Skip to main content

On-premise troubleshooting

License required or connector restart loop​

Check the validator and sanitized status first:

systemctl status spot-license.service --no-pager
sudo -u spot /opt/spot/bin/spot-agent-sap license-status --json
sudo -u spot /opt/spot/bin/spot-agent-sap license-check
journalctl -u spot-license.service -u spot-agent-sap.service -n 120 --no-pager

If the license is missing, activate it or install the offline file by following Licenses and renewal. expired, revoked, and invalid block the product; going above user or instance limits only produces a warning and must not cause restarts. Never paste keys or raw responses into a ticket or logs.

If an online license was valid and the remote service becomes temporarily unavailable, SPOT may show up to seven days of grace from the last successful validation, never beyond expiry. A local validator failure does not enable that grace; fix spot-license.service first.

UI does not open​

systemctl status spot-server --no-pager
ss -ltnp | grep 8080
journalctl -u spot-server -n 120 --no-pager

If the port is busy, change it from setup or runtime configuration.

Setup does not save HTTPS​

Validate that certificate and private key exist, belong together, and are readable by the process user. HTTP remains valid when you do not enable TLS yet.

Embedded Elastic does not start​

Check memory, permissions, and logs:

systemctl status spot-elasticsearch --no-pager
journalctl -u spot-elasticsearch -n 120 --no-pager
curl -sS http://127.0.0.1:9200

The service must listen only on 127.0.0.1:9200. Embedded mode must not have a user, API key, CA, or insecure_skip_verify; save embedded again if values remain from an earlier external configuration.

External Elastic HTTP is blocked​

External profiles require HTTPS. A legacy HTTPS profile without transport_profile is safely classified as external; a legacy HTTP profile blocks the new runtime with elastic_transport_migration_required until it is migrated. Select system CAs, an imported CA, or Disable certificate validation. The last choice does not permit HTTP. Only credential-free http://127.0.0.1:9200 can be classified as embedded, and only inside spot-suite.

Elasticsearch pending​

This is valid for spot-suite-external after deferral. Health, users, and configuration remain available. Configure an HTTPS destination, run Test, and save. Do not start an embedded service: this package does not include one.

Permission denied in code or SDK​

Do not give /opt/spot to spot or spot-elastic. System payload must remain root-owned; only data and logs are mutable. Reinstall to repair an insecure old tree. For portable, keep $SPOT_HOME private to its dedicated runtime user.

A private certificate fails​

  1. Check hostname, expiration, and chain.
  2. Import the corporate CA under Configuration > Trust store and assign it.
  3. To temporarily accept the risk, explicitly enable Disable certificate validation and save.

There is no automatic fallback. The exception keeps encryption but does not authenticate the server; the warning remains after reload and restart. Changing TLS policy requires the password or API key again.

A CA cannot be deleted​

SPOT blocks deletion while Elastic, LDAP, or AI uses the CA. Move every affected destination to another CA or system trust and save before deletion. Do not manually edit a fingerprint or enter a file path in configuration.

LDAPS or StartTLS cannot connect​

Check scheme/mode, host, port, bind DN, SNI, and CA. Re-enter the bind password after any identity change; a mask is not reused. Link-local, metadata, multicast, and unspecified addresses remain blocked with certificate validation disabled.

SAP data does not arrive​

Check:

  • RFC SDK availability in the service environment.
  • SAP user and secret.
  • RFC ports.
  • SAP connection marked as enabled.
  • spot-agent-sap logs.

If only CCMS events fails, distinguish an RFC failure from an alert without text. An alert with a valid identity, timestamp, and value is preserved even when SAP omits the message; SPOT displays a stable fallback text. Authorization errors, corrupt responses, or a missing VALUE still stop the cycle and retain the previous watermark. Diagnostics separate eligible nodes, candidates, emitted events, fallbacks, and real failures.

Dashboards have no data​

Check global target, namespace, indices, and time window. If Events has data but Operations does not, open Metrics and validate a specific domain metric.

Bootstrap returns management_disabled or preflight fails​

management_disabled means the target permits reads/writes but does not authorize SPOT to manage storage. Enable SPOT manages Data Streams and ILM only with approval from the Elastic owner. If preflight fails, correct the version, template/ILM/index privileges, or disk space before retrying; SPOT does not mutate the cluster when preflight fails.

With management disabled, management_status: unmanaged is expected. detached means SPOT managed the target previously and has now stopped reconciliation without deleting existing resources.

AI does not respond​

Review provider origin/base path, TLS policy, CA, key, and outbound connectivity. Test uses the runtime policy and records a sanitized result. Providers with an API key require HTTPS; loopback HTTP works only without a key, and private LAN HTTP without a key requires its separate acknowledgement.