Troubleshooting

Work backwards from where the data stops. That is faster than guessing.

Host offline

1. systemctl status diting-agent
2. Read /var/log/diting/agent.log
3. Check the network path and ports to the gateway
4. Confirm the token is valid

Host online, no data

• Read /kernel-capabilities and the lane status in the heartbeat
• Confirm capture mode is not disabled
• Confirm traffic actually crosses the captured interface
• Check clock synchronization

Capture lane degraded

• If tc_ebpf is unavailable, check kernel version and privileges
• If socket_syscall is unavailable, check RLIMIT_MEMLOCK and SELinux
• Kernels without BTF use the compatibility path and lose some capability

Every degradation reports a reason. Nothing fails silently.

Data not reaching storage

Follow the path:

1. Is the gateway receiving data
2. Is Kafka backing up
3. Is the collector consuming
4. Is ClickHouse writable

When Kafka backs up, read collector logs and partition counts before restarting anything.

Queries falling back

If queries slow down or fall back locally, check ClickHouse write and merge pressure first, then whether queries prune partitions.

Logs

• agent: /var/log/diting/agent.log
• platform components: the matching pod or systemd unit for your profile

Still stuck

Bring these:

• kernel and distribution
• agent version
• /kernel-capabilities output
• the time window and a trace_id

Related: Host onboarding and kernels, Deploy and offline install.