Error Messages
Find any error or warning that conflux prints, with its exit code, cause and fix, grouped by command.
Reading the Tables
Conflux writes every error and warning to standard error with the prefix conflux: . The tables below quote each message without the prefix.
In the tables, … stands for a value that conflux fills in. A long message is quoted by the lines you are most likely to search for. Most messages also print the command to run next.
Unless a table says otherwise, an error exits with code 1. Code 2 means a usage error, such as an unknown flag or a command written in anchorctl's form. For every exit code, see the CLI Reference.
Any Command
Any conflux command can print these messages:
| Message | Exit | Cause | What to do |
|---|---|---|---|
"-x" is not a conflux option. | 2 | A flag came before the command, as in conflux -x up. | Put the flag after the command. For a flag meant for anchorctl, run conflux anchorctl -x …. The message shows both forms. |
… needs root.try: sudo conflux … | 13 | A command that changes the machine ran without root. The message starts with the action: bringing up a network interface, registering the boot service, installing a credential, starting the service, stopping the service, removing the boot service or renewing this machine's credential. | Run the line that the message prints. It is your command with sudo in front. |
… needs Administrator.open PowerShell with "Run as administrator", then: conflux … | 13 | The same error on Windows, from a PowerShell session that is not elevated. | Open PowerShell with Run as administrator, and run the line that the message prints. |
"stop" is anchorctl's, and conflux keeps the configuration this machine starts from. | 2 | You ran conflux stop or conflux restart. Conflux does not pass these to anchorctl, because its configuration would then no longer match the running anchor. | Run sudo conflux down to stop and sudo conflux start to restart. For anchorctl's own stop, run conflux anchorctl stop …. |
Bringing a Machine Up
conflux up and conflux proxy check everything before they write anything, so a refused command leaves the machine unchanged.
The supervisor runs the same checks on a hand-edited conflux.json when the service starts. There, these errors go to the log and count as failures that no retry can change.
| Message | Exit | Cause | What to do |
|---|---|---|---|
this machine has not been given an IPv4 yet and there is no terminal to ask at: pass --ipv4 ADDRESS or --no-ipv4 | 1 | up or proxy ran from a script, on a machine that has never been asked for an IPv4 address. | Pass --ipv4 ADDRESS or --no-ipv4. |
--ipv4 and --no-ipv4 contradict each other | 1 | You passed both flags of a pair. The same message, naming the pair, covers --subnet, --uplink, --peers, --port, --low-latency, --serve-exit and --use-exit. | Keep one of the two flags. If you leave out both, the configured value stays. |
conflux proxy publishes a local service on the overlay, and needs at least one spec: | 2 | conflux proxy ran with no arguments. | Add a spec, such as sudo conflux proxy 8080=127.0.0.1:3000. To list the proxies on a running anchor, run sudo conflux anchorctl proxy. |
"-add" is not one of conflux proxy's flags. | 2 | conflux proxy does not have this flag. Usually, anchorctl's proxy command was meant. | Run sudo conflux anchorctl proxy -add …. The message prints this command with your arguments. |
no port specs given, and nothing else to serve: conflux proxy needs at least one, | 2 | proxy ran with flags only, and with no spec, --subnet or --serve-exit. | Give it something to serve: a spec, a --subnet to route or --serve-exit. |
the service started but no anchor came up within 90s.see what it said: <log command> | 1 | The service is running, but the anchor did not start. start prints the same message. | Run the log command that the message names, then look up the reason in Anchor Start Failures. |
| Message | Cause | What to do |
|---|---|---|
"…" is not an IPv4 address or prefix, for example 10.128.0.7 or 10.128.0.7/24 | The value is not an IPv4 address or prefix. | Write a.b.c.d or a.b.c.d/len. |
… is IPv6: the overlay derives this machine's IPv6 from its identity, and this is for IPv4 | You gave an IPv6 address to --ipv4. | Give an IPv4 address, or pass --no-ipv4. The overlay derives the IPv6 address itself. |
… is not a unicast address a host sends from: loopback, link-local, multicast and broadcast are refused | The address is loopback, link-local, multicast or broadcast. | Use an address that a host can send from. |
… would route the whole IPv4 internet into the tunnel, which is what --use-exit is for | The prefix is /0. | To send this machine's internet traffic over the overlay, use --use-exit instead. |
… is inside 198.18.0.0/15, where anchor answers the IPv4 peers it translates for, and it will not send from there | Anchor reserves this range for the IPv4 peers it translates for. | Choose an address outside 198.18.0.0/15. |
--port 0 is not a port: it must be 1-65535, and --no-port is how to go back to letting the kernel pick one | The port is 0, or above 65535. | Use a port from 1 to 65535, or pass --no-port to let the kernel choose. |
--lan-discovery …: want yes, no or auto | The value is not yes, no or auto. | Use yes or no, or auto for the default. |
| Message | Cause | What to do |
|---|---|---|
"8080" is not PORT[/NETWORK]=BACKEND, for example 8080=127.0.0.1:3000 or 53/udp=127.0.0.1:53 | The spec has no =. | Use the form OVERLAYPORT[/NETWORK]=BACKEND. |
"8080/tpc=…": "tpc" is not tcp or udp | The network is not tcp or udp. | Use tcp, the default, or udp. |
"70000=…": "70000" is not an overlay port (1-65535) | The overlay port is outside 1 to 65535. | Use a port from 1 to 65535. |
"8080=": no backend after the "=" | The spec has no backend. | Name a backend as host:port. |
"8080=localhost": backend "localhost" is not host:port: … | The backend has no port. | Add the port, as in localhost:3000. Put an IPv6 backend in brackets: [::1]:5432. |
overlay port 8080/tcp is given twice | Two specs use the same port and network. | Use one spec per port and network. 53=… and 53/udp=… can be used together. |
| Message | Cause | What to do |
|---|---|---|
this machine's credential grants the taint "x", and it is configured for the taint "y".conflux uninstall --yesconflux up --taint y (or conflux proxy ... --taint y) | --taint or conflux.json names taints that the credential does not grant. A machine that enrolled on the instance VeilNet hosts before it granted taints has a credential with none, and also gets this error. | A credential's taints never change. Keep the taints it grants, or create a new identity with the commands that the message prints. For a credential from a guardian, the last line is conflux enrol --manifest FILE, with a credential that grants the taints you want. |
taint is empty | The --taint value is empty. | Give the taint a name. |
taint "…" is N bytes and the limit is 64 | The name is longer than 64 bytes. | Use a shorter name. |
taint "…" is not UTF-8 | The name is not valid UTF-8. | Use a UTF-8 name. |
taint "a,b" contains a comma; for two compartments, use --taint twice | One --taint holds a comma-separated list. | Pass --taint once for each taint, as in --taint a --taint b. |
taint "x@y" has '@', which binds a served network to compartments (SUBNET@a+b) | The name contains @ or +. These characters bind a forwarded network to taints. | Choose a name without these characters. |
taint "x y" has a space or a character that does not print, U+0020 | The name contains a space, or a character that does not print. | Choose a name without these characters. |
33 taints, and anchor allows 32 | There are more than 32 taints. | Use 32 taints at most. |
| Message | Cause | What to do |
|---|---|---|
subnet "a,b" contains a comma, which would split it into two entries; use --subnet twice instead | One --subnet holds two entries. | Pass --subnet once for each entry, as in --subnet a --subnet b. |
subnet "…" is N bytes and anchor allows 255 | The entry is longer than 255 bytes. | Shorten the entry. |
subnet "@office" binds nothing: write the network or interface before the @ | Nothing comes before the @. | Write the network or interface first, as in 192.168.1.0/24@office or eth1@office. |
subnet "10.0.0/8x" is neither a prefix nor an interface name: … | The entry has a slash, but it is not a valid prefix. | Use a prefix, an interface name or '*'. |
subnet 192.168.1.7/24 has host bits set; did you mean 192.168.1.0/24 | The entry is an address, where a network was meant. | Use the network that the message suggests. |
subnet ::ffff:10.0.0.0/104 is an IPv4 network written as IPv6, which anchor never finds attached; write 10.0.0.0/8 | The IPv4 network is written in IPv4-mapped IPv6 form. | Write it in IPv4 form, as the message shows. |
subnet 8.8.8.0/24 is not a private network: anchor forwards private networks only, and reaching the public internet through an anchor is what an exit is for | The prefix is public. | Forward only 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 100.64.0.0/10 or fc00::/7. For internet access, use an exit. |
65 subnets, and anchor serves at most 64 | There are more than 64 entries. | Use fewer entries. An interface name or '*' covers several networks. |
subnet "…@lab" is bound to "lab", which this machine is not in; its taints are … | The entry is bound to a taint that this machine's credential does not grant. | Bind only to taints that this machine carries. A machine with no taints cannot bind a network. |
subnets are bound to 17 compartments, and anchor allows 16 | The bindings name more than 16 different taints. | Use 16 taints at most. |
| Message | Cause | What to do |
|---|---|---|
peer "a,b" contains a comma, which would split it into two entries; use --peers twice instead | One --peers holds two entries. | Pass --peers once for each entry, as in --peers a --peers b. |
peer "…" is not host:port, for example … | The entry has no port. | Use host:port, or anchor…@host:port to name the anchor expected at that address. |
peer "…" names a port and no host | The entry has a port but no host, such as :4700. | Add the host. |
peer "…": "…" is not a port | The port is not a number from 0 to 65535. | Correct the port. |
peer "…": "…" is not an AnchorID, which is "anchor" and 52 base32 characters | The part before the @ is not a full AnchorID. | Use the 58-character form that conflux status prints. |
… is plain http; credentials are only fetched over https (set CONFLUX_ALLOW_INSECURE_API=1 to override, for tests) | The --api address uses http. | Use https. The override is for tests only. |
… has scheme "…", want https | The --api address uses another scheme. | Use https. |
| Message | Cause | What to do |
|---|---|---|
fd:3 adopts a descriptor from whatever started the daemon, and conflux's supervisor starts anchord with none to adopt. | You passed --uplink fd:N. Conflux has no descriptor to hand to the anchor. | Name the device, such as /dev/ttyUSB0:115200. To pass a descriptor to an anchor yourself, use conflux anchorctl start -uplink fd:3. |
anchor has no way to open a link on Windows, so --uplink cannot be used here. | You passed --uplink on Windows. | Uplinks work only on Unix hosts. Use the host's network instead. |
"/dev/ttyUSB0:0": 0 is not a line speed | The speed is zero or less. | Give a valid speed, such as :115200, or leave the speed out to keep the line's current setting. |
":115200" names a speed and no device | The entry has a speed but no device. | Name the device, as in /dev/ttyUSB0:115200. |
a port and an uplink are set together: an uplink carries layer 1 over … and binds no socket, so there is no port to choose | You passed --port together with --uplink. | Pass --no-port. |
--lan-discovery yes and an uplink are set together: … | You passed --lan-discovery yes together with --uplink. There is no host network to probe. | Use --lan-discovery auto or no. |
| Message | Cause | What to do |
|---|---|---|
serveExit and useExit are both set, and anchor refuses the pair: … | A machine can serve an exit or use one, but not both. | Keep one, with --no-use-exit or --no-serve-exit. |
mode is "tun" and 1 proxy spec(s) are set: a reverse proxy needs userspace mode, … | conflux.json was edited by hand to add proxies in TUN mode. | Run conflux proxy, or remove proxies and bind the service on the overlay address. See Proxy and TUN Modes. |
mode is "…", want "tun" or "proxy" | The mode field was edited by hand to another value. | Set it to tun or proxy. |
parse /etc/conflux/conflux.json: … | The file is not valid JSON, usually after a hand edit. | Fix the JSON, then run sudo conflux start. |
/etc/conflux/conflux.json was written by a newer conflux (config version 2, this build understands 1) | An older conflux is reading a file that a newer conflux wrote. | Upgrade conflux. |
the control socket path is N bytes and the kernel allows M:set CONFLUX_DIR to something shorter | CONFLUX_DIR is too long for a Unix socket path. | Use a directory with a shorter path. The kernel allows 104 to 108 bytes. |
Enrolling a Machine
conflux enrol checks everything before it writes anything, so a refused file leaves the machine unchanged. Every refusal exits with code 1, except the first in the table.
An invalid --ipv4 value, or an invalid address from the issuer, produces the IPv4 messages above.
| Message | Exit | Cause | What to do |
|---|---|---|---|
(prints the usage) | 2 | conflux enrol ran without --manifest. | Pass --manifest FILE, or --manifest - to read the credential from standard input. |
this machine already has a credential at /var/lib/conflux/manifest.b64. | 1 | A credential is already installed. Installing another would replace this machine's identity, AnchorID and address. | If you intend that, run sudo conflux uninstall first, then enrol. |
read the manifest: …the manifest is empty | 1 | The file is missing, unreadable or empty. | Check the path. Standard input is limited to 1 MiB. |
the stored credential is not base64: …the stored credential is not a JSON document: … | 1 | The file is damaged, or is not a credential. | Ask the issuer for the file again. |
the credential is format version N and this conflux understands 1; upgrade conflux | 1 | The credential uses a newer format. | Upgrade conflux. |
the credential is a "realm" manifest, not an anchor one: a realm manifest mints anchors and does not start one | 1 | The file is a realm manifest, not this machine's credential. | Ask the issuer for this machine's own file. |
the credential carries no …, so an anchor cannot be built from it | 1 | A required part, such as the identity or the chain, is missing. | Ask the issuer for a new credential. |
the credential asks for renewalAuth "…" and this conflux implements "anchor-id" and "node-secret"; upgrade conflux rather than renewing without it | 1 | The credential uses a renewal scheme that this build does not support. | Upgrade conflux. |
the credential says renewalAuth "node-secret" and carries no renewalSecret; it cannot renew and has to be reissued | 1 | The renewal secret is missing. | Ask the issuer to reissue the credential. |
the manifest says renewalAuth "…" and carries no renewalUrl. | 1 | The manifest says how to authenticate a renewal, but not where to send it. | Ask the issuer to add the renewal URL. |
the stored credential names … for renewal and this conflux is configured for …; refusing to send it elsewhere.--api and the document disagree. | 1 | --api names a different host from the one the credential renews with. | Leave out --api, or get a credential issued for the address you meant. |
the credential expired …, and anchor will not start on an expired one.Get a fresh one from its issuer | 1 | The credential has expired. Once installed, it could never be renewed. | Get a new credential from its issuer. |
this is an … credential granting no taints, which is the realm's shared compartment: | 1 | The credential is from the instance VeilNet hosts and grants no taints. Conflux never puts a machine in that shared compartment. | Run sudo conflux up --taint T to get a credential in a network of its own. |
the taints this credential grants: … | 1 | The issuer granted a taint that conflux cannot carry. The reason follows, as for --taint. | Ask the issuer for a new credential. |
the manifest's export block is not one conflux understands: …the manifest's export block: … | 1 | The issuer's telemetry settings are not valid. | Ask the issuer to fix them. |
Starting, Stopping and Removing
conflux start, conflux down and conflux uninstall print these messages:
| Message | Exit | Cause | What to do |
|---|---|---|---|
"-identity" is anchorctl's start, not conflux's. | 2 | Flags meant for anchorctl were given to conflux start, which takes no flags. | Run the sudo conflux anchorctl start … line that the message prints. |
conflux start takes no arguments, and got "…". | 2 | An argument followed start. | Run sudo conflux start with no arguments. |
conflux is not installed here, so there is no service to start. | 69 | start ran on a machine with no boot service. | Run sudo conflux install, up or proxy. |
There is no configuration on this machine, so there is nothing to start. | 78 | The service is registered, but there is nothing to run. | Run sudo conflux up or sudo conflux proxy …. |
conflux is not installed here, so there is nothing to bring back afterwards. | 69 | down ran on a machine with no boot service. | There is nothing to stop. To see the machine's current state, run sudo conflux status. |
this deletes the credential and there is no other copy.Pass --yes to say so explicitly; a scripted uninstall will not destroy an identity by default. | 2 | uninstall ran without --yes, with no terminal to ask at. | Pass --yes if you intend to destroy this identity. |
(you answered no) | 2 | uninstall asked for confirmation, and you declined. | Nothing was removed. No action is needed. |
Renewing a Credential
conflux renew prints these messages:
| Message | Exit | Cause | What to do |
|---|---|---|---|
"-cred" is anchorctl's renew, not conflux's. | 2 | conflux renew takes no flags. anchorctl's renew installs a credential that you already hold. | Run sudo conflux anchorctl renew -cred FILE. |
conflux renew takes no arguments, and got "…". | 2 | An argument followed renew. | Run sudo conflux renew with no arguments. |
this machine has never been configured, so there is no credential to renew. | 69 | Nothing is enrolled, and renew never enrols. | Run sudo conflux up or sudo conflux proxy …. |
nothing is running here, and a credential is installed into a running anchor. | 69 | The anchor is not running. | Run sudo conflux start. A machine that you keep stopped needs no action, because it renews on its next start. |
this credential does not renew: its issuer named nowhere to renew it; it is valid until …, and is replaced rather than renewed | 69 | The machine has a fixed-term credential. | Replace it before it expires. |
could not read /run/conflux/token, which anchorctl authenticates with | 1 | The daemon is running, but its token is missing. | Run sudo conflux start, which restarts the daemon with a new token. |
Status and Passed-Through Commands
Conflux passes every command it does not own, such as peers, routes or blocks, to its embedded anchorctl. It steps in only in these cases:
| Message | Exit | Cause | What to do |
|---|---|---|---|
open /etc/conflux/conflux.json: permission denied | 1 | conflux status ran without root. Only root can read the configuration directory. | Run sudo conflux status. |
nothing is running here.(the control socket would be /run/conflux/anchord.sock) | 69 | A command passed through to anchorctl, such as peers, ran while no daemon is running. | Run sudo conflux start if this machine is configured, or up or proxy if it is not. The message lists all three. |
/run/conflux/token is not readable, and anchorctl needs it to authenticate.try: sudo conflux … | 69 | A passed-through command ran without root. | Run the line that the message prints. |
(anchorctl's own message) | its own | A passed-through command refused for another reason. | Read anchorctl's explanation. Conflux passes it on unchanged, with anchorctl's exit code. |
Anchor Start Failures
These messages come from the supervisor, which the boot service runs. They appear in the service log, or on screen when you run sudo conflux serve --foreground.
In the terminal, up or start reports only that no anchor came up within 90 seconds, and names the log. To find the log, see Service and Logs.
The Result column shows one of three outcomes:
- Retried: the supervisor tries again, with a backoff of up to thirty seconds.
- 70: no retry can change the outcome. After three attempts, the supervisor stops with exit code 70, and the service stays down.
- Exit 1: the supervisor stops, and the service manager starts it again.
Lines from anchord carry the prefix anchord:. The first six messages can also appear in your terminal from any command, because every command extracts the anchor binaries before it uses them.
| Message | Result | Cause | What to do |
|---|---|---|---|
the anchor binaries were extracted to /var/lib/conflux/bin/… but will not run from there.that filesystem is mounted noexec. | Exit 1 | Linux: the filesystem of the state directory does not allow programs to run. | Set CONFLUX_DIR to a directory on a filesystem that allows programs to run. |
SELinux is enforcing, and a binary under this path is probably labelled var_lib_t.try: sudo semanage fcontext -a -t bin_t '…(/.*)?' && sudo restorecon -R … | Exit 1 | Linux: SELinux is enforcing. | Run the two commands that the message prints, with the path filled in. |
if this says "killed: 9", the binary's signature was rejected -- an Apple Silicon Macotherwise check that the filesystem is not mounted noexec. | Exit 1 | macOS refused the binary, or the filesystem does not allow programs to run. | Check the download and the filesystem. |
an endpoint protection product may have quarantined them: a program that writes and thencheck the Defender protection history, and exclude that directory if this is expected. | Exit 1 | Windows: endpoint protection removed or blocked the extracted binaries. | Check the digests against the release notes, then exclude the directory. See Windows Problems. |
check that the filesystem is not mounted noexec, and that no policy forbids execution there. | Exit 1 | FreeBSD or OpenBSD, or Linux when neither of the causes above applies. | Set CONFLUX_DIR to a directory that allows programs to run. |
this conflux was built for …/… and carries no anchor binaries for it | Exit 1 | This download is for another platform. | Download the build for this operating system and architecture. |
this machine's clock is 12m3s away from the server's, and the overlay will not start or connect on it.fix the clock first (timedatectl set-ntp true, or the equivalent), then try again | Retried | The local clock differs from the API's by more than ten minutes. | Fix the clock. See Clock Skew. |
enrol: no taint to ask for: …; run conflux up or conflux proxy, which mint one | 70 | The taints in conflux.json were emptied by hand, on a machine that is not yet enrolled. | Run sudo conflux up or sudo conflux proxy …, which create a taint. |
enrolled, but could not save the credential -- it is now lost and a new one must be drawn: … | Retried | The disk is full, or the state directory is not writable. The identity that conflux just created is lost. | Free some space or fix the permissions. The next attempt enrols again. |
the credential expired … ago, and anchor will not start on an expired one: this credential does not renew: its issuer named nowhere to renew it; it has to be replaced | 70 | A fixed-term credential has expired. | Replace it. Run sudo conflux uninstall --yes, then sudo conflux enrol --manifest FILE with the new file, then sudo conflux up or proxy again. |
the credential expired … ago, and no AnchorID is recorded to renew it with -- the anchor never started on it, or /var/lib/conflux/state.json was lost -- so it has to be replaced | 70 | The credential has expired, and there is no AnchorID to renew it with. | Replace the credential. |
this machine's credential grants the taint "x", and it is configured for the taint "y". | 70 | The same refusal as for up and proxy, raised when the service starts. | Create a new identity with the commands that the message prints. |
(anchord: the credential's realm root is not the pinned one) | 70 | The credential belongs to a different realm tree from the one these binaries are pinned to. | Use a credential issued for this network. |
anchord: … will not give this process a TUN devicetundev: creating … device or resource busy | 70 | A capability or device is missing, the interface name is already in use, or the host booted without IPv6. | Grant the capability or choose another --interface. Alternatively, run conflux proxy, which needs neither an interface nor IPv6 on the host. |
anchord: … could not be set up to forward for the realm | 70 | Linux with an interface and --subnet or --serve-exit. Neither nft nor iptables with ipset is installed, or /proc/sys is not writable. | Install nft, or iptables with ipset, or start the container with forwarding already enabled. A userspace router needs neither. |
anchord: … does not grant this anchor's taints | 70 | The manifest names taints that its credential chain does not include. This is the issuer's mistake. | Ask the issuer for a new credential. |
(anchorctl exits 2) | 70 | The embedded anchorctl refused the arguments it was started with. | Read the lines before it in the log. A hand-edited conflux.json is the usual cause. |
cannot reach anchord's socket: …this usually means conflux is not running as root | 70 | The supervisor has no permission to use the socket. | Run the service as root, which is how conflux registers it. |
anchord refused conflux's bearer token: … | 70 | The supervisor and anchord disagree about the token. | Run sudo conflux start, which writes a new token. |
anchord did not answer on /run/conflux/anchord.sock within 30sanchord exited … | Retried | Anchord was slow to start, or it exited. Its last log lines follow the message. | Read those lines for the reason. |
anchord will not start with this configuration: … | 70 | Three attempts failed for a reason that no retry can change. The reason follows the message. | Fix the problem that the line names, then run sudo conflux start. |
there is no configuration to start.conflux up join with a network interface | 78 | The service started on a machine with no configuration. | Run sudo conflux up or sudo conflux proxy …. |
macOS and Windows
These errors make the command that hits them exit with code 1:
| Message | Cause | What to do |
|---|---|---|
launchctl bootstrap system /Library/LaunchDaemons/org.veilnet.conflux.plist:Bootstrap failed: 5: Input/output error | macOS, on up or install, often after an uninstall. launchd reports most refusals as error 5, which does not name the cause. | Check the causes that the message lists. The plist must be owned by root, and must not be writable by its group or by everyone. If the job is already loaded, run sudo launchctl bootout system/org.veilnet.conflux. The program that the plist names must exist, on a volume that is mounted. |
… belongs to DOMAIN\account (SID), which is not an administrator, so conflux did not create it and will not use what is in it. | Windows: another account created %ProgramData%\conflux before conflux did. | Remove the directory, then run the command again as Administrator. If conflux itself left the directory behind, run any conflux command once as that account to repair it. |
… was made by another account before conflux secured …, so conflux will not use it. | Windows: something inside the conflux directory belongs to another account. | Remove that file or folder, then run the command again as Administrator. |
a network interface on Windows needs wintun.dll, and it could not be fetched: … | Windows in TUN mode, with no route to wintun.net. | Place the file by hand as the message describes, or use conflux proxy, which needs no driver. See Windows Problems. |
the downloaded archive is not the pinned one.expected sha256 …got sha256 … | Windows: the download is not the Wintun archive that conflux pins. | Conflux does not use it. Retry from a network you trust, or use conflux proxy. |
Warnings
A warning carries the same prefix as an error, but the command continues. No warning changes the exit code.
| Message | When | What it means |
|---|---|---|
a set of 2 taints is compared by containment, not overlap: this machine exchanges | You passed more than one --taint. | A reminder only. A peer must carry all of these taints, or carry only taints from this set. Sharing one taint is not enough. |
this machine was bootstrapping from … and will now use …. | --peers replaced an earlier override. | Nothing, if you intended it. |
this machine was running in TUN mode with interface anchor0. | proxy ran on a machine in TUN mode. | Nothing, if you intended it. The mode changes, but the identity stays the same. |
this machine was serving 2 proxied service(s) in userspace mode. | up ran on a machine in proxy mode, which drops the proxy specs. | If you only meant to bring the machine back, run sudo conflux proxy … again with every spec. Next time, use sudo conflux start. |
9600 baud carries a realm handshake in about 25s, against a 60s idle timeout. | The uplink speed is below 19200. | Use a faster line if you can. See Uplink Problems. |
could not renew: …the credential is still valid for …; conflux will keep trying | A renewal failed, but the credential is still valid. | No urgent action is needed. See Failing Renewals. |
could not renew, and the credential expired … ago: …anchor will not start on it, so conflux tries again until this succeeds | A renewal failed, and the credential has expired. | Fix the problem that the error names. The machine recovers by itself once a renewal succeeds. |
Replacing the subnet list an order from anchor… set at …. | --subnet or --no-subnet replaced a list that another member's Subnets order had set. | Nothing, if you intended it. This notice goes to standard output, without the prefix. |
could not clear the readiness marker: … | A file in the run directory could not be removed. | Nothing. It costs at most one extra status call, and it never stops a start. |
Messages from passed-through commands are anchorctl's own and are not listed here. For any other message, read the service log and send it with a bug report.