Confirm the Root Lock kernel is actually running
Overview: Initial setup confirms that Root Lock by HeartSuite is active and the machine is ready for allowlisting. Auto-added allowlist entries are the programs that executed at boot and shutdown; the queues hold the rest. Installer and initial setup logs are in /var/log/heartsuite/ and accessible via provider serial console (AWS, Linode, Hetzner, and others).
What complete looks like
When you launch a pre-installed Root Lock cloud instance, the Dashboard confirms initial setup is complete on first boot and suggests the next step. Use the serial console to cat /var/log/heartsuite/install.log if you need the installer or initial setup logs from the image build.
After completing the local installation process (download, GRUB preparation, kernel install, and unattended initial setup), the Dashboard appears. The already-added entries are boot and shutdown programs. From here, Cloud Path and Local Path proceed identically.
The Dashboard shows the same state on a fleet host after Cloud Path or Local Path initial setup. Applying allowlists across many hosts is Central Policy.
What the Dashboard shows
When initial setup is complete, the Dashboard confirms:
- Protection state (indicator at the top): Shows SETUP MODE: Root Lock is active, logging only, nothing blocked
- Checklist: Starts at Program Allowlisting (initial setup is already done; it is not a Dashboard row)
- Status line at the bottom: Shows the kernel indicator (“Root Lock” or “maintenance kernel”), current mode, time in mode, and lockdown status
- Suggested Next Step: Directs you to begin program allowlisting
What is already on the allowlist
When initial setup is complete, the auto-added entries are the programs that executed at boot and shutdown. The review queues hold the rest. Do not approve one-shot tests you do, install helpers you run, or other programs you will not keep. Allowlisting Basics covers approve and skip.
After Lockdown, add software through Protecting During Maintenance.
Protection state
The protection state indicator appears as a full-width, high-contrast bar at the top of the Dashboard. Its content depends on the current system state:
| State | Indicator |
|---|---|
| Setup Mode | SETUP MODE: logging only, nothing is blocked |
| Lockdown (no immutable seal) | LOCKDOWN: immutable seal not applied |
| Lockdown + sealed | Lockdown applied |
| maintenance kernel | maintenance kernel: Root Lock not active. No blocking. No logging. No backups. |
Status line at the bottom
Below the protection state indicator, a status line shows:
Root Lock Setup Mode active for 3d 7h: logging only, nothing is blocked
- Kernel indicator: “Root Lock” (when the Root Lock kernel is active) or “maintenance kernel” (when booted to the recovery kernel with no Root Lock loaded)
- Mode: Setup Mode or Lockdown, with time in current mode
- Lockdown:
—(Setup Mode),Not applied(Lockdown without immutable seal), orApplied(Lockdown with immutable seal)
What to do if verification fails
If initial setup does not complete, or the indicator at the top shows a state you did not expect (for example, “maintenance kernel” when you intended to boot Root Lock):
Check the status line at the bottom of the Dashboard. It shows the kernel indicator (“Root Lock” or “maintenance kernel”). If it shows the maintenance kernel, reboot and select the Root Lock kernel from the GRUB menu.
Check that the Root Lock systemd service is running:
systemctl status heartsuiteFor local installations, the Dashboard appears only after unattended initial setup finishes. If it has not appeared, check
/var/log/heartsuite/install.logon the serial console. There is no System Setup screen.If the Dashboard shows “UNKNOWN STATE: protection status cannot be determined”, follow the Suggested Next Step displayed on the Dashboard.
If the issue persists, contact support at support@heartsecsuite.com.
For advanced troubleshooting, you can verify kernel-level activation directly:
dmesg | grep HEARTSUITE
The Dashboard provides this same information in the protection state indicator and the status line at the bottom.
With initial setup confirmed, follow the Dashboard’s Suggested Next Step to begin program allowlisting.
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.