SignLogger CLI Troubleshooting Guide

This guide explains how to resolve problems you may encounter on a SignLogger appliance, step by step, from the command-line interface (CLI). For a detailed description of the commands, see the SignLogger CLI User Guide.

How to use this guide

1. Find your problem in the Symptom → section table at the end, or go to the relevant section from the table of contents.
2. Each problem consists of four parts: - Symptom: What do you see? - Check: Which command do you use to look? - Possible cause: Why does this happen? - Solution: What do you do, step by step?
3. Type the commands in the code boxes exactly as shown. Replace the placeholders inside < > with your own values; do not type the < and > characters.
4. Before commands that make changes, type enable to switch to write mode. Configuration changes are applied with execute commit.

0. Before you begin

0.1 Where to connect from

• If the network configuration is broken or SSH does not open, log in from the hypervisor console or from the appliance's screen and keyboard connection. The console is independent of the network.
• On console login, too, you use your management panel administrator account and password.
• A mandatory password change blocks SSH login but does not block console login.

0.2 Read mode and write mode

• If the prompt ends with >, you are in read mode. get, show and most diagnose commands work here.
• For execute commands and for writing configuration, type enable; the prompt becomes #.
• If you see the error bu komut için privileged mode gereklidir, type enable and repeat the command.

0.3 A setting change = candidate + commit

A change you make with config … end is not applied immediately; it is written to the candidate configuration. To apply it:

get system config pending
execute commit <açıklama>

The most common cause of "I changed it but nothing happened" is forgetting the commit.

0.4 The first five minutes (for every fault)

get system status
diagnose health
diagnose health scan
get system service list
get hardware disk usage
get system config pending

These outputs usually show at which layer the problem lies: network, service, disk, or a pending configuration.

---

1. Connection and login

1.1 Cannot establish an SSH connection

Symptom: ssh times out or the connection is refused; no password prompt appears.

Check (from the console):

diagnose ip address list
diagnose ip route list
get system session listen
get router status
get router zone list

Possible cause:

• The appliance's IP address is wrong or the interface is down.
• If the gateway (router) module is enabled, the SSH service is disabled in the zone of the interface you are connecting to.
• You are connecting from the wrong network, or a firewall in between is blocking SSH.

Solution:

1. With diagnose ip address list, verify that the address you are connecting to exists on the appliance and that the interface is UP. If the address is wrong, go to 2.1.
2. If Status in the get router status output is AKTİF, use get router zone list to check whether SSH appears in the SERVICES ALLOWED TO THE APPLIANCE column of the zones. If it does not, enable SSH in the zone:

   enable
   config system zone
   edit <zone-no>
   set svc-ssh enable
   next
   end
   execute commit Zone SSH erişimi açıldı
   

3. Is the appliance listening on SSH? :22 should appear in the get system session listen output.

1.2 Password is not accepted

Symptom: The password is rejected on SSH or console login.

Check: The message displayed during login (shown depending on your SSH client). Look at the login records in the panel; see the account's status with an authorized account using get system admin list.

Possible cause and solution:

Message	Cause	Solution
Kullanıcı adı ya da parola yanlış	The password is wrong, or the username was derived incorrectly.	The CLI username is derived from the panel username: if it is an email address, the part before @, in lowercase (e.g. Ali.Veli@firma.com → ali.veli). The password is the same as in the panel.
Çok fazla hatalı deneme; hesap geçici olarak kilitli	The attempt limit was exceeded (the counter is shared with web login).	Wait for the lockout period to expire.
Hesap devre dışı	The panel account is disabled.	Have an authorized administrator enable the account in the panel.
Bu hesabın komut satırı erişimi kapalı	CLI access has been disabled for the account.	Contact your support team or use another authorized account.

If two panel accounts map to the same CLI name (e.g. ali@firma.com and ali@baska.com), you cannot log in with that name. Change the username of one of the accounts in the panel.

1.3 "Change your password from the web panel first"

Symptom: SSH login is rejected with this message.

Possible cause: The default password from the installation is in use, a password change has been made mandatory, or the password has expired.

Solution:

1. Log in to the web panel and change your password on the My Profile page.
2. Connect with SSH using the new password.
3. If you cannot reach the panel, log in from the console; the console is exempt from this rule.

1.4 "Authentication service unreachable"

Symptom: On SSH login, the message Kimlik doğrulama hizmetine ulaşılamıyor; daha sonra yeniden deneyin.

Possible cause: The management service that verifies the password (the panel) is not running or is restarting.

Solution:

1. Wait a minute and try again (an update or restart may be in progress).
2. If it persists, log in from the console and follow 3.2.

1.5 Login succeeds but the session closes immediately

Symptom: The password is accepted, then the connection closes with this message:

Erişim reddedildi: bu cihazda CLI yalnız etkin panel yöneticileri içindir; hesabın panel kaydı yok ya da hesap/CLI erişimi kapalı (<kullanıcı>)

Possible cause: The account has no panel record, is disabled, or its role has no permission that the CLI recognizes.

Solution: Have an authorized administrator check that the account is enabled and that its role carries at least one permission. For role classes, see the Permissions section of the user guide.

1.6 After a while every command returns an error

Symptom: Hata: yetki denetlenemedi: session suresi doldu: idle-timeout (or session bulunamadi).

Possible cause: The session was idle for 30 minutes or reached the 12-hour maximum duration.

Solution: Type exit and reconnect.

1.7 The CLI Console inside the panel does not open

Symptom: The CLI Console button is missing from the top bar, or the console shows an error message.

What you see	Cause	Solution
The button is not visible	The account does not have the edit_security_settings permission.	Use SSH or the console, or have the permission added to your role.
Hesabınızın CLI erişimi kapalı.	CLI access has been disabled for the account.	Contact your support team.
CLI kullanmadan önce Profilim sayfasında parolanızı değiştirin. …	A password change is mandatory.	Change the password from My Profile and click Reconnect.
Konsol oturumu sınırına ulaşıldı. Daha sonra deneyin.	20 consoles are open on the appliance.	Close unused consoles, then try again.
Konsol oturumu sona erdi. Yeniden bağlanın.	No activity for 15 minutes, or the panel session ended.	Reconnect.
CLI başlatılamadı. Sistem yöneticinize başvurun.	The CLI could not be started.	Log in via SSH or the console and follow 3.2.
Tek satır ve en fazla 4096 bayt uzunluğunda komut girin.	The line is too long, or multiple lines were pasted.	Send the commands one at a time.

1.8 A command returns a "no permission" or "privileged mode" error

Symptom:

Hata: bu komut için privileged mode gereklidir. 'enable' komutu ile yetki yükseltin
Hata: yetki yok: <komut> (hesabın <izin> izni yok)
Hata: yetki yok: <komut> (hesabın yazma izni yok (salt görüntüleme))
Hata: yetki yok: <komut> (rol bu komut icin yetkili degil)
Hata: privileged mode dogrulamasi basarisiz
Hata: yetki reddedildi (…): …

Check:

get system auth me
get system admin-role permissions <rol-adı>

Solution:

• privileged mode gereklidir → type enable.
• privileged mode dogrulamasi basarisiz → your account has no write permission at all (edit_…, create_…, delete_…); you cannot switch to write mode.
• hesabın <izin> izni yok → have the permission shown in parentheses added to your role.
• rol bu komut icin yetkili degil → the command requires a higher role class (e.g. execute reboot requires the management class).
• yetki reddedildi (…) → the CLI allowed the command but the panel rejected the operation; read the reason in the message. Some operations can only be performed with accounts in the root domain.

---

2. Network

2.1 The appliance has no IP address, or the wrong one

Symptom: The appliance cannot be pinged, and the panel and SSH do not open.

Check (from the console):

diagnose ip address list
get system interface
diagnose hardware nic

Possible cause: No address was assigned to the interface, a wrong address was assigned, the cable is not plugged in, or the network adapter is not attached on the virtual machine.

Solution:

1. If the diagnose ip address list output says Çekirdekte hiç ağ arayüzü yok (yalnız lo)., check the virtual machine's network adapter settings in the hypervisor.
2. If the interface is DOWN, check the cable or the virtual switch connection (diagnose hardware nic shows the link status and error counters).
3. If the address is wrong, correct it:

   enable
   config system interface
   edit <port>
   set addr-mode static
   set ip <ip-adresi>
   set prefix <önek>
   set gateway <ağ-geçidi>
   next
   end
   get system config pending
   execute commit Yönetim adresi düzeltildi
   

Type edit and press TAB; the ports on the appliance are suggested. For DHCP, use set addr-mode dhcp. 4. Verify the new address with diagnose ip address list.

If it still does not work: If the commit result contains a warning or error, review the steps with get system commit list and get system commit show <no>. A VLAN or a new interface cannot be created this way; use the panel's Network Settings screen.

2.2 The gateway or another network is unreachable

Check:

diagnose test ping
diagnose ip route list
diagnose netlink route <hedef-ip>
diagnose netlink arp
diagnose hardware nic

Possible cause and solution:

• diagnose test ping → default gateway bulunamadı: there is no default route. Add a route with set gateway <ağ-geçidi> in config system interface or with config router static, then execute commit.
• The gateway shows as FAILED/INCOMPLETE (diagnose netlink arp): the gateway is not responding; it is down, on another VLAN, or on the wrong subnet. Check the address/prefix and the VLAN setting.
• If the diagnose hardware nic error counters are greater than zero, suspect a cable, SFP, or duplex mismatch.
• If a specific network is unreachable, look at the selected route with diagnose netlink route <hedef-ip>; if it is wrong, correct it with config router static.

To clear the ARP table and try again: enable and execute clear system arp table.

2.3 Names cannot be resolved (DNS)

Symptom: DNS lookup başarısız, the update or license server cannot be reached by name; diagnose health scan reports DNS calismiyor.

Check:

get system dns
diagnose test dns <alan-adı>
diagnose test dns <alan-adı> <dns-sunucusu>

Possible cause: No DNS server is defined, it is wrong, or access to the DNS server is blocked.

Solution:

1. If the name resolves with a specific server but not with the system resolver, correct the appliance's DNS setting:

   enable
   config system dns
   set primary <dns-1>
   set secondary <dns-2>
   end
   execute commit DNS düzeltildi
   

2. If it does not resolve with any server, test access to the DNS server: diagnose test port <dns-sunucusu> 53 (TCP) and, for the network path, diagnose test path <dns-sunucusu>.

Note: The diagnose health scan DNS check uses a fixed public domain name. On networks closed to the internet this finding can be misleading; run diagnose test dns with your own domain name.

2.4 Cannot connect to a remote server (TCP)

Examples: update server, KAMU SM, SMTP, LDAP, external syslog.

Check:

diagnose test port <sunucu> <port>
diagnose test path <sunucu> <port>
diagnose ssl connection <sunucu>:<port>

Reading the results:

diagnose test port result	Meaning
AÇIK (<ms> ms)	The connection was established. The problem is at the application layer (credentials, certificate, settings).
BAŞARISIZ: bağlantı reddedildi (port kapalı)	The target is reachable but there is no service on that port.
BAŞARISIZ: zaman aşımı (süzülüyor ya da ulaşılamıyor)	A firewall in between is dropping the packets, or the target is down.
BAŞARISIZ: hedefe yol yok	The appliance has no route to this target. 2.2.

diagnose test path tests the steps in order and reports the first problematic step with Ilk kopan halka: <adım>. An HATA result on the ICMP step is not a fault by itself; if the TCP step succeeds, the service is reachable.

For TLS problems, diagnose ssl connection shows the certificate chain and validity dates.

If the source address must leave from a specific interface, set the source address first: execute ping-options source <adres> or execute traceroute-options source <adres> (write mode is required).

2.5 Small pages open, large ones hang

Check:

diagnose test mtu <hedef>

Possible cause: The path MTU is smaller than 1500 (PPPoE, VPN) and large packets cannot be fragmented.

Solution: If Olculen yol MTU is smaller than 1500, enable TCP MSS clamping on the network device in between, or set the interface MTU according to the path MTU. The Hicbir boyut gecmedi warning may indicate that the target blocks ICMP; try with another target.

2.6 The clock is wrong or NTP does not synchronize

Symptom: Log timestamps have drifted, and signing or TLS connections report clock errors.

Check:

get system time
diagnose sys ntp status
get system ntp

Possible cause and solution:

• ntpsync is disabled (the clock was set manually): execute time set turns NTP off. Enable it again:

  enable
  config system ntp
  set ntpsync enable
  set server <ntp-1> <ntp-2>
  end
  execute commit NTP açıldı
  

• Sources are ulaşılamıyor: check UDP 123 access to the NTP server on the network side; test the server name with diagnose test dns <sunucu>.
• zaman servisi sorgulanamadı: the time service is not responding; check its status with get system service status chronyd and report it to the support team.
• If the time zone is wrong: config system global → set timezone Europe/Istanbul → end → execute commit.

2.7 The panel does not open, but SSH works

Check:

get system trusted-host list
get router zone list
get system component panel

Possible cause:

• The trusted address list does not cover the address you are connecting from. If the list is not empty, only the addresses on the list can reach the panel.
• If router mode is enabled, HTTPS is disabled in the zone.
• The panel service is not running (3.2).

Solution (trusted address):

enable
config system trusted-host
edit <boş-bir-no>
set address <sizin-ip-adresiniz>/32
set comment "Yönetici"
next
end
execute commit Güvenilir adres eklendi

To enable HTTPS in the zone: config system zone → edit <no> → set svc-https enable → next → end → execute commit.

2.8 Access to the appliance was lost after a change

Solution:

1. Connect from the console.
2. Look at the latest commit jobs:

   get system commit list
   get system commit show <no>
   

3. The fastest way is to go back to the previous revision:

   get system config revisions
   get system config diff <sürüm>
   enable
   execute config revert <sürüm>
   execute commit Erişim geri getirildi
   

4. Or fix the cause directly: the interface address (2.1), zone access (1.1), trusted addresses (2.7).

---

3. Services and the management panel

3.1 A service is not running

Check:

get system service list
get system service status <servis>
get log service <servis> 100
diagnose sys failed-units

Possible cause: The service failed and stopped, its configuration is wrong, a resource it depends on (disk, memory, network) is insufficient, or the feature is disabled.

Solution:

1. Read the Status column: - tasarım gereği kapalı, · özellik kapalı, bu cihazda yok, · lisans yok: the service is not running in this installation, as expected; this is not a fault. - HATA (…) or ÇALIŞMIYOR: continue. - · <n> kez yeniden başladı: the service keeps crashing; do not restart it without looking at the logs.
2. Look at the logs: get log service <servis> 200, or diagnose log service <servis> for live monitoring (exit with Ctrl+C).
3. Is there a resource problem? get hardware disk usage, get system performance status, diagnose sys oom.
4. Restart it:

   enable
   execute restart <servis>
   get system service status <servis>
   

If the DHCP/DNS server (gateway module) has gone down, execute service start sljs-dnsmasq can also be used.

If it still does not work: diagnose debug application <servis> gives the service unit, recent errors and log files on a single screen. Send the output to the support team.

3.2 The management panel does not open

Symptom: The browser does not open the panel; CLI commands return the error yonetim servisine ulasilamadi (…).

Check:

get system component panel
get system service status server_settings
get log service server_settings 200
diagnose test healthz server-settings

Solution:

1. If the service appears as çalışıyor but the panel does not open, check the network side (2.7).
2. If the service is not running, restart it with a Super User account:

   enable
   execute restart server_settings
   

The panel does not respond for a few seconds; repeat the commands that depend on the panel a little later. 3. If you only renewed the web certificate, execute reload panel is sufficient instead of restarting the service.

Note: execute restart server_settings works only with a Super User account. If you do not have the privilege, contact an administrator who has Super User privileges.

3.3 CLI commands are slow or time out

Symptom: Commands take a long time; the error yonetim servisi yanit vermiyor: … (ayrinti: diagnose cli timing).

Check:

diagnose cli timing
diagnose cli timing probe
diagnose cli timing history
get system performance status
diagnose sys top

Reading:

• diagnose cli timing shows where the duration of the last command was spent (management service, internal component, audit record, local processing) and tells you the longest stage.
• diagnose cli timing probe tests the dependencies; YAVAŞ, ÇOK YAVAŞ or HATA lines point to the problematic layer. For example, ÇOK YAVAŞ — disk G/Ç bekletiliyor indicates a disk bottleneck, and HATA — panel kanalı açmamış (servis çalışmıyor ya da açılışı sürüyor) means the management service is not ready.
• If the system load is high, find the most resource-intensive processes with diagnose sys top.

Solution: Depending on the problematic layer, go to section 3.2, 6.1 or 6.4.

3.4 Privileged operations do not work

Symptom: Commands such as execute reboot, execute restart and packet capture return privileged worker kullanilamiyor: … or a similar error.

Check:

get system control-plane
get system worker-status
get system service status signlogger-privileged

Solution: If Durum : UNAVAILABLE, restart the internal component with a Super User account:

enable
execute restart signlogger-privileged
get system control-plane

If the problem persists, restart the appliance (execute reboot) or contact the support team.

---

4. Log Search DB

4.1 Log Search DB status is WARNING or PROBLEM

Check:

get log store status --refresh
get system service status logsearch
get log service logsearch 200
get hardware disk usage
get hardware memory

Reading:

Status	Meaning
SAĞLIKLI	Normal.
UYARI (eksik kopya)	Some data replicas are unassigned; search works but redundancy is incomplete.
SORUN (eksik parça)	Some data shards are unassigned; some records may not appear in search.

The Not lines at the end of the output are recommendations for the store; apply them first.

Possible cause: The data disk is full, memory is insufficient, the service is restarting, or the shard count limit is being approached.

Solution:

1. If the disk is above 90%, follow 6.1.
2. If the service is not running:

   enable
   execute restart logsearch
   

The service may take a few minutes to recover; monitor it with get log store status --refresh. 3. For signs of insufficient memory, look at the diagnose sys oom output. 4. Monthly merge (rollup) and memory settings are in config system es-tuning. Change these settings together with the support team.

4.2 "Store unreachable"

Symptom: get log store status → Depoya ulaşılamadı: …; log search in the panel returns no results.

Solution:

1. Check the service status with get system service status logsearch. If it is ÇALIŞMIYOR or HATA, follow 4.1 step 2.
2. If the service is running, it may still be starting up; repeat after a few minutes.
3. Examine the logs: get log service logsearch 300.

Note: get log store status works only with accounts in the root domain. With an account in another domain you get a yetki reddedildi error.

4.3 Log search is slow

Check: get system performance status, diagnose sys top-mem, diagnose sys disk io, get log store status.

Solution: Check disk I/O and memory pressure. The sizes and recommendations in the Largest indexes table show whether the retention period or the merge setting needs to be reviewed (config log setting, config system es-tuning).

---

5. Log ingestion and signing

5.1 No logs are arriving from a device

Symptom: The logs of a firewall or another log source do not appear in the panel.

Check:

get log device list
get log rsyslog status
get system service status rsyslog
get router status
diagnose sniffer packet <arayüz> sn=30 host <cihaz-ip> port 514

Possible cause:

• The source device is not sending logs, or is sending them to the wrong address/port.
• The syslog receiver is not running.
• The gateway module (router mode) is enabled and the syslog service is disabled in the zone that receives the logs.
• The device has no record, or its license is invalid.

Solution:

1. If get log rsyslog status → Syslog servisi calismiyor, run enable and execute restart rsyslog.
2. With packet capture (permission: edit_network_settings), are packets from the device's IP visible? - No packets: the problem is on the source device or in between. Check the source device's syslog destination and the network path. - Packets present but no logs: continue.
3. If Status in the get router status output is AKTİF, check that the syslog service is enabled in the zone the logs arrive in:

   get system zone <zone-no>
   

If svc-syslog is disable:

enable
config system zone
edit <zone-no>
set svc-syslog enable
next
end
execute commit Zone syslog alımı açıldı

1. Check the device record and its license: get log device list (5.3).
2. Look at the most recent incoming records: get log rsyslog files and get log rsyslog view <no>.

5.2 The log source shows "NO CONNECTION"

Symptom: get log device list → STATUS BAĞLANTI YOK.

Explanation: This column shows whether the appliance can reach the log source over the management connection (SSH, HTTPS, API). It is separate from log ingestion.

Check and solution:

show system device <no>
diagnose test port <cihaz-ip> <port>
diagnose test path <cihaz-ip>

• If the port is closed or there is a timeout, check management access on the source device and the firewall in between.
• If the connection is open but the status does not recover, update the connection type, user and key in the record from the panel.

5.3 The log source's license has expired

Symptom: get log device list → LICENSE SÜRESİ DOLDU or GEÇERSİZ.

Check: get system license status, get log device list.

Solution: Renew the license and upload it from the license screen in the panel. License matching is done by device name; the name in the device record must be the same as the one in the license.

5.4 Logs are not being signed (Law 5651)

Check:

get log signing status
get log signing list
get log signing list <cihaz-seri> 20

Reading:

• In the Latest signed archives and get log signing list tables, the STATUS and ERROR columns show the result of signing.
• If KAMU SM zaman damgası : açık, signing uses the KAMU SM timestamp server. If kapalı (yerel imza), the appliance's own signature is used.

Possible cause and solution:

1. KAMU SM access: Test access to the KAMU SM server:

   show log setting
   diagnose test port <kamu-sm-sunucusu> <port>
   diagnose test path <kamu-sm-sunucusu>
   

The KAMU SM erişimi : ERİŞİLEMİYOR line in the get log signing status output can also appear for a reachable server if the server address is registered with the http:// prefix. Verify the actual result with diagnose test port and with the ERROR column of the archives. 2. KAMU SM credentials: Check the public-sm-username and public-sm-password fields in config log setting (the password is not displayed; to rewrite it use set public-sm-password <parola>), then execute commit. 3. Signing pending logs immediately: enable and execute log sign now. This manual operation signs with the appliance's server certificate; the KAMU SM timestamp is used in scheduled signing. 4. Accounts outside the root domain get a device_serials zorunlu error with execute log sign now; perform signing from the panel by selecting a device.

5.5 Verification of a signed archive fails

Check:

get log signing list
execute log verify <arşivin-tam-yolu>.zip

Reading: Sonuç : doğrulandı confirms the integrity of the archive. Sonuç : BAŞARISIZ may indicate that the archive has been modified, is incomplete, or is corrupted; the details are at the top of the output.

The error forbidden: doğrulama yalnız imzalı log dizinlerinde: … indicates that the archive is outside the permitted directories; specify an archive located in one of the directories listed in the message.

5.6 Logs are not being forwarded to the external syslog server

Check:

diagnose log syslog
diagnose log syslog test <sunucu-no>
diagnose test port <sunucu-ip> <port>

Reading: diagnose log syslog lists the servers (address, transport, status) and the forwarded modules. test sends a single real test message to the selected server and prints Sonuç : BAŞARILI|BAŞARISIZ.

Solution:

• If STATUS is kapalı, run config log syslog → edit <no> → set status enable → next → end → execute commit.
• If the module STATUS column is off, that module is not forwarded; the module setting is on the Log Settings screen in the panel.
• If the test succeeds but there are no records in the SIEM, check the receiver and filters on the SIEM side. With UDP forwarding, success shows only that the message was sent; it does not guarantee delivery.

---

6. Disk and memory

6.1 The disk is full

Symptom: diagnose health → disk:/data WARN/FAIL; the Log Search DB or services return errors.

Check:

get hardware disk usage
diagnose health scan
diagnose sys disk usage-top /data 2
diagnose sys disk inodes

Possible cause: The log retention period is long relative to the disk capacity, cleanup is disabled, or the disk is growing faster than planned.

Solution:

1. Review the retention and automatic cleanup settings:

   get log setting
   

Relevant fields: log-retention-days, signed-file-retention-days, general-log-retention-days, enable-disk-cleanup, disk-usage-threshold, disk-cleanup-min-free-gb.

Warning: Signed logs are legal evidence under Law 5651. Check your legal obligations before shortening retention periods.

1. To change them:

   enable
   config log setting
   set enable-disk-cleanup enable
   set disk-usage-threshold 85
   end
   execute commit Disk temizlik ayarı
   

2. For a permanent solution, grow the disk on the virtual machine (6.2).

Log or data files cannot be deleted from the CLI; this is a deliberate restriction to protect evidence integrity.

6.2 The disk was enlarged but the new space is not visible

Check:

get hardware disk unused
get hardware disk layout

Reading: get hardware disk unused gives the following findings:

• disk sonunda ~<boyut> bolumlenmemis alan var → the disk has been enlarged, but the partition has not been extended.
• ~<boyut> alan dosya sistemi tarafindan kullanilmiyor (FS genisletilmemis olabilir) → the partition has grown, but the file system has not been extended.
• VG <ad>: <boyut> GB ayrilmamis alan var → there is unallocated space in the logical volume group.
• disk tamamen kullanilmiyor → the newly added disk is not used at all.

Solution: Perform the extension from the panel's disk management screen. The automatic extension setting is in config system disk-extend. There is no direct disk extension command in the CLI.

6.3 I suspect a disk health problem

Check:

get hardware disk info
get hardware storage smart <disk>
diagnose sys kernel 500 | grep -i error
diagnose sys disk io

Solution: If there is a warning such as Diskte G/Ç hatası sayıldı; disk değişimi değerlendirilmeli. or Disk çalışır durumda değil, plan a disk replacement. For virtual disks, health information is monitored at the hypervisor.

6.4 Memory is insufficient or processes are being terminated

Check:

get hardware memory
get system performance status
diagnose sys top-mem 20
diagnose sys oom

Reading: diagnose sys oom shows the processes that were terminated due to insufficient memory. When memory runs low, diagnose health scan produces the finding Available memory N% (OOM riski yakin).

Solution: Identify the service that uses the most memory. Adding memory to the virtual machine is the most lasting solution. The Log Search DB memory mode is in config system es-tuning; change it together with the support team.

---

7. NAC and RADIUS

7.1 Users cannot log in to the network (RADIUS)

Check:

get system service status radiusd
get system service status radius-nac-daemon
get log service radiusd 200
get user radius-client
get user online stats

Possible cause:

• The RADIUS service or the NAC policy service is not running.
• The network device sending the requests (NAS) is not defined as a RADIUS client, or the shared secret does not match.
• If the gateway module is enabled, the RADIUS service is disabled in the zone.
• The user's identity source (LDAP/AD) is unreachable.

Solution:

1. If the services are not running: enable, execute restart radiusd, execute restart radius-nac-daemon.
2. Check that the NAS is registered: is the device's address in the get user radius-client list? If not, add it from the panel or with config user radius-client. Make the shared secret (secret) the same on both sides, then execute commit.
3. Are requests reaching the appliance?

   diagnose sniffer packet any sn=30 host <nas-ip> port 1812
   

If there are no packets, the problem is on the NAS or in between. If router mode is enabled, set the svc-radius field to enable in the zone (using the method in 5.1 step 3). 4. If identities come from LDAP/AD, go to 7.2.

7.2 LDAP or Active Directory authentication does not work

Check:

get user ldap list
execute ldap test <no>
get system service status winbind
diagnose test port <ldap-sunucusu> 389
diagnose ssl connection <ldap-sunucusu>:636

Solution:

• LDAP bağlantı testi başarısız: <ayrıntı> → read the detail: a timeout points to a network problem, an authentication error points to wrong bind information.
• Update the bind information in config system ldap → edit <no> (bind-dn, bind-password, base-dn), then execute commit.
• If LDAPS/STARTTLS is used, check the certificate's validity with diagnose ssl connection.
• If an Active Directory connection (802.1X) is used, verify that the winbind service is running; if necessary, execute restart winbind.

7.3 A user's session cannot be disconnected

Check:

get user online list <kullanıcı>

Solution:

enable
execute user logout <kullanıcı>

• The warning Oturum kaydı kapatıldı ancak cihaza aktif çıkış (deauth) ULAŞTIRILAMADI — … indicates that the logout command did not reach the network device. Check the NAS record's secret, CoA/Disconnect support, and the device's access to the CLI.
• Hotspot sessions of the gateway module may not be in this list; for those, see 8.4.

7.4 Two-factor authentication SMS is not delivered

Check:

get system sms-provider list
get user two-factor
enable
execute sms test <sağlayıcı> --to <numara>

Solution: If execute sms test returns an error, read the provider response in the message (credentials, credit, number format). The provider setting is in config sms provider. For number filters, use get sms filter and get sms number-filter.

---

8. Captive portal

8.1 The portal page does not open

Check:

get system component captive-portal
get system service status captive-portal
get log service captive-portal 200
diagnose test healthz captive-portal

Solution:

1. If the service is not running, run enable and execute reload captive-portal (restarts the service; the portal does not respond for a short time).
2. If the service is running but clients are not redirected to the page, check the portal setting on the firewall that performs the redirection and the firewall-ip, fqdn and https fields in config captive portal.
3. If the gateway module's hotspot is used: get router status, and the captive-enabled and svc-captive fields in the zone (get system zone <no>).

8.2 The SMS or email verification code is not delivered

Check:

get system sms-provider list
get system mail-server list
enable
execute sms test <sağlayıcı> --to <numara>
execute mail test <no> --to <adres>

Solution: If the tests succeed, check that the correct provider and email server are selected in the portal record (show captive portal <ssid> → sms-provider, mail-server). If the tests fail, read the provider or SMTP response in the error message.

8.3 User or administrator approval does not work

Check:

get captive-portal approval-method
get captive approver

Solution: Is the portal's approval method correct (Kullanıcı onayı, Yönetici onayı, Girişten önce)? For administrator approval, the email addresses and statuses of the approvers are in config captive approver. Test email delivery with execute mail test.

8.4 Disconnecting a gateway hotspot user

get router hotspot list
enable
execute router hotspot-logout <ip>

Only IPv4 addresses are accepted. The command returns the response Oturum düşürüldü even if there is no session at that address; verify the result with get router hotspot list.

---

9. Update

9.1 The update does not appear or does not start

Check:

get system update status
get system update history
get system license status
diagnose test dns <güncelleme-sunucusu>
diagnose test port <güncelleme-sunucusu> <port>

Possible cause and solution:

Message	Solution
Lisansınız bulunamadı. Güncelleme sistemi kullanılamıyor. …	Check the appliance license (get system license status).
Sıralı güncelleme gerekli. Önce önceki güncellemeleri tamamlamanız gerekiyor.	Install the pending updates in order.
yetki reddedildi (…)	The account does not have the edit_update_management permission, or the account is not in the root domain.
The check fails without a message	Test DNS and access to the update server (2.3, 2.4).

To start the update: enable and execute update start. During installation, the management panel and related services restart; commands that depend on the panel may return errors for a few minutes. Monitor the result with get system update history.

---

10. Configuration and commit

10.1 end or next says "could not be written"

Symptom: yazılamadı: config <bölüm>: <neden>.

Explanation: Your changes failed validation; nothing was written, and the changes are waiting in your session.

Solution: Fix the cause (e.g. add set server …) and type end again, or discard the pending changes with abort. For the rules of the fields, type ? within the section.

Common causes:

Cause	Solution
zorunlu alan eksik: <alan>	Set the field with set.
server: NTP açıkken en az bir sunucu gerekli	Add an NTP server or use set ntpsync disable.
secondary: birincil DNS boşken ikincil verilemez	Set primary first.
hostname: geçersiz ana makine adı: …	Use letters, digits and hyphens.
timezone: bilinmeyen saat dilimi: …	Use an IANA name (e.g. Europe/Istanbul).
<port>: geçerli bir IPv4 adresi gerekli	Check the ip, prefix and gateway fields.

10.2 The commit failed

Check:

get system commit list
get system commit show <no>
get system config pending

Reading: get system commit show shows the apply steps (tamam, UYARI, HATA) and the error messages. On a failed commit, the running configuration returns to its previous state; your changes remain in the candidate.

Solution: Fix the setting belonging to the failed step and run execute commit again, or discard the candidate with execute config discard.

10.3 Rolling back a committed change

get system config revisions
get system config diff <sürüm>
enable
execute config revert <sürüm>
get system config pending
execute commit Geri alındı

execute config revert only loads the revision into the candidate; it is not applied without execute commit.

10.4 exit does not leave the section

Symptom: <n> bekleyen degisiklik var. Yazmak icin `end`, atmak icin `abort`.

Solution: Type end to write the changes, or abort to discard them.

---

11. Collecting diagnostic information

Collect the following outputs before contacting the support team. You can save them to a file in a single command over SSH:

ssh <kullanıcı>@<cihaz-ip> "get system status; get system version; get system performance status; diagnose health; diagnose health scan; get system service list; get hardware disk usage; get log store status; get system commit list" > tanilama.txt

Additional outputs specific to the problem:

Problem	Additional commands
Service	get system service status <servis>, get log service <servis> 300, diagnose debug application <servis>
Network	diagnose ip address list, diagnose ip route list, diagnose netlink summary, diagnose test path <hedef>
Log ingestion	get log device list, get log rsyslog status, diagnose log syslog
Signing	get log signing status, get log signing list
Slowness	diagnose cli timing probe, diagnose sys top, diagnose sys disk io
System logs	diagnose sys errors 120, diagnose sys warnings 60, diagnose sys failed-units

• If you want to process the output with a script, append --output json to the commands.
• If traffic analysis is needed, capture a pcap file with diagnose sniffer file <arayüz> sn=60 <süzgeç> and download the file from the Network Diagnostics › Packet Capture tab in the panel. Captured packets may contain personal data; apply your organization's policy before sharing the file.

---

Appendix. Symptom → section table

Symptom	Section
SSH timeout / connection refused	1.1
Password not accepted, account locked	1.2
"Change your password from the web panel first"	1.3
"Authentication service unreachable"	1.4
"Access denied: on this appliance the CLI is only for active panel administrators"	1.5
"session suresi doldu"	1.6
The CLI Console inside the panel does not open	1.7
"no permission", "privileged mode required"	1.8
Appliance cannot be pinged, wrong address	2.1
Gateway unreachable	2.2
Names cannot be resolved	2.3
Cannot connect to a remote server	2.4
Large pages hang	2.5
Clock is wrong	2.6
Panel does not open, SSH works	2.7
Access lost after a change	2.8
Service is not running	3.1
"yonetim servisine ulasilamadi"	3.2
Commands are slow	3.3
"privileged worker kullanilamiyor"	3.4
Log Search DB WARNING/PROBLEM	4.1
"Store unreachable"	4.2
Log search is slow	4.3
No logs arriving from a device	5.1
Log source "NO CONNECTION"	5.2
License "EXPIRED"	5.3
Logs are not being signed	5.4
Archive verification fails	5.5
External syslog forwarding does not work	5.6
Disk is full	6.1
Disk enlarged, space not visible	6.2
Suspected disk fault	6.3
Insufficient memory	6.4
RADIUS logins fail	7.1
LDAP/AD authentication fails	7.2
A user session cannot be disconnected	7.3
2FA SMS is not delivered	7.4
Captive portal does not open	8.1
Portal code is not delivered	8.2
Portal approval does not work	8.3
Disconnecting a hotspot user	8.4
Update does not start	9.1
"yazılamadı: config …"	10.1
Commit failed	10.2
Rolling back a change	10.3
exit does not leave the section	10.4
Collecting information for support	11