Skip to main content
Start with configuration completeness. Alert and case streams are configured independently, and a partially configured stream is treated as an error.

​
A stream will not start

Verify that all required settings for the affected stream are present.

​
Alert stream

​
Case stream

If all options for a stream are omitted, that stream is disabled. If configuration for a stream is started but a required option is missing, that stream is an error.

​
The service is not running

Check the service state:
If the unit file was recently edited:
Follow logs while reproducing the problem:
For automatic recovery, keep:

​
The receiver gets no records

Check the path from the relay host to the destination:
  1. Confirm the destination IP and port for the affected stream.
  2. Confirm the receiver is listening on that TCP port.
  3. Confirm firewall and network policy allow the connection.
  4. Confirm the corresponding alert or case stream is fully enabled.
  5. Confirm the receiver expects newline-delimited JSON over TCP.

​
The receiver cannot parse records

The expected framing is:
Do not configure a parser that expects one large JSON document or traditional RFC syslog framing. Validate mappings with representative events from the deployed relay.

​
Case fetching needs investigation

The recommended case configuration includes:
Check these settings together with Stellar Cyber API reachability when case forwarding is delayed or incomplete.

​
Debug mode

Use --debug only while troubleshooting.
Disable debug mode after troubleshooting unless you intentionally need the additional logging in production.

​
Quick checks

Service state

Confirm the systemd unit is active and inspect the journal for runtime errors.

Stream completeness

Make sure every enabled stream has interval, destination IP, and destination port.

TCP reachability

Verify the relay host can reach each configured destination listener.

NDJSON parsing

Confirm the receiver treats each newline-delimited JSON object as one event.