Troubleshooting
Use the symptom table to check authentication, identifiers, query times, and telemetry delays.
| Symptom | Check |
|---|---|
| HTTP 401 or 403 from the API | Confirm the token is current and has read access to the selected namespace. A system query needs separate tenant-wide access. |
| HTTP 404 from API inventory | Confirm discovery is enabled and use the load balancer’s ves.io/app_type label. |
| HTTP 404 from API statistics | Use the telemetry XCSH_VIRTUAL_HOST returned by the service graph. |
| HTTP 500 from service graph | Regenerate ordered Unix time values. A reversed window can return HTTP 500. |
| Empty metric series | Confirm the timer is active, widen the window, and allow up to ten minutes for rollup. |
| No WAF block event | Confirm the HTTPS request reached this load balancer, the WAF is in blocking mode, and the query uses the correct virtual host. |
| TLS or DNS failure | Confirm the delegated zone, managed record, certificate readiness, and load balancer domain. |
Check that the current time window is ordered:
printf 'start=%s end=%s\n' "$XCSH_START_TIME" "$XCSH_END_TIME"test "$XCSH_START_TIME" -lt "$XCSH_END_TIME"Refresh the time window before retrying a stale query.