Alerts explained
Every alert we send has a number. Here you find each one with its exact wording, what it means, what to check and why we report it.
Monitors (websites, ports, DNS, certificates, mail, cron jobs)
101 Not reachable
Message
DOWN: Shop Shop is not reachable.
What it means
Several of our check locations could not reach the monitor one after the other. A single failed check never triggers this alert: a second location confirms it first.
What to check
Open the address yourself, ideally from a different network. Check whether the server is running, whether the web server or service is started and whether a firewall or a security service (for example a bot protection) blocks our check locations. If the site works for you, the problem may be on the way to the server; the incident page shows which locations failed.
Why we report it
When a monitor is not reachable, your visitors and customers cannot reach it either. Every minute counts.
102 No answer
Message
DOWN: Shop Shop is not reachable. No answer: Connection timed out
What it means
The connection failed before an answer came, for example because of a timeout, a refused connection, a DNS error or a TLS problem. The error after the colon is the exact error our check received.
What to check
Look at the error: "timed out" usually means the server is overloaded or a firewall drops the connection; "connection refused" means nothing listens on the port; a DNS error means the name does not resolve. If the problem only lasted a moment, it may have been a short network fault on the way.
Why we report it
Without an answer the page or service does not work for anyone who tries to use it right now.
103 Unexpected HTTP status
Message
DOWN: Shop Shop is not reachable. The server answered with HTTP 503.
What it means
The server answered, but with a status code outside the accepted range (by default 200 to 399). Common codes: 500 internal error, 502 and 504 problems behind a proxy, 503 service unavailable or maintenance, 403 access denied, 404 page not found.
What to check
Open the address and look at the page. Check the error log of the web server and the application. A 403 can mean that a firewall or bot protection blocks our checks: then allow our check locations or change the accepted status codes of the monitor. During planned maintenance a 503 is expected; pause the monitor for that time.
Why we report it
An error page instead of your content looks like an outage to visitors and search engines.
104 Keyword not found
Message
DOWN: Shop Shop is not reachable. Keyword "Add to cart" not found on the page.
What it means
The page loaded, but the text the monitor looks for was not on it.
What to check
Open the page and look for the text. Often the page shows an error, a login or a cookie notice instead of the content. If the page was changed on purpose and the text is gone, adjust the keyword in the monitor; then it is a false alarm.
Why we report it
A page can answer normally and still be broken, for example an empty shop page or a database error. The keyword finds that.
105 Unwanted keyword found
Message
DOWN: Shop Shop is not reachable. Keyword "Error" found on the page, but it must not appear.
What it means
The page contains a text that must not appear, for example "error" or "maintenance".
What to check
Open the page and look where the text appears. If it is part of normal content (for example a blog post mentioning the word), choose a more specific text for the monitor; then it is a false alarm.
Why we report it
Error messages on a page that otherwise loads normally are easy to miss and cost visitors and trust.
106 DNS answer differs
Message
DOWN: Shop Shop is not reachable. The DNS answer differs from the expected one.
What it means
The DNS server answered, but not with the value the monitor expects (for example a different IP address).
What to check
Check the DNS records at your provider. If you changed them on purpose, update the expected value in the monitor. An unexpected change can mean that someone changed your DNS settings without permission.
Why we report it
A wrong DNS answer sends visitors and mail to the wrong server, or nowhere.
107 No reply to ping
Message
DOWN: Shop Shop is not reachable. No reply to ping.
What it means
The host did not answer any ping request from our check locations.
What to check
Check whether the server is running and reachable on the network. Some firewalls and providers block ping (ICMP); if the host never answers ping, use a port or website monitor instead, otherwise this alert may be a false alarm.
Why we report it
A host that does not answer at all is usually switched off or cut off from the network.
108 Network problem, server running
Message
NETWORK PROBLEM: Shop Shop is not reachable from most locations, but at least one location still reaches it: the server is running, the problem is in the network on the way to it.
What it means
Most check locations could not reach the monitor, but at least one still could. The server itself is running; the problem is on the network on the way to it.
What to check
Check your provider's status page and network announcements. Often such faults resolve on their own. If it lasts, ask your provider whether routes from certain regions are affected.
Why we report it
Visitors from the affected regions cannot reach you, even though everything looks fine from your own network.
109 Certificate invalid
Message
CERTIFICATE INVALID: Shop The SSL certificate of Shop is invalid.
What it means
The SSL certificate has expired, does not match the domain name, is incomplete or not trusted.
What to check
Open the site in a browser and look at the certificate warning. Renew the certificate or install the full certificate chain. After a renewal, restart the web server so that it uses the new certificate.
Why we report it
Browsers show a security warning and most visitors leave. Shops and logins stop working.
110 Certificate expiring
Message
CERTIFICATE EXPIRES: Shop The SSL certificate of Shop expires soon.
What it means
The SSL certificate expires soon. It still works now.
What to check
Check whether automatic renewal (for example certbot or your hosting panel) is set up and running. If the certificate was renewed already, the web server may still use the old one: restart or reload it.
Why we report it
We warn early so that there is time to act before visitors see a security warning.
111 Certificate not retrievable
Message
CERTIFICATE NOT RETRIEVABLE: Shop The SSL certificate of Shop could not be retrieved.
What it means
We could not fetch the certificate, for example because the port is closed or the TLS connection fails.
What to check
Check whether the service answers on the port and whether TLS is configured. A firewall that blocks our check locations can also cause this; then it is a false alarm for visitors.
Why we report it
Without the certificate we cannot tell whether visitors see a valid, trusted connection.
112 Heartbeat missed
Message
HEARTBEAT MISSED: Shop Shop did not report in time.
What it means
The job (for example a backup or a cron job) did not report in time.
What to check
Check whether the job ran and whether it can still reach our heartbeat address. If the job runs later or less often than set up, adjust the interval and grace period of the monitor.
Why we report it
Jobs that stop running silently, such as backups, are often only noticed when it is too late.
113 Job reported a failure
Message
JOB FAILED: Shop Shop reported a failed run.
What it means
The job reported in, but signalled that its run failed.
What to check
Look at the output or log of the job for this run.
Why we report it
A job that runs but fails is just as bad as one that does not run.
114 Check mail settings
Message
MAIL SETTINGS: Shop The mail settings of shop.example.com in DNS need attention (SPF, DKIM, DMARC or name servers). Details and suggested fixes are in the dashboard.
What it means
The mail-related DNS records of the domain need attention: SPF, DKIM, DMARC, MTA-STS, DNSSEC or the name servers.
What to check
The monitor page lists the exact findings with suggested fixes. Change the records at your DNS provider; it can take a while until the change is visible everywhere.
Why we report it
Missing or wrong records let your mail land in spam or let others send mail in your name.
115 Test mail missing
Message
TEST MAIL MISSING: Shop No test mail from shop.example.com arrived in time.
What it means
The regular test mail from your server did not arrive in time.
What to check
Check the mail queue and the log of your mail server and whether the sending job still runs. A short delay at the receiving side can also cause this; if the next test mail arrives, the alert closes by itself.
Why we report it
If test mails do not arrive, your customers' mails probably do not either.
116 Test mail with problems
Message
MAIL DELIVERY PROBLEM: Shop The latest test mail from shop.example.com failed SPF, DKIM or DMARC, is blacklisted or was rated as spam. Details are in the dashboard.
What it means
The test mail arrived, but failed SPF, DKIM or DMARC, is on a blacklist or was rated as spam.
What to check
The monitor page shows exactly what failed. Fix the records or ask for removal from the blacklist.
Why we report it
Such mails often end up in spam or are rejected.
Servers (agent)
201 Server not reporting
Message
SERVER: web1 web1 is not reporting (agent or server offline). The agent has stopped sending data: the server may be switched off or offline, or the agent has stopped. Check whether the server responds and the agent is running.
What it means
Our agent on the server has not sent any data for several minutes.
What to check
Check whether the server is running and has network. If it is, check the agent service ("systemctl status centoculus-agent2"). After a reboot or a network change the agent reports again by itself; then the alert closes.
Why we report it
Without data we cannot see the server, and often the server itself is down.
202 Service stopped
Message
SERVER: web1 web1 has a stopped service. A monitored service is no longer running. Check its status and log and start it again.
What it means
A service you chose to monitor on the server is no longer running.
What to check
Check the status and the log of the service ("systemctl status <service>", "journalctl -u <service>") and start it again. If you stopped or removed the service on purpose, remove it from the monitored services; then it is a false alarm.
Why we report it
A stopped web, database or mail service usually means an outage of everything that depends on it.
203 Disk almost full
Message
SERVER: web1 web1 is running out of disk space. A file system is almost full. Free up space (old logs, backups, caches) or enlarge the disk before services fail.
What it means
A file system is fuller than the set limit (by default a warning at 85 % and an alert at 95 %).
What to check
Find large files and directories (for example "du -xh / | sort -h | tail"), delete old logs, backups and caches, or enlarge the disk. If the disk is always this full on purpose, raise the limit for this file system.
Why we report it
When the disk is full, databases, mail and websites stop writing data and fail.
204 Inodes almost used up
Message
SERVER: web1 web1 is running out of inodes. Almost no free inodes are left, usually because of very many small files (sessions, caches, mail queue). Delete old files to free inodes.
What it means
Almost all inodes of a file system are used, usually by very many small files. New files can no longer be created, even if there is free space.
What to check
Find directories with very many files (sessions, caches, mail queue) and delete old ones.
Why we report it
Without free inodes services fail just as with a full disk, and that is hard to spot.
205 File system read-only
Message
SERVER: web1 web1 has a read-only file system. The system has made a file system read-only, usually because of a disk error. Services can no longer save data: check the disk and the system log.
What it means
The system has made a file system read-only, usually because of a disk or file system error.
What to check
Check the system log ("dmesg", "journalctl -k") for disk errors and the health of the disk. Often a file system check and a reboot are needed; if the disk is failing, restore to new hardware.
Why we report it
Services can no longer save anything, and data may be at risk.
206 High CPU load
Message
SERVER: web1 web1 has a high CPU load. The processor has been busy for a long time. Check which processes use it.
What it means
The processor has been busier than the set limit for a long time (by default above 90 % for 15 minutes).
What to check
Find the processes that use the processor ("top", "htop"). Planned work such as backups or imports can cause this; if it happens regularly at the same time, it is expected.
Why we report it
A permanently busy processor makes websites and services slow.
207 High system load
Message
SERVER: web1 web1 has a high system load. More work is waiting than the processors can handle. Check the running processes and disk activity.
What it means
For a long time more work has been waiting than the processors can handle (system load per processor above the set limit).
What to check
Check processes and disk activity ("top", "iotop"). High load with a low processor use often means slow disks or waiting on the network.
Why we report it
High load makes everything on the server slow and often comes before an outage.
208 Low memory
Message
SERVER: web1 web1 is low on memory. Little memory is left. Check which processes use it; if it runs out, the system stops services.
What it means
Free memory has been below the set limit for a while (by default less than 10 % available).
What to check
Find the processes that use memory ("top" sorted by memory). Reduce the memory settings of the database or PHP, or add memory.
Why we report it
When memory runs out, the system stops processes on its own, often the database.
209 Memory and swap almost full
Message
SERVER: web1 web1 is running out of memory and swap. Memory and swap are almost used up at the same time: the server is really short of memory, slows down and may stop services. Check which processes use memory, or add more memory.
What it means
Memory and swap are almost used up at the same time (both below 10 % free). The server is really short of memory.
What to check
Find the processes that use memory and reduce their settings, or add memory. A full swap alone is no problem: the system parks unused data there. That is why we only alert when memory is low at the same time.
Why we report it
The server becomes very slow and the system soon starts to stop services.
210 Server restarted
Message
SERVER: web1 web1 has restarted. The server was restarted. If this was not planned, check the system log.
What it means
The server was restarted. We record this in the incident list without sending an alert.
What to check
If the restart was not planned, check the system log for the reason, for example a power failure, a kernel error or an automatic update.
Why we report it
Unplanned restarts can point to hardware or stability problems.
211 System clock wrong
Message
SERVER: web1 web1 has a wrong system clock. The server clock is wrong. Check the time synchronisation (NTP); a wrong time breaks certificates, logins and scheduled jobs.
What it means
The server clock differs from the real time by more than a minute.
What to check
Check the time synchronisation ("timedatectl"); start or set up NTP (for example systemd-timesyncd or chrony).
Why we report it
A wrong time breaks certificates, logins, two-factor codes and scheduled jobs.
212 User accounts changed
Message
NOTICE #212: web1 web1 has changed user accounts or groups. A user account or group was added, changed or removed. If this was not you or your team, the server may be compromised: check who has access.
What it means
A user account or group on the server was added, changed or removed (/etc/passwd or /etc/group changed). We report this once; there is no all-clear message.
What to check
Look at the latest changes ("tail /etc/passwd", "last", "journalctl"). Software installations and updates also create system users; if you or your team installed something at that time, it is expected.
Why we report it
Attackers often create their own user to keep access. Early notice is important.
213 Passwords changed
Message
NOTICE #213: web1 web1 has changed passwords. A password on the server was changed. If this was not you or your team, check who has access.
What it means
A password on the server was changed (/etc/shadow changed). We report this once; there is no all-clear message.
What to check
Check who changed which password ("journalctl", "last"). Password changes by you or your team, and some updates, are expected.
Why we report it
An unexpected password change can mean that someone took over an account.
214 Admin rights changed
Message
NOTICE #214: web1 web1 has changed admin rights (sudo). Admin rights (sudo) were changed. If this was not you or your team, check who has access.
What it means
The admin rights (sudo) on the server were changed (/etc/sudoers or /etc/sudoers.d changed). We report this once; there is no all-clear message.
What to check
Look at the changed file and check who has admin rights. Some packages add their own rules when installed.
Why we report it
Admin rights give full control of the server. Unexpected changes are a strong warning sign.
215 SSH configuration changed
Message
NOTICE #215: web1 web1 has a changed SSH configuration. The SSH configuration was changed. Check that logins are still restricted as intended.
What it means
The configuration of the SSH server (/etc/ssh/sshd_config) was changed. We report this once; there is no all-clear message.
What to check
Check the changed settings, especially password login, root login and the port. Updates of the SSH package can change the file too.
Why we report it
SSH is the main way into the server. A weakened configuration makes attacks easier.
Want this checked automatically and get alerted?
Centoculus checks your site every 5 minutes on the free plan and alerts you by email and in the app before your customers notice. 50 website monitors and 5 SSL checks a day, free, commercial use allowed. Sign-up opens soon: get early access and you start first.
Get early access