09:00:00Z, in place of conflux.json's; --subnet or --no-subnet sets it again. |
serving | One row per proxy spec, in proxy mode | Each published port and its backend, such as 8080=127.0.0.1:3000. |
refused | When the configured taints differ from the ones the credential grants | Every start is refused, and retrying does not help. The row names the granted taints, the configured taints and the fix, which is a new identity. See the taint errors. |
anchor | Once the anchor has started at least once | The full 58-character AnchorID, anchor…. Use this full form with the realm controls, not the short form that peers prints. |
credential | Always | valid until <time> (<time left>) while the credential is current. EXPIRED <time> once it has expired without a renewal. none — nothing enrolled yet before the first enrolment. held, expiry unknown when conflux has not yet recorded the expiry. unreadable: … when conflux cannot read the stored credential. |
clock | When the clock was off by more than a second at the last call to the API | off by 12m3s. Past ten minutes, the row adds — past the 10m anchor allows; fix the clock (timedatectl set-ntp true). See Clock Skew. |
renewal | When the last renewal failed | failing since <time>: <error>, with the error from the last attempt. |
uplink | After the link has been reopened | How often conflux has reopened the link, such as 3 reopens, last 2026-09-08T11:04:12Z. See Uplink Problems. |
binaries | After an upgrade, until the service restarts | stale — conflux was upgraded; run "conflux start" to restart onto the new anchor. Run sudo conflux start to clear it. |
api | Always | The address this machine enrols and renews with: https://api.veilnet.com.au on the instance VeilNet hosts, or the guardian's address on a sovereign network. |
telemetry | Always | The telemetry export set in conflux.json: none — nothing is exported until an endpoint is set, or the endpoint and the signals, such as guardian.example.gov:4317 — metrics, logs. |
set by … | Under telemetry, when the running daemon reports what set its export | This row has no name in the first column. set by anchorctl export — an override, discarded at the next restart means that someone changed the export by hand on the running daemon. The next restart restores the settings in conflux.json. |
anchor: | Always, last | The output of anchorctl status from the running anchor, or not running. The anchor documentation explains its fields. |
| Platform | When the service is registered and running |
|---|---|
| Linux | active (systemd: conflux.service, enabled at boot) |
| macOS | running (launchd: org.veilnet.conflux, at boot) |
| Windows | running (service: conflux, automatic at boot) |
| FreeBSD | running (rc: conflux, enabled at boot) |
| OpenBSD | running (rc.d: conflux, enabled at boot) |
| macOS, Windows or the BSDs, stopped | installed, not running (…) |
| Any platform, never registered | not installed |
On Linux, the first word of the service row is the systemd state of the unit. It reads inactive after conflux down, and failed once the supervisor has given up. To learn when that happens, see Service and Logs.
Unconfigured Machines
On a machine that has never run conflux up or conflux proxy, conflux status reports that there is no configuration and exits with code 78:
$ sudo conflux status conflux 1.0.0-pre (f47de0fac83d24489664ca15fc6a317ac9c9f683) linux/amd64 service not installed config none — this machine has never been configured conflux up join with a network interface conflux proxy 8080=127.0.0.1:3000 publish a port, no interface needed $ echo $? 78
To configure the machine, run one of the two commands that the output suggests.
Unreachable Peers
When two machines are up but cannot reach each other, run these checks in order on the machine that gets no reply. The cause is usually a taint mismatch, which the third check finds.
Run the checks in order on the machine that cannot reach the other. Each answer on the right names what to fix. If every check passes, the two machines are connected.
Peers find each other through the bootstrap node. This takes fifteen to sixty seconds after the second machine starts, so a first
pingthat fails is not yet a fault.
Failing Renewals
When a renewal fails, conflux status shows a renewal failing since … row with the last error. What happens next depends on whether the credential is still valid:
| State | What happens |
|---|---|
| Valid, renewal failing | Only a warning. The anchor keeps running, and conflux retries every minute. |
Expired, renewal failing (credential EXPIRED) | A running anchor stays up, but peers refuse every new handshake from it. After a restart, the anchor does not start at all. The supervisor keeps retrying, with a backoff of up to thirty seconds, and tries to renew before each attempt. |
| Expired, renewal succeeds | The usual case for a machine that was off for a while. The machine renews on its next start and keeps its AnchorID and address. |
The service log shows the same two failing states:
- While the credential is valid:
could not renew: <error>, thenthe credential is still valid for <time>; conflux will keep trying. - Once it has expired:
could not renew, and the credential expired <time> ago: <error>, thenanchor will not start on it, so conflux tries again until this succeeds.
To recover, fix the problem that the error names. It is often the machine's connection to the API, or the clock. Then fetch and install a new credential without a restart:
$ sudo conflux renew
If the credential has expired and the anchor has restarted, the supervisor is already retrying. To make it retry immediately, run sudo conflux start. A machine that you leave stopped needs no action, because it renews on its next start.
- Conflux never enrols again to get around a failed renewal. A new enrolment would create a new identity, and peers that knew the old identity would lose track of the machine.
- A fixed-term credential cannot be renewed. Once it expires, replace it. The service shows as failed until you do.