ls ~/errors
Error code lexicon.
The messages that keep coming up in support — what they mean, how to check them and what helps.
550 5.7.1SMTP 550 5.7.1: relay access denied and policy rejectionsThe server rejects the message for policy reasons – usually because the sender is not authenticated and the server would have to relay mail to a domain it is not responsible for.550 5.7.26SMTP 550 5.7.26 and 5.7.23: unauthenticated emailGmail (and Microsoft with 5.7.509/5.7.515) rejects the message because it is not authenticated via SPF or DKIM in alignment with the From domain.421 4.7.0SMTP 421 4.7.0: temporarily rate limited, try again laterThe receiving server temporarily refuses more mail from your IP because volume, reputation or authentication look suspicious – messages stay in the queue and are retried later.554 5.7.1SMTP 554 5.7.1: rejected due to blocklist or spamThe receiver permanently rejects the connection or message because the sending IP is on a DNS blocklist (DNSBL) or the content was classified as spam.451 4.7.1SMTP 451 4.7.1: greylisting and temporary rejectionThe receiver deliberately rejects the first delivery attempt from an unknown sender; a properly working mail server retries after a few minutes and gets through.535 5.7.8SMTP 535 5.7.8: authentication failed – login rejectedThe server rejected the SMTP AUTH login. The connection works, but username, password or auth mechanism do not match what the backend (usually Dovecot SASL) expects.530 5.7.0SMTP 530 5.7.0: must issue a STARTTLS command firstOn this port the server accepts neither AUTH nor MAIL FROM over an unencrypted connection. The client has to send STARTTLS first or use implicit TLS on port 465.552 5.2.2SMTP 552 5.2.2: mailbox full / quota exceededThe receiving server refuses the message because the recipient's mailbox has hit its quota. The sender gets a bounce and the message is not delivered.550 5.1.1SMTP 550 5.1.1: user unknown / recipient address rejectedThe target server does not know the recipient address and rejects the message permanently. Either the address is wrong or it is missing from the server's tables.553 5.7.1SMTP 553 5.7.1: sender address rejected: not owned by userPostfix compares the sender address (MAIL FROM) with the authenticated SASL user. If smtpd_sender_login_maps says the address does not belong to that user, the message is rejected.does not resolve to addressPostfix warning: hostname … does not resolve to addressPostfix found a name for the connecting server's IP via PTR, but that name does not point back to the same IP. The client is then treated as “unknown”.auth failedDovecot: imap-login Disconnected (auth failed)A client logged in to IMAP or POP3 and was refused. That can be a single user with a wrong password, a broken passdb or an attack.status=deferred Connection timed outPostfix: status=deferred (connect to …:25: Connection timed out)Your mail server cannot open a connection to the recipient's server on port 25, so it keeps the message in the queue and tries again later. Very often the cause is a blocked outgoing port 25.Host or domain name not foundPostfix: Host or domain name not found. Name service error for name=… type=MXPostfix could not look up the recipient domain in DNS. Either your server's resolver does not work (often a chrooted Postfix without resolv.conf), or the domain itself has a problem.SASL authentication failedPostfix: SASL authentication failed; cannot authenticate to server (no mechanism available)Postfix tried to log in at your smart host (relay) and failed. This is the outgoing side: your server is the client. The cause is a missing SASL module, wrong credentials, or the login being offered only after TLS starts.Dovecot Permission deniedDovecot: Error: open() failed: Permission denied (mailbox)The user Dovecot runs as for this mailbox may not read or write the mail files. Typical after a migration, a new server, or when Postfix delivers as a different user than Dovecot reads.dkim=fail body hash did not verifyDKIM: dkim=fail (body hash did not verify)The signature is intact, but the body of the message no longer matches the hash that was signed. Something changed the text after signing: a footer, a virus banner, a disclaimer, rewritten links or even changed line endings.not accepted due to domain's DMARC policy550 5.7.1 Unauthenticated email is not accepted due to domain's DMARC policyThe recipient checked your domain's DMARC policy, and the message passed neither SPF nor DKIM in a way that matches the From domain, so it was rejected as the policy says (p=reject or quarantine).554 5.7.1 Relay access deniedSMTP: 554 5.7.1 Relay access deniedThe server is asked to deliver mail to a domain it does not own, from a client it does not trust. Refusing that is correct, it is what stops an open relay. The task is to find out whether your client should have logged in, or your own domain is not set up.450 4.1.8 Sender address rejected: Domain not foundSMTP: 450 4.1.8 Sender address rejected: Domain not foundThe receiving server looked up the domain in the sender address and found neither an A nor an MX record, so it refuses the mail with reject_unknown_sender_domain. Typical sources are servers that send as root@hostname.localdomain.mail for example.com loops back to myselfPostfix: mail for example.com loops back to myselfPostfix looked up where to send the mail and ended up at itself, so it stops instead of looping forever. The routing says this host is responsible, but the local configuration does not accept the domain.550 5.4.1 Recipient address rejected: Access deniedSMTP: 550 5.4.1 Recipient address rejected: Access deniedThis bounce comes from Exchange Online when it protects itself against address harvesting. The mail is refused at the edge because it cannot find the recipient in the directory. It looks like a permission problem, but it nearly always means the address does not exist there.Connection timed out on port 25Port 25 blocked: SMTP timeout on direct deliveryYour mail server cannot reach the recipient's MX on port 25 because outbound 25 is blocked. Messages stay queued and are retried.502HTTP 502 Bad Gateway with nginx and PHP-FPMnginx could not get a valid response from the upstream (PHP-FPM, Node.js, Gunicorn, a Docker container) – the backend is down, unreachable or crashed.504HTTP 504 Gateway Timeout with nginxnginx reached the backend but did not get a response within the configured timeout (60 seconds by default).413HTTP 413 Request Entity Too Large in nginxThe request body (usually an upload) is larger than the limit nginx or a proxy in front of it allows – the request never reaches the application.403HTTP 403 Forbidden (nginx): directory index is forbiddennginx understands the request but refuses access. The exact reason is almost always in error.log – “directory index … is forbidden”, “Permission denied” or “access forbidden by rule”.500HTTP 500 Internal Server Error: find the cause in the logsThe application or web server failed while handling the request. The status code says nothing about why – the reason is in the nginx error.log, the PHP-FPM log or the application log.503HTTP 503 Service Unavailable: who is sending it?The service is temporarily unavailable. First find out who generates the 503: nginx itself (rate limit, return 503), the application (maintenance mode) or a load balancer in front.400400 Bad Request: request header or cookie too largeA single request header or the cookie line is larger than the buffer nginx reserves for it. The default is 4 buffers of 8 KB – large SSO cookies or JWTs exceed that quickly.ERR_TOO_MANY_REDIRECTSERR_TOO_MANY_REDIRECTS: example.com redirected you too many timesTwo places keep sending the browser to each other. The browser follows the redirects, gives up after a limit and shows this error. The loop is always in the combination of server, CDN and application.Error 521 / 522 (origin unreachable behind CDN)Error 521 (Web server is down) and 522 (Connection timed out) behind a CDNThese codes come from the CDN (for example Cloudflare), not from your server. The CDN reached its own edge but could not talk to your origin: 521 means the connection was refused, 522 means it timed out.Mixed Content: requested an insecure resourceMixed Content: The page was loaded over HTTPS, but requested an insecure resource ... This request has been blockedThe page itself uses HTTPS, but it tries to load a script, stylesheet, font, image or request over plain HTTP. Browsers block active content (scripts, styles, requests) and warn or upgrade passive content such as images. Styles and scripts then fail to load.429 Too Many RequestsHTTP 429 Too Many RequestsThe server or an intermediate layer says that this client sent too many requests in a given time. It is a rate limit working as designed. The task is to find which layer applies it and whether the limit or the client is wrong.404 Not Foundnginx: 404 Not Foundnginx looked for a file at the path it built from root or alias and the request URI, and did not find it. The error log shows the exact path it tried. Usually the path, the routing rule or the server block is wrong.too big headernginx: upstream sent too big header while reading response headerThe backend's response headers (usually cookies) are larger than the buffer nginx reserves for them; nginx gives up and returns 502 Bad Gateway.Primary script unknownnginx + PHP-FPM: “Primary script unknown” / “File not found.”nginx passes the request to PHP-FPM, but PHP-FPM finds no file at the given path or may not read it. The browser just shows “File not found.”.111: Connection refusednginx: connect() failed (111: connection refused) to upstreamnginx reaches the backend host, but nothing listens on the target port. The OS refuses the connection immediately and the user sees 502 Bad Gateway.98: Address already in usenginx: bind() failed (98: Address already in use)nginx cannot open its port because another process already listens on it – often Apache, a second nginx or a Docker container.110: Connection timed outnginx: upstream timed out (110: Connection timed out)The backend (PHP-FPM, Node, Gunicorn) did not answer within nginx's time limit, so nginx gives up and returns 504 Gateway Timeout.rewrite or internal redirection cyclenginx: rewrite or internal redirection cycle while internally redirecting to "/index.html"nginx redirected the request internally again and again and gave up after 10 steps, answering 500. Typically try_files falls back to a file that does not exist under the current root.worker_connections are not enoughnginx: [alert] 768 worker_connections are not enoughOne nginx worker has used up all connections it may hold at once. New requests wait or fail. With proxy_pass every request needs two connections (client and upstream), so the limit is reached sooner than the visitor count suggests.could not build server_names_hashnginx: [emerg] could not build server_names_hash, you should increase server_names_hash_bucket_sizenginx stores all server_name values in a hash table. A very long name or many names no longer fit into one bucket, so the configuration test fails and nginx will not start or reload.upstream prematurely closed connectionnginx: upstream prematurely closed connection while reading response header from upstreamnginx sent the request to the backend, but the backend closed the connection before it sent a response. The user sees 502 Bad Gateway. The backend crashed, was killed, restarted, or does not speak the protocol nginx uses.connect() to unix:/run/php/php-fpm.sock failed (13: Permission denied)nginx: connect() to unix:/run/php/php-fpm.sock failed (13: Permission denied) while connecting to upstreamnginx found the PHP-FPM socket but is not allowed to open it. The visitor gets 502 Bad Gateway. The owner, group or mode of the socket do not match the user nginx runs as.cannot load certificatenginx: [emerg] cannot load certificate (PEM no start line, key values mismatch)nginx could not read the certificate or the key it was told to use, so it refuses to start or reload. The file is missing or unreadable, it is not PEM, it is the wrong file, or the key does not belong to the certificate.423 LockedNextcloud: "file is locked" and HTTP 423 LockedNextcloud refuses access because a lock still exists for the file in transactional file locking – usually a stale lock after an aborted upload or crash.maintenance modeNextcloud: fixing "maintenance mode is enabled"Nextcloud is in maintenance mode and blocks the web UI, clients and most occ commands – either set on purpose or left behind by an update that did not finish cleanly.untrusted domainNextcloud: access through untrusted domainNextcloud was opened via a hostname or IP that is not listed in trusted_domains, so it refuses to log you in.data directory readableNextcloud: “your data directory is readable by other users”On start Nextcloud checks whether other system users can read or list the data directory. If they can, Nextcloud refuses to run or shows the warning.Internal Server ErrorNextcloud: internal server error with request IDNextcloud hit an error while handling the request. The request ID shown is the key: with it you find exactly the matching entry in nextcloud.log.CSRF check failedNextcloud: CSRF check failed on login or saveThe CSRF token in the form does not match the session on the server. Almost always the session was lost between loading and submitting – not an attack.APCu not availableNextcloud: memcache \OC\Memcache\APCu not available for local cacheNextcloud is configured to use APCu as local cache, but the PHP instance currently running has APCu disabled. Almost always this only affects PHP CLI – occ and cron.php.missing indexesNextcloud: “the database is missing some indexes”After an update Nextcloud defined new indexes but did not create them automatically, because that can take long on large tables. Without them queries get slow.Last background jobNextcloud: “last background job execution ran … ago”Nextcloud handles cleanup, notifications, file versions and trash via background jobs. The warning means these jobs have not run for a while.reverse proxy header configuration is incorrectNextcloud: the reverse proxy header configuration is incorrectNextcloud sees forwarded headers (X-Forwarded-For) from a proxy it does not trust, or no proxy is configured although one is in front. Visitors then appear with the wrong IP, or redirects and links use http instead of https.Cannot write into "config" directoryNextcloud: Cannot write into "config" directory!The web server user may not write to config/, so the installer, updates or settings cannot save config.php. Usually the owner or the permissions are wrong after a copy, restore or move.Too many requestsNextcloud: Too many requests. There were too many requests from your networkNextcloud's brute-force protection has slowed down or blocked your IP address after repeated failed logins. Often the real cause is a proxy that makes all users look like one address.Your data directory is invalidNextcloud: Your data directory is invalid (.ocdata missing)Nextcloud refuses to start because it does not find the marker file .ocdata in the data directory. This protects you: Nextcloud will not write into a folder that might be an empty, unmounted mount point.RedisException: Redis went awayNextcloud: RedisException: Redis went awayNextcloud uses Redis for file locking and caching. When the connection breaks, requests fail, uploads hang or you see 500 errors. The question is whether Redis is gone or Nextcloud cannot reach it.Your web server is not properly set up to resolve "/.well-known/caldav"Nextcloud: Your web server is not properly set up to resolve "/.well-known/caldav"Calendar and contact apps find your server through the /.well-known/caldav and /.well-known/carddav addresses. The overview warns when these do not redirect to /remote.php/dav. Sync still works if you enter the full DAV URL by hand.Some files have not passed the integrity checkNextcloud: Some files have not passed the integrity checkNextcloud compares its code files with a signed list of hashes. Anything that was changed, deleted or added inside the program folder is reported. It is a warning about your files, not a data loss.Updates between multiple major versions and downgrades are unsupportedNextcloud: Updates between multiple major versions and downgrades are unsupportedNextcloud only upgrades from one major version to the next. The message appears when you skip a major, or when the code you installed is older than the version recorded in the database. Never force it by editing the version number.SAML signatureSAML error: signature validation failed in NextcloudNextcloud (user_saml with php-saml) could not verify the SAML response signature with the stored IdP certificate and rejects the login.invalid_grantOIDC/OAuth2: invalid_grant at the token endpointThe identity provider rejects the authorization code or refresh token the client wants to exchange. The login fails right after the redirect back from the IdP.redirect_uri_mismatchOIDC: redirect_uri_mismatch / invalid redirect_uriIn the authorize request the client sends a redirect_uri that is not registered exactly like that at the identity provider. The IdP stops before the user can log in.NotBeforeSAML: “not yet valid” – clock skew on NotBeforeEvery SAML assertion is only valid within a time window (NotBefore to NotOnOrAfter). If the service provider's clock differs from the IdP's, the assertion counts as not yet or no longer valid.Invalid audience for this ResponseSAML: Invalid audience for this Response (AudienceRestriction)The identity provider addresses its assertion to one audience, the Entity ID of the service provider. Your app checks that this value equals its own Entity ID and refuses otherwise. Signature and time checks are separate, so this is purely a name mismatch.invalid_clientOIDC: invalid_client (client authentication failed)After the user signs in, your app calls the token endpoint and has to prove who it is with its client ID and secret. invalid_client means that proof was refused. It is about the app's identity, not the user's code or redirect address.acme:error:unauthorizedLet's Encrypt: urn:ietf:params:acme:error:unauthorizedLet's Encrypt could not fetch the challenge file under /.well-known/acme-challenge/ from the right server and therefore refuses to issue the certificate.unable to get local issuer certificateSSL: unable to get local issuer certificateThe client cannot build the chain from the server certificate to a trusted root CA. Either the server does not send the intermediates, or the client lacks the root CA.SSL_ERROR_RX_RECORD_TOO_LONGSSL_ERROR_RX_RECORD_TOO_LONG in FirefoxThe browser expects a TLS handshake on port 443 but receives plain text, usually an HTTP response. Firefox reads those bytes as an oversized TLS record and gives up.ERR_CERT_COMMON_NAME_INVALIDNET::ERR_CERT_COMMON_NAME_INVALIDThe certificate is valid but not issued for this name. Browsers only check the Subject Alternative Names (SAN) – if the requested hostname is missing there, you get this error.certificate has expiredSSL: certificate has expired / ERR_CERT_DATE_INVALIDThe served certificate is outside its validity period. Often it was renewed long ago, but the web server still serves the old file from memory.rateLimitedLet's Encrypt: too many certificates already issuedLet's Encrypt limits how many certificates are issued in a time window. The error names the limit that was hit and when you can try again (“retry after”).Timeout during connect (likely firewall problem)Certbot: Timeout during connect (likely firewall problem)Let's Encrypt could not open a connection to your server on port 80 to fetch the challenge file. Something blocks it on the way: a firewall, a wrong address, or an IPv6 address that does not answer.ERR_SSL_VERSION_OR_CIPHER_MISMATCHERR_SSL_VERSION_OR_CIPHER_MISMATCH (SSL_ERROR_NO_CYPHER_OVERLAP)The browser and the server could not agree on a TLS version or cipher. Either the server offers only outdated protocols, or its settings are so strict that modern clients find no match.NET::ERR_CERT_AUTHORITY_INVALIDNET::ERR_CERT_AUTHORITY_INVALID: certificate authority not trustedThe browser got a certificate but cannot trace it back to a certificate authority it trusts. This is about who signed it, not about the date or the name.NET::ERR_CERT_DATE_INVALIDNET::ERR_CERT_DATE_INVALID: certificate date is invalidA certificate is only valid between two dates. The browser compares them with its own clock. The error means that today, as seen by the client, lies outside that window, so either the certificate is out of date or the client's clock is wrong.Failed to renew certificatecertbot renew: Failed to renew certificate (all renewals failed)Let's Encrypt certificates last a short time, so renewal must work on its own. When certbot renew fails, the certificate keeps ageing until the browser shows an expiry warning. The cause is usually in the saved renewal settings, not in Let's Encrypt.SERVFAILDNS SERVFAIL: find the cause and fix itThe resolver could not produce a valid answer – either the authoritative nameservers are not answering correctly or DNSSEC validation fails.NXDOMAINDNS NXDOMAIN: domain or hostname does not existThe responsible name server answered authoritatively that this name does not exist. That differs from SERVFAIL or a timeout – the question is which server says so and why.CNAME at apexDNS: CNAME at the apex – “CNAME and other data”A CNAME may not coexist with other records of the same name. The zone apex (example.com) always has SOA and NS – so a CNAME is not allowed there.status: REFUSEDDNS: status: REFUSED (query refused)The server was reached and answered on purpose with “no”. It is a policy decision, not a timeout. Either it does not serve the zone you asked for, or it does not do recursion for your address.connection timed out; no servers could be reachedDNS: connection timed out; no servers could be reachedThe query got no answer at all, not even a refusal. The packet never arrived or the reply never came back. This points to the path or the server process, not to the domain.curl: (6) Could not resolve hostcurl: (6) Could not resolve hostcurl could not turn the host name into an IP address, so it never tried to connect. The question is whether the name is wrong, the DNS record is missing, or only this machine cannot resolve it.ENOSPCNo space left on device although df shows free spaceThe kernel returns ENOSPC because a filesystem resource is exhausted – not necessarily disk space, often the inodes or space held by deleted files that are still open.Permission denied (publickey)SSH: permission denied (publickey)The server only allows key login and accepted none of the keys offered. The cause shows up in the client with -vvv and in the server log.EROFSLinux: read-only file system (EROFS)A write was refused because the filesystem is read-only. Often the kernel switched it itself after an error to prevent further damage.EMFILELinux: too many open files (EMFILE, error 24)A process hit its file descriptor limit. That includes files but also sockets and pipes – on web servers mostly open connections.Out of memoryLinux: out of memory – killed process (OOM killer)The system or a cgroup ran out of memory. The kernel ended the process with the highest OOM score – not necessarily the one that caused the problem.control process exitedsystemd: job for X.service failed (control process exited)systemd tried to start or reload the service and the start command (ExecStart or ExecStartPre) exited with an error. The actual cause is in the service's journal.permission denied docker.sockDocker: permission denied while trying to connect to the daemon socketYour user may not use /var/run/docker.sock. Only root and members of the docker group are allowed to talk to the Docker daemon.REMOTE HOST IDENTIFICATION HAS CHANGEDSSH: WARNING: REMOTE HOST IDENTIFICATION HAS CHANGEDThe server presents a different host key than the one stored in your known_hosts. Often harmless (a reinstall), but it is the exact warning that would also appear in a man-in-the-middle attack.port 22: Connection timed outSSH: connect to host port 22: Connection timed outYour packets get no answer at all. Unlike “Connection refused”, nothing replies: a firewall drops the traffic, the address is wrong, or the machine is off or unreachable.start-limit-hitsystemd: Start request repeated too quickly (start-limit-hit)The service crashed again and again in a short time, so systemd stopped restarting it to protect the system. The limit is only the symptom – the service keeps failing for another reason.Could not get lock /var/lib/dpkg/lock-frontendapt: Could not get lock /var/lib/dpkg/lock-frontendAnother process is using the package system right now, most often the automatic updater. apt and dpkg allow only one at a time, so yours has to wait.Too many authentication failuresSSH: Received disconnect: Too many authentication failuresThe server counts every key your SSH agent offers as a failed attempt. With many keys loaded it reaches MaxAuthTries (6 by default) before your password or the right key is even tried.E: Unable to locate packageapt: E: Unable to locate packageapt does not find the package in any package list it knows. Either the lists are empty or old, the name is wrong for your release, or the repository that carries the package is not enabled.dpkg was interrupted, you must manually run 'dpkg --configure -a'dpkg was interrupted, you must manually run 'dpkg --configure -a' to correct the problemA previous install or upgrade did not finish. dpkg left packages half unpacked or half configured and refuses new work until they are completed. Usually one command fixes it.Temporary failure in name resolutionTemporary failure in name resolution (ping, apt, curl, ssh)The program asked the system resolver for an IP address and got no answer at all. This is not “domain does not exist”. The server cannot reach a working DNS server, or has none configured.is not in the sudoers file. This incident will be reported.sudo: user is not in the sudoers file. This incident will be reported.sudo works, but the policy does not allow this user. On Debian and Ubuntu the usual rule is: members of the group sudo may use it. The user is not in that group, or the group change is not active yet.Argument list too longbash: /usr/bin/rm: Argument list too longThe shell replaced * with every matching file name, and the list got larger than the kernel allows for one command. The command never started. It is a limit of the call, not of the disk.wrong fs type, bad option, bad superblockmount: wrong fs type, bad option, bad superblock on /dev/sdX, missing codepage or helper programmount is a catch-all message. It means the kernel or a helper program could not mount the device with the given type and options. The kernel log usually names the real reason.Bind for 0.0.0.0:80 failed: port is already allocatedDocker: Bind for 0.0.0.0:80 failed – port is already allocatedDocker cannot bind the host port because something already holds it: another container, a host service, or a stuck docker-proxy process.ssh: connect to host port 22: Connection refusedssh: connect to host … port 22: Connection refusedThe packet arrived and was actively rejected: no service listens on that port. That is what separates this error from a firewall timeout.rsync error: some files/attrs were not transferred (code 23)rsync error: some files/attrs were not transferred (code 23)rsync finished the run but did not copy everything. Code 23 is a summary – the lines above it name the file and the reason.gzip: stdin: unexpected end of filetar/gzip: Unexpected EOF in archive – unexpected end of fileThe archive ends in the middle of the data. Bytes are missing, so tar cannot read the last member and aborts.NO_PUBKEY – The following signatures couldn't be verifiedapt: NO_PUBKEY – The following signatures couldn't be verifiedapt does not know the public key that signed the repository. Until the key is present, packages from that source are not installed.cron: job is listed but never runsCron job not running – even though the entry existsCron starts with a minimal environment. Scripts that work in your shell fail there because of PATH, relative paths or missing variables.ERROR 2002 (HY000)MySQL / MariaDB: ERROR 2002 (HY000) can't connect through socketThe client looks for the server's Unix socket file and does not find a running server there – usually the database is stopped, or client and server use different socket paths.ERROR 1045 (28000)MySQL / MariaDB: ERROR 1045 (28000) access denied for userThe server was reached, but it rejects the login: wrong password, a user that does not exist for this host, or an authentication plugin that does not allow a password.ERROR 1040 (08004): Too many connectionsMySQL / MariaDB: ERROR 1040 (08004): Too many connectionsThe server has reached max_connections and rejects every new client. Raising the limit alone rarely solves it. The question is why connections stay open: leaking apps, slow queries or a traffic peak.MySQL server has gone awayERROR 2006 (HY000): MySQL server has gone awayThe client sent a query on a connection that the server had already closed. It is a symptom with three common sources: the server closed an idle connection, the query was too big, or the server restarted.FATAL: password authentication failed for userPostgreSQL: FATAL: password authentication failed for userThe server found a matching pg_hba.conf line that asks for a password, and the password was not accepted. The server log names the matching line and usually the reason.FATAL: no pg_hba.conf entry for hostPostgreSQL: FATAL: no pg_hba.conf entry for host, user, databaseThe server is reachable, but its access file pg_hba.conf has no line that fits this client: address, user, database and SSL mode. It rejects before it even asks for a password.Table is marked as crashed and should be repairedMariaDB / MySQL: Table is marked as crashed and should be repaired (ERROR 1194 / 145)The table files of a MyISAM or Aria table are inconsistent, usually because the server stopped in the middle of a write. The table is blocked until it is checked and repaired. InnoDB tables recover on their own and rarely show this.ERROR 1064 (42000)MariaDB/MySQL: ERROR 1064 (42000) – syntax errorThe server did not understand the statement: the SQL is not valid – often a reserved word used as a column name, MySQL-8-only syntax on MariaDB, or an unescaped quote.ERROR 1067 (42000)ERROR 1067 (42000): Invalid default value for …The server rejects a column default: it is invalid for the type or conflicts with the active sql_mode, for example a zero date under NO_ZERO_DATE.ERROR 2003 (HY000)ERROR 2003 (HY000): Can't connect to MySQL server (10061)The client reached the host but the port refused the connection: the service is not running, listens on 127.0.0.1 only, or a firewall drops the packet.FATAL: sorry, too many clients alreadyPostgreSQL: FATAL – sorry, too many clients alreadyPostgreSQL has used every connection slot and refuses new clients until one is freed. The cause is almost always a pool or a leak, not the limit itself.OOM command not allowed when used memory > 'maxmemory'Redis: OOM command not allowed when used memory > 'maxmemory'Memory is above maxmemory and the noeviction policy forbids evicting keys. Writes are rejected while reads still work.Allowed memory size exhaustedPHP Fatal error: Allowed memory size exhaustedA PHP script used more memory than memory_limit allows, so PHP stopped it. The default of 128 MB is often too little for image processing, imports or large plugins.Maximum execution time exceededPHP Fatal error: Maximum execution time of 30 seconds exceededA PHP script ran longer than max_execution_time (30 seconds by default for web requests) and PHP stopped it.server reached pm.max_children settingPHP-FPM: [pool www] server reached pm.max_children setting, consider raising itAll PHP workers of the pool are busy. New requests queue until one is free, so pages slow down and nginx may return 502 or 504. The cause is either too few workers for the load, or workers that are stuck on something slow.Call to undefined function mysqli_connect()PHP Fatal error: Uncaught Error: Call to undefined function mysqli_connect()The PHP that runs your page has no mysqli extension loaded. The code is fine, the module is missing for this PHP version or this SAPI (CLI and PHP-FPM have separate configuration).Cannot modify header information - headers already sentPHP Warning: Cannot modify header information - headers already sent by (output started at ...)PHP sends HTTP headers (redirect, cookie, session) only before any body output. Something printed text first, even a single space or a hidden byte. The message names the file and line where the output started.The uploaded file exceeds the upload_max_filesize directive in php.iniPHP: The uploaded file exceeds the upload_max_filesize directive in php.iniPHP rejected the upload because the file is larger than upload_max_filesize, or the whole request is larger than post_max_size. Several limits apply in a chain, from the web server to PHP.PHP Parse error: syntax error, unexpected tokenPHP Parse error: syntax error, unexpected tokenPHP could not compile the file, so it never runs. The reported line is often just the consequence of an error a few lines earlier.FRITZ!BoxFRITZ!Box password forgotten: how to get back inYou can open the login page but no longer know the password. If it was never changed, the default password is printed on the underside of the device.fritz.box öffnet nichtfritz.box won't open: what to doThe name fritz.box only works inside your home network and needs a working link to the box. The IP address 192.168.178.1 often works when the name does not.WerkseinstellungenFactory reset a FRITZ!Box: what you loseA reset deletes all your own settings. It is the last resort, not the first. Make a backup beforehand if you still have access.Kein InternetFRITZ!Box has no internet: what you can check yourselfWi-Fi works but nothing reaches the internet. The key question is whether one device, the whole box or the line is affected.WLAN-KennwortFRITZ!Box: find or change the Wi-Fi passwordThe Wi-Fi password (network key) is printed on the box label from the factory. You can also view and change it in the interface if you have access.WLANSlow Wi-Fi: what can cause it and what you can checkYour device is connected to Wi-Fi but everything feels sluggish. Often the internet line is fine and the problem is the radio path between router and device, or a crowded network.WLAN-AbbruchWi-Fi keeps disconnecting: causes and checksThe connection is up, drops for a moment and comes back. That usually points to a weak or disturbed radio signal, a device problem or an overloaded router.WLAN-KanalChange the Wi-Fi channel: 2.4 GHz or 5 GHz, which fits?Many Wi-Fi problems come from networks interfering with each other. The right band and a free channel often make the connection steadier.Repeater/MeshWi-Fi repeater or mesh: what makes sense for your home?If Wi-Fi does not reach every room, there are several ways to fix it. A repeater is usually the simpler option, a mesh system the more complete one. Placement and connection matter most.Kein InternetWi-Fi connected but no internet: causes and checksThe device is connected to the router, but websites and apps do not load. The fault can be in the device, the router, the provider's line or name resolution.RouterHow to restart your router properly, and when it helpsA restart clears many small faults: stuck connections, a full connection table or a lost dial-in. The order matters, otherwise devices do not get a clean address.GatewayHow to find your IP address and gateway at homeIn a home network the gateway is almost always the router. You need its address to open the router's settings page. Your own IP address shows whether you actually joined the network.DNSChanging the DNS server: when, where and the risksDNS turns names like example.com into addresses. If your provider's DNS server stops answering, websites seem dead even though the line works. A different DNS server can get around it.SpeedtestSpeed test shows less than your plan: why that happensThe contract speed is what the line delivers up to the router. What reaches your device depends on Wi-Fi, cable, device and load. A single test over Wi-Fi therefore says little.PortfreigabePort forwarding not working: DS-Lite, CGNAT, firewallA port forward sends requests from the internet to a device in your home network. It often fails not because of the setting but because your connection has no public IPv4 address at all.DruckerPrinter not found on your home network: what to doThe printer is on, but your PC, Mac or phone cannot find it. Usually the devices are not on the same network, or the printer received a new IP address.Smart-TVSmart TV or Chromecast will not connect to Wi-FiStreaming from phone to TV only works when both are on the same local network. Casting and AirPlay use mDNS, which does not cross network boundaries.GastnetzSet up a guest network on your router: how and whyA guest network gives visitors internet but keeps them apart from your home network. That separation is intended, but it also means printers, TVs and NAS are not reachable from it.Doppel-NATTwo routers in a row: how to spot double NATWhen one router sits behind another, each translates the addresses once. This is called double NAT. Port forwarding, online games and remote access then often fail.FernzugriffReach your NAS or home PC from outside the houseYou only get into the home network from outside if the router allows it. A VPN is the safest way. Port forwarding to the internet is possible but riskier.