Gabier Docs
Browse the documentation

More

Troubleshooting

Fixes for the usual Gabier problems — no notification after a login, journalctl permission denied, a webhook returning 401 or 404, a channel that is too noisy, and a service that will not start.

Start here before opening an issue. These cover almost everything.

Nothing shows up after a login

First find out whether the parser understands your logs at all. replay is non-destructive and sends nothing:

$ gabier replay /var/log/auth.log --dry-run --config /etc/gabier/config.toml

Events found, but nothing arrives live — the live source is wrong. Check which unit actually exists:

$ systemctl status ssh sshd
$ journalctl -u ssh -u sshd -n 20

Put whichever exists in source.units. If sshd does not log to the journal on your system, read the file instead:

[source]
kind = "file"
path = "/var/log/auth.log"   # /var/log/secure on the RHEL family

No events at all in the replay — the log format is not being parsed. Open an issue with a few redacted lines; it is a one-line fix in sshd.rs.

Events found and sent, but the channel is silent — the destination is the problem:

$ sudo -u gabier gabier check --config /etc/gabier/config.toml

journalctl: permission denied

Reading the journal requires membership of the systemd-journal group. The shipped unit grants it to the service account:

[Service]
User=gabier
SupplementaryGroups=systemd-journal

If you are running the binary by hand, run it as that account — sudo -u gabier gabier check — rather than as yourself.

Discord or Slack replied with an error

$ sudo -u gabier gabier check --config /etc/gabier/config.toml

check probes every destination and prints what each one answered, with the webhook token masked. A 401 or 404 means the webhook was deleted or the URL is truncated; create a new one and paste the whole thing. See Discord and Slack for the service-specific responses.

Too many messages

The throttle is the right lever, not the event toggles:

[throttle]
window_secs = 900   # longer window, fewer summaries
burst = 0           # never send an individual failure

With burst = 0 you get one summary per IP per window and nothing else. If you want successes only, turn the rest off:

[events]
accepted = true
failed = false
invalid_user = false
closed = false

The service will not start

$ systemctl status gabier
$ journalctl -u gabier -n 50 --no-pager
$ sudo -u gabier gabier check --config /etc/gabier/config.toml

In order of likelihood:

  1. No destination configured. At least one of [discord] and [slack] must have a usable webhook, from the config or from /etc/gabier/env.
  2. The config is unreadable by the service account. install.sh sets root:gabier and mode 0640; a config you created by hand may not be.
  3. No config found. The unit passes --config /etc/gabier/config.toml explicitly, so the file must be exactly there.

Too few failures counted

sshd allows three password attempts per connection, on the same source port. Gabier folds those into one event deliberately — otherwise every single attempt would be three notifications — so a burst summary under-counts relative to a raw grep of the journal. This is expected.

Still stuck

Open an issue with the output of gabier check (the token is masked), your distribution and systemd version, and the replay --dry-run output for a few lines around the login that should have fired.