Troubleshooting


Info

This is a non-exhaustive list of problems or troubleshooting strategies. If you need help please email us at support@sqreen.com or through our web chat. Please don't hesitate, we're here to help!

Increase log verbosity

The Sqreen agent can log messages to a text file. These messages contain warnings about possible abnormal behavior and describe some actions the agent is executing.

Two values in Sqreen configuration control the logging:

Env variable name Role Default value Options
SQREEN_LOG_LOCATION Specify a custom file to write Sqreen logs The terminal Custom filepath
SQREEN_LOG_LEVEL Sqreen logging level WARN INFO, DEBUG

The INFO level is verbose but still suitable for production environments. Only use DEBUG for short periods of time due to the amount of data it generates.

Check if the Sqreen extension loads

The phpinfo() page should list the Sqreen extension. If it does not, there is a problem with the PHP configuration, preventing it from loading the Sqreen PHP extension. Read the manual installation guide.

phpinfo.png

You can retrieve the following information from this table:

  • The extension version.
  • The daemon version.
  • The connection status between the extension and the daemon (on the Connected line, in the first section).

Ensure the agent is running

A sqreen-agent process should be running:

$ ps aux | grep sqreen
sqreen  19456   0,0  0,0  2522856   6656 s013  S+   Ven10     0:55.18 sqreen-agent

If it's not, ensure that you installed the sqreen-agent and configured it to start automatically.

Ensure user tracking happens within the HTTP request's context

If you use the Sqreen SDK to track user login and signup (signup_track or auth_track calls), make sure the SDK makes these calls while the HTTP request is in progress.

The HTTP request contains a lot of required contextual information, and these calls will fail silently, if made while not processing an HTTP request (for example, by pushing user events to an asynchronous queue, and invoking the Sqreen SDK there).

User identification is only reported during an attack

The identify call in the Sqreen SDK only sends information to Sqreen, if, during the same request, it detects an attack.

This is in contrast to signup_track and auth_track calls, which the Sqreen SDK always sends.

Check PHP logs

The PHP errors (in the FPM logs or in the Apache logs) may contain Sqreen related entries.

Check the agent logs

The sqreen-agent logs should inform you that the agent started successfully:

$ cat /var/log/sqreen/sqreen.log
[INFO][2017-09-04 09:42:29,013 #15348.MainThread] sqreen-agent:91 Starting up on TCP socket 0.0.0.0:7773
[INFO][2017-08-31 09:42:29,013 #15348.MainThread] sqreen-agent:104 Sqreen-agent successfully started

Check the agent debug logs

You can configure the agent to report debug logs as well:

$ sqreen-agent --log_level=DEBUG
[INFO][2017-09-04 09:42:29,013 #15348.MainThread] sqreen-agent:91 Starting up on TCP socket 0.0.0.0:7773
[INFO][2017-08-31 09:42:29,013 #15348.MainThread] sqreen-agent:104 Sqreen-agent successfully started

Ensure the extension can reach the daemon

Since the PHP extension must be able to reach the daemon, run the following command (from the PHP host if different from the daemon host) to confirm the setup is correct:

curl 127.0.0.1:7773

If you are using a different host for the daemon and your PHP host, replace 127.0.0.1 with the address and port of the host running the daemon.

The command either:

  • Times out (the connection succeeded)
  • Terminates with a Connection refused error.

A timeout indicates everything is fine, the daemon is listening. A Connection refused error suggests this host cannot join the daemon. Check your network configuration.