Troubleshooting¶

Find your symptom, check the likely cause and apply the fix. If a fix does not help, contact Privitty support through the channel listed in your Privitty agreement.

The setup or invite link has expired¶

Cause: A setup link is valid for 24 hours and works once.

Fix: Ask an owner to check your row on the Users page. If your status stays invited and you cannot get a new link, contact Privitty support. See Users and roles.

Sign-in shows `unauthorized` or `rate_limited`¶

Cause: unauthorized means the email, password or code is wrong, or the account is not active. rate_limited means too many attempts in a minute.

Fix: Wait a minute and try again. Select Forgot password to reset your password. If you lost your authenticator, choose Email on the two-factor step, or ask an owner to select Reset MFA on your row in Users.

Edges¶

The Edge does not appear after you run the command¶

Cause	Fix
The command is older than 15 minutes, or you already used it.	On Add Edge, select Create command and run the new command.
You required approval and the Edge waits for it.	Select Approve on the Approvals page.
You did not run the command as root.	Run it again with `sudo`.
Your install reached its Edge limit.	Deactivate Edges you no longer use, or check your limits on Billing and Usage. See Billing and usage.

See Edges list and Add Edge.

The Edge shows Offline¶

Cause: The Edge lost its connection to Watchtower. Common reasons are a powered-off host, a network or firewall change at the site, or a wrong system clock on the host.

Fix:

Check that the Edge host is powered on and has network access.
Check that the host's date and time are correct.
Wait a minute after the connection returns. The Online column updates on its own.

While an Edge is offline, it keeps collecting values and sends them when it reconnects. If the Edge stays offline for more than 30 days, it must be enrolled again with a new Add Edge command. See Edge page overview.

Sync shows Failed¶

Cause: The Edge rejected the new configuration and kept its previous one.

Fix: Hover over the Sync cell to read the error. Fix the template or the Edge's configuration, check it with Preview render on the Config tab, and save again. Watchtower does not resend a failed version. See Edge configuration.

Sync shows Rolled back¶

Cause: The Edge applied the configuration but could not confirm it in time, so it returned to the previous one. This happens when the Edge loses its connection during the change, or when a changed asset does not connect and Roll back when a connector fails is on.

Fix: Correct the change, for example a wrong device address, and publish again.

Sync shows Pending¶

Cause: Watchtower has a new version that the Edge has not confirmed, or the Edge has not received any configuration yet.

Fix: Wait up to the Confirm timeout seconds on the template's Agent tab (120 seconds by default). If it stays Pending, check that the Edge is Online.

Sync shows In sync, but your latest change did not arrive¶

Cause: Watchtower could not build the new configuration, so it sent nothing. The Sync cell keeps its old value.

Fix: Hover over the Sync cell to read the error, for example variable <name> is not set for edge <id>. Fix the named item and save again.

Assets and tags¶

A tag shows no value or bad quality¶

Cause and fix:

What you see	Cause	Fix
The latest value shows `—`	The Edge is offline or not in sync, the asset is disabled, or the device has not answered yet.	Check the Online and Sync columns, then the asset Health.
Asset health `disconnected`	The Edge cannot reach the device.	Check the device's IP address and port in the template.
Asset health `degraded`	The device answers, but at least one tag reads badly.	Check that tag's address and data type.
Asset health `disabled`	The asset has `"enabled": false`.	Enable it in the configuration.

If the connection is correct, select Restart connector on the asset page. See Assets, tags and live values.

An alarm email did not arrive¶

Cause and fix:

Cause	Fix
Your account has no alarm notification subscription. The incident still opens in the portal.	Contact Privitty support to set up the subscription.
The rule already sent an email in the last 15 minutes.	Wait. Each rule sends at most one email every 15 minutes.
More than 10 incidents opened within 5 minutes.	Look for the single digest email. Resolved emails are not sent during a storm.
You unsubscribed with the link in an earlier alarm email.	Contact Privitty support to turn alarm email back on.
The condition has not held for For seconds yet.	Check the rule's For seconds on the asset page.

Check the Incidents tab of the Edge to confirm that the incident opened. See Alarms and incidents.

Privitty App enrollment¶

The App rejects the invite link¶

Cause	Fix
The invite was already used, or is older than 48 hours.	On the operator's row on Operators, select Invite and send the new link.
The link was edited or came from another Watchtower install.	Send a new invite. Do not edit links.
The operator is disabled.	Create a new operator.

The App rejects the email code¶

Cause: The code is wrong, is older than 10 minutes, or has had 5 wrong attempts.

Fix: Select Send email code and enter the newest code. See Operators and the App.

Grants¶

A grant stays in `joining` or shows `join_failed`¶

Cause: The Edge was offline, or could not finish the connection to the App.

Fix:

Check that the Edge shows Online.
Open the Edge's Commands tab and read the Error of the join command.
Select Retry on the grant.

See Grant access to an Edge.

In the Privitty App¶

Commands are not listed or are refused¶

Cause: The grant does not include Device commands or has ended, or the Edge has not applied a configuration that contains the grant. The Edge then answers Device commands not enabled.

Fix: In the portal, check that the grant is active and shows commands, and that the Edge is Online and In sync. See Device commands.

`/logs` shows only a few agent lines¶

Cause: The first line reads # journalctl and syslog unavailable; showing last <k> privitty-edged log lines. The Edge cannot read the host's logs.

Fix: This is expected. Read the host's logs on the host.

LAN Reach is not offered¶

Cause: LAN Reach appears only when the Edge has at least one LAN Reach entry and the grant includes Remote access.

Fix: Add an entry on the template's LAN Reach tab, publish it and wait for In sync. Then reopen the remote-access dialog. See LAN Reach.

A tunnel fails or times out¶

Cause: The App shows Timed out waiting for tunnel (180 s). Is the edge online? when the Edge does not answer. The Edge is offline, the grant has no Remote access or has ended, or another tunnel is already open on that Edge. For LAN Reach, the target must be in the LAN Reach list.

Fix: Check that the Edge is Online and the grant is active with remote in its row. Select Close Tunnel in the App to close an open tunnel, then try again. See Remote access.

The App shows an access-ending notice¶

Message	Meaning	Fix
`Access ends in N days`	The App licence ends in 30, 7 or 1 days.	Ask your administrator to renew the subscription. See App licence and renewal.
`Access ended` with reason `expired`	The licence ended, or the App was offline for more than 7 days.	After renewal, open the App while online. If access does not return, ask for a new invite.
`Access ended` with reason `deactivated`	An administrator deactivated the App or its operator.	Ask your administrator.
`Access ended` with reason `invalid`	The App could not verify its access.	Enroll the App again with a new invite.

Check that the device's date, time and time zone are correct. A wrong clock can end access early.