ls ~/errors
Error code lexicon.
The messages that keep coming up in support — what they mean, how to check them and what helps.
550 5.7.1SMTP 550 5.7.1: relay access denied and policy rejectionsThe server rejects the message for policy reasons – usually because the sender is not authenticated and the server would have to relay mail to a domain it is not responsible for.550 5.7.26SMTP 550 5.7.26 and 5.7.23: unauthenticated emailGmail (and Microsoft with 5.7.509/5.7.515) rejects the message because it is not authenticated via SPF or DKIM in alignment with the From domain.421 4.7.0SMTP 421 4.7.0: temporarily rate limited, try again laterThe receiving server temporarily refuses more mail from your IP because volume, reputation or authentication look suspicious – messages stay in the queue and are retried later.554 5.7.1SMTP 554 5.7.1: rejected due to blocklist or spamThe receiver permanently rejects the connection or message because the sending IP is on a DNS blocklist (DNSBL) or the content was classified as spam.451 4.7.1SMTP 451 4.7.1: greylisting and temporary rejectionThe receiver deliberately rejects the first delivery attempt from an unknown sender; a properly working mail server retries after a few minutes and gets through.535 5.7.8SMTP 535 5.7.8: authentication failed – login rejectedThe server rejected the SMTP AUTH login. The connection works, but username, password or auth mechanism do not match what the backend (usually Dovecot SASL) expects.530 5.7.0SMTP 530 5.7.0: must issue a STARTTLS command firstOn this port the server accepts neither AUTH nor MAIL FROM over an unencrypted connection. The client has to send STARTTLS first or use implicit TLS on port 465.552 5.2.2SMTP 552 5.2.2: mailbox full / quota exceededThe receiving server refuses the message because the recipient's mailbox has hit its quota. The sender gets a bounce and the message is not delivered.550 5.1.1SMTP 550 5.1.1: user unknown / recipient address rejectedThe target server does not know the recipient address and rejects the message permanently. Either the address is wrong or it is missing from the server's tables.553 5.7.1SMTP 553 5.7.1: sender address rejected: not owned by userPostfix compares the sender address (MAIL FROM) with the authenticated SASL user. If smtpd_sender_login_maps says the address does not belong to that user, the message is rejected.does not resolve to addressPostfix warning: hostname … does not resolve to addressPostfix found a name for the connecting server's IP via PTR, but that name does not point back to the same IP. The client is then treated as “unknown”.auth failedDovecot: imap-login Disconnected (auth failed)A client logged in to IMAP or POP3 and was refused. That can be a single user with a wrong password, a broken passdb or an attack.502HTTP 502 Bad Gateway with nginx and PHP-FPMnginx could not get a valid response from the upstream (PHP-FPM, Node.js, Gunicorn, a Docker container) – the backend is down, unreachable or crashed.504HTTP 504 Gateway Timeout with nginxnginx reached the backend but did not get a response within the configured timeout (60 seconds by default).413HTTP 413 Request Entity Too Large in nginxThe request body (usually an upload) is larger than the limit nginx or a proxy in front of it allows – the request never reaches the application.403HTTP 403 Forbidden (nginx): directory index is forbiddennginx understands the request but refuses access. The exact reason is almost always in error.log – “directory index … is forbidden”, “Permission denied” or “access forbidden by rule”.500HTTP 500 Internal Server Error: find the cause in the logsThe application or web server failed while handling the request. The status code says nothing about why – the reason is in the nginx error.log, the PHP-FPM log or the application log.503HTTP 503 Service Unavailable: who is sending it?The service is temporarily unavailable. First find out who generates the 503: nginx itself (rate limit, return 503), the application (maintenance mode) or a load balancer in front.400400 Bad Request: request header or cookie too largeA single request header or the cookie line is larger than the buffer nginx reserves for it. The default is 4 buffers of 8 KB – large SSO cookies or JWTs exceed that quickly.too big headernginx: upstream sent too big header while reading response headerThe backend's response headers (usually cookies) are larger than the buffer nginx reserves for them; nginx gives up and returns 502 Bad Gateway.Primary script unknownnginx + PHP-FPM: “Primary script unknown” / “File not found.”nginx passes the request to PHP-FPM, but PHP-FPM finds no file at the given path or may not read it. The browser just shows “File not found.”.111: Connection refusednginx: connect() failed (111: connection refused) to upstreamnginx reaches the backend host, but nothing listens on the target port. The OS refuses the connection immediately and the user sees 502 Bad Gateway.423 LockedNextcloud: "file is locked" and HTTP 423 LockedNextcloud refuses access because a lock still exists for the file in transactional file locking – usually a stale lock after an aborted upload or crash.maintenance modeNextcloud: fixing "maintenance mode is enabled"Nextcloud is in maintenance mode and blocks the web UI, clients and most occ commands – either set on purpose or left behind by an update that did not finish cleanly.untrusted domainNextcloud: access through untrusted domainNextcloud was opened via a hostname or IP that is not listed in trusted_domains, so it refuses to log you in.data directory readableNextcloud: “your data directory is readable by other users”On start Nextcloud checks whether other system users can read or list the data directory. If they can, Nextcloud refuses to run or shows the warning.Internal Server ErrorNextcloud: internal server error with request IDNextcloud hit an error while handling the request. The request ID shown is the key: with it you find exactly the matching entry in nextcloud.log.CSRF check failedNextcloud: CSRF check failed on login or saveThe CSRF token in the form does not match the session on the server. Almost always the session was lost between loading and submitting – not an attack.APCu not availableNextcloud: memcache \OC\Memcache\APCu not available for local cacheNextcloud is configured to use APCu as local cache, but the PHP instance currently running has APCu disabled. Almost always this only affects PHP CLI – occ and cron.php.missing indexesNextcloud: “the database is missing some indexes”After an update Nextcloud defined new indexes but did not create them automatically, because that can take long on large tables. Without them queries get slow.Last background jobNextcloud: “last background job execution ran … ago”Nextcloud handles cleanup, notifications, file versions and trash via background jobs. The warning means these jobs have not run for a while.SAML signatureSAML error: signature validation failed in NextcloudNextcloud (user_saml with php-saml) could not verify the SAML response signature with the stored IdP certificate and rejects the login.invalid_grantOIDC/OAuth2: invalid_grant at the token endpointThe identity provider rejects the authorization code or refresh token the client wants to exchange. The login fails right after the redirect back from the IdP.redirect_uri_mismatchOIDC: redirect_uri_mismatch / invalid redirect_uriIn the authorize request the client sends a redirect_uri that is not registered exactly like that at the identity provider. The IdP stops before the user can log in.NotBeforeSAML: “not yet valid” – clock skew on NotBeforeEvery SAML assertion is only valid within a time window (NotBefore to NotOnOrAfter). If the service provider's clock differs from the IdP's, the assertion counts as not yet or no longer valid.acme:error:unauthorizedLet's Encrypt: urn:ietf:params:acme:error:unauthorizedLet's Encrypt could not fetch the challenge file under /.well-known/acme-challenge/ from the right server and therefore refuses to issue the certificate.unable to get local issuer certificateSSL: unable to get local issuer certificateThe client cannot build the chain from the server certificate to a trusted root CA. Either the server does not send the intermediates, or the client lacks the root CA.SSL_ERROR_RX_RECORD_TOO_LONGSSL_ERROR_RX_RECORD_TOO_LONG in FirefoxThe browser expects a TLS handshake on port 443 but receives plain text, usually an HTTP response. Firefox reads those bytes as an oversized TLS record and gives up.ERR_CERT_COMMON_NAME_INVALIDNET::ERR_CERT_COMMON_NAME_INVALIDThe certificate is valid but not issued for this name. Browsers only check the Subject Alternative Names (SAN) – if the requested hostname is missing there, you get this error.certificate has expiredSSL: certificate has expired / ERR_CERT_DATE_INVALIDThe served certificate is outside its validity period. Often it was renewed long ago, but the web server still serves the old file from memory.rateLimitedLet's Encrypt: too many certificates already issuedLet's Encrypt limits how many certificates are issued in a time window. The error names the limit that was hit and when you can try again (“retry after”).SERVFAILDNS SERVFAIL: find the cause and fix itThe resolver could not produce a valid answer – either the authoritative nameservers are not answering correctly or DNSSEC validation fails.NXDOMAINDNS NXDOMAIN: domain or hostname does not existThe responsible name server answered authoritatively that this name does not exist. That differs from SERVFAIL or a timeout – the question is which server says so and why.CNAME at apexDNS: CNAME at the apex – “CNAME and other data”A CNAME may not coexist with other records of the same name. The zone apex (example.com) always has SOA and NS – so a CNAME is not allowed there.ENOSPCNo space left on device although df shows free spaceThe kernel returns ENOSPC because a filesystem resource is exhausted – not necessarily disk space, often the inodes or space held by deleted files that are still open.Permission denied (publickey)SSH: permission denied (publickey)The server only allows key login and accepted none of the keys offered. The cause shows up in the client with -vvv and in the server log.EROFSLinux: read-only file system (EROFS)A write was refused because the filesystem is read-only. Often the kernel switched it itself after an error to prevent further damage.EMFILELinux: too many open files (EMFILE, error 24)A process hit its file descriptor limit. That includes files but also sockets and pipes – on web servers mostly open connections.Out of memoryLinux: out of memory – killed process (OOM killer)The system or a cgroup ran out of memory. The kernel ended the process with the highest OOM score – not necessarily the one that caused the problem.control process exitedsystemd: job for X.service failed (control process exited)systemd tried to start or reload the service and the start command (ExecStart or ExecStartPre) exited with an error. The actual cause is in the service's journal.