/docs/troubleshooting/ Recent content in Troubleshooting on Tetragon - eBPF-based Security Observability and Runtime Enforcement Hugo en /docs/troubleshooting/sysdump/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/troubleshooting/sysdump/ Before you report a problem, make sure to retrieve the necessary information from your cluster. Tetragon’s bugtool captures potentially useful information about your environment for debugging. The tool is meant to be used for debugging a single Tetragon agent node but can be run automatically in a cluster. Note that in the context of Kubernetes, the command needs to be run from inside the Tetragon Pod’s container. Key information collected by bugtool: /docs/troubleshooting/loglevel/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/troubleshooting/loglevel/ When debugging, it might be useful to change the log level. The default log level is controlled by the log-level option at startup: Enable debug level with --log-level=debug Enable trace level with --log-level=trace Change log level on Kubernetes Warning The Pods of the Tetragon DaemonSet will be restarted automatically after changing the debug Helm value. It is possible to change the log level of Tetragon’s DaemonSet Pods by setting tetragon.debug to true. /docs/troubleshooting/bpf-progs-stats/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/troubleshooting/bpf-progs-stats/ This page shows you how to monitor BPF programs statistics. Concept The BPF subsystem provides performance data for each loaded program and tetragon exports that in metrics or display that in terminal in top like tool. In terminal The tetra command allows to display loaded BPF programs in terminal with: tetra debug progs The default output shows tetragon programs only and looks like: 2024-10-31 11:12:45.94715546 +0000 UTC m=+8.038098448 Ovh(%) Id Cnt Time Name Pin 0. /docs/troubleshooting/grpc-tls/ Mon, 01 Jan 0001 00:00:00 +0000 /docs/troubleshooting/grpc-tls/ The setup steps live in gRPC TLS / mTLS. This page covers the three errors operators hit most often. x509: certificate signed by unknown authority Seen on the client during the TLS handshake. Cause — tetra does not trust the CA that signed the server certificate. Fix — pass the CA bundle that issued the server cert: tetra --tls-ca-cert-files ca.crt ... When the chart auto-provisioned the cert, copy ca.crt out of the Secret: