This is a non-exhaustive list of problems or troubleshooting strategies. If you need help please email us at or through our web chat. Please don't hesitate, we're here to help!

Increase log verbosity

The Sqreen agent can log messages to a text file. These messages contain warnings about possible abnormal behavior and describe some actions the agent is executing.

Two values in Sqreen configuration control the logging:

Env variable name Role Default value Options
SQREEN_LOG_LOCATION Specify a custom file to write Sqreen logs The terminal Custom filepath

The INFO level is verbose but still suitable for production environments. DEBUG should only be used for short periods of time due to the amount of data it generates.

Check if the Sqreen extension is loaded

The phpinfo() page should list the Sqreen extension. If it's not, then PHP was probably not correctly configured to load the Sqreen PHP extension. Read the manual installation guide.


You can retrieve the following information from this table:

  • The extension version.
  • The daemon version.
  • The connection status between the extension and the daemon (on the Connected line, in the first section).

Ensure the agent is running

A sqreen-agent process should be running:

$ ps aux | grep sqreen
sqreen  19456   0,0  0,0  2522856   6656 s013  S+   Ven10     0:55.18 sqreen-agent

If it's not, ensure the sqreen-agent was installed and configured to start automatically.

Ensure user tracking happens within the HTTP request's context

If you are using the Sqreen SDK to track user login/signup (i.e. signup_track, or auth_track calls), make sure these calls are made while the HTTP request is being processed.

The HTTP request contains a lot of required contextual information, and these calls will fail silently, if made while not processing an HTTP request (e.g. by pushing user events to an asynchronous queue, and invoking the Sqreen SDK there).

User identification is only reported during an attack

The identify call in the Sqreen SDK will only send information to Sqreen, if - during the same request - an attack has been detected.

This is in contrast to signup_track and auth_track calls, which are always sent.

Check PHP logs

The PHP errors (in the FPM logs or in the Apache logs) may contain Sqreen related entries.

Check the agent logs

The sqreen-agent logs should inform you that the agent was successfully started:

$ cat /var/log/sqreen/sqreen.log
[INFO][2017-09-04 09:42:29,013 #15348.MainThread] sqreen-agent:91 Starting up on TCP socket
[INFO][2017-08-31 09:42:29,013 #15348.MainThread] sqreen-agent:104 Sqreen-agent successfully started

Check the agent debug logs

You can configure the agent to report debug logs as well:

$ sqreen-agent --log_level=DEBUG
[INFO][2017-09-04 09:42:29,013 #15348.MainThread] sqreen-agent:91 Starting up on TCP socket
[INFO][2017-08-31 09:42:29,013 #15348.MainThread] sqreen-agent:104 Sqreen-agent successfully started

Ensure the extension can reach the daemon

Since the PHP extension must be able to reach the daemon, run the following command (from the PHP host if different from the daemon host) to confirm the setup is correct:


If you are using a different host for the daemon and your PHP host, replace with the address and port of the host running the daemon.

The command either:

  • Timesout (the connection was successfully performed)
  • Terminates with a Connection refused error.

In the case of a timeout, everything is fine, the daemon is listening. In case of a Connection refused error, it seems this host cannot join the daemon. Check your network configuration.