The new docs.trellix.com features a modernized UI and AI-powered conversational search. Content is currently available in English, with additional languages launching in early November 2026. We hope you enjoy the updated experience.

What happens when a Sensor fails?

Prev Next

When a Sensor fails with a Fail-Open module in place, the following events occur in the stated order:

  • The Manager reports a Sensor in bad health or a Port pair is in bypass mode error in the System Health page.

  • The Sensor reboots and the Fail-Open module begins forwarding traffic. All traffic now bypasses the Sensor and flows through the Fail-Open module with minimal traffic disruption (within milliseconds).

  • Upon reboot completion, the Sensor resumes its heartbeat, and one of the following occurs:

    • If the reboot occurred during normal operation as described, the Fail-Open module resumes passing data through the Sensor and the Sensor returns to Inline Fail-Open mode.

    • If the reboot occurred due to an error, the Fail-Open module continues to bypass the Sensor until the administrator manually re-enables Sensor ports in the Manager.

      After the ports are re-enabled, the Fail-Open module resumes passing data through the Sensor and the Sensor returns to in-line mode.

  • The errors on the Manager disappear and normal health is reported.