Troubleshooting

I lost the admin password

The first start prints it once. With Docker the first container's logs hold it (docker compose logs siemlite | grep -A1 'username: admin'), but rebuilding replaces them. Set a new one:

docker compose exec siemlite siemlite users passwd -username admin    # Docker
./siemlite users passwd -username admin                               # plain binary

Pass -db if your database is not ./siemlite.db. This also signs the user out everywhere.

The browser warns about the certificate

SIEMLite generates a self-signed certificate on first start. Trust siemlite.crt on your machine, or supply your own with -tls-cert and -tls-key. With Docker, copy the certificate out with docker compose cp siemlite:/data/siemlite.crt ..

The certificate doesn't match the name I use

The certificate is generated once. Set -tls-hosts (Docker: SIEMLITE_TLS_HOSTS) to every name or IP people use before the first start. To regenerate later, delete the certificate and key and restart; see Installation for the Docker command.

Sending a log returns an error

Events dated before the retention period, or more than a day ahead, are refused and counted as rejected with the reason.

Syslog isn't arriving

• Each listener is off until its flag is set (-syslog-udp, -syslog-tcp, -syslog-tls).
• Only loopback and private networks may send by default. Widen it with -syslog-allow. Refused senders are counted and logged once a minute.
• Ports below 1024 need root, or sudo setcap cap_net_bind_service=+ep ./siemlite.
• UDP drops messages when the ingest queue is full and has no way to push back. Keep its rate below what storage sustains, or use TCP.
• Under Docker, a sender on the Docker host itself appears as the network's gateway address.

My lines aren't parsed the way I expect

Look at the source's setting on the Sources page: Automatic, None or a parser. A line that doesn't match the source's parser is still stored, parsed as Automatic would, with a parse_error field. Use the parser editor's preview with sample lines.

Search doesn't find part of the original line

Search covers the parsed event (message, program, host, user, addresses and parsed fields). The original line is removed 24 hours after the event arrives, so search for what the parser understood. See Search.

An update or restore didn't work

• The Update and restart button appears for a plain-binary install that can write to its own folder, and for Docker (the update is saved in the data volume). If SIEMLite can't write where it needs to, the card says so and shows the command to pull the new image. See Backups and updates.
• Failed downloads or checksum mismatches change nothing.
• Backups from newer versions are refused by older ones. Make a backup before updating if you may want to go back. See Backups and updates.

The test email fails

The message is the mail server's own answer. The usual causes:

• Couldn't connect: the server name or port is wrong, or a firewall blocks it. Use 587 with STARTTLS, 465 with TLS, or 25 with no encryption.
• The server doesn't offer STARTTLS: choose TLS or no encryption, or check the port.
• The secure connection failed: the certificate doesn't verify. Fix the name or certificate, or tick Accept any certificate for a self-signed one.
• The server rejected the login: check the username and password. Many providers need an app password, or a login that is allowed to send mail.
• The server refused the sender: the Send from address must be one the server lets that login send as.
• "Enter the password again" appears after changing the server or login, or after restoring a backup onto another server. See Email.

Let's Encrypt doesn't issue a certificate

The HTTPS certificate section of the System page says why, and Check this address tests the same path Let's Encrypt uses. Meanwhile the site stays reachable by IP address or LAN name with the self-signed certificate. The usual causes:

• The name doesn't point here: its DNS (an A or AAAA record) must point at this server's public address. The section shows what the name resolves to.
• Port 443 isn't reachable from the internet, or isn't forwarded to SIEMLite. With Docker, publish it with SIEMLITE_HTTPS_PORT=443. Let's Encrypt only checks port 443 (there's no port-80 option here).
• Too many attempts: Let's Encrypt limits how often it issues for one name. Keep the acme folder next to the database (/data/acme with Docker), so restarts and rebuilds reuse the certificate. To experiment, use its staging server with -acme-directory.
• The check fails but Let's Encrypt might still work: some routers don't let a server reach its own public address. Try saving anyway; the status shows the real result.

See Run on the internet.

Can't change your password

• "The current password is wrong": after 10 wrong tries in 15 minutes the account can't try again until the window ends. This limit is separate from signing in, so it never stops you signing in.
• No password form on the Account page: the account belongs to Microsoft Entra ID; its password is managed by your organization.
• Forgotten: an admin can set a new one on the Users page, or run siemlite users passwd -username <name>.

The admin account can't sign in

"This account can only sign in on the server itself" means Keep the admin account to this server is on (Users page), or Only allow sign-in with Microsoft is. Sign in at https://localhost:8444 on the server. From another computer, tunnel to it first: ssh -L 8444:localhost:8444 you@server, then open https://localhost:8444. A "this port only answers the server itself" error means the connection didn't come from the server: use localhost on the server or the tunnel, not the server's address. If the local port doesn't answer at all, check that docker compose ps shows 127.0.0.1:8444->8444 (it needs the v0.17 compose.yaml; update with git pull), or that SIEMLite was started with -local-addr.

If nothing works, lift the restrictions on the server with docker compose exec siemlite siemlite signin reset (or ./siemlite signin reset); a running SIEMLite applies it within a minute. See Sign-in restrictions.

The sign-in page has no password form

Only allow sign-in with Microsoft is on, so only Microsoft accounts can sign in. The built-in admin account can still sign in on the server, at https://localhost:8444, where the password form is shown. Turning sign-in with Microsoft off brings passwords back.

Sign in with Microsoft doesn't work

The sign-in page shows a short reason, and the server log has the detail.

• "Isn't in the group": add the person to the Entra access group (nested groups count).
• "An account with your name already exists": a local account has the same name. SIEMLite won't link them; rename or delete the local account.
• Test connection says Graph refused the request: give the app the GroupMember.Read.All application permission and grant admin consent.
• Microsoft says the redirect URI doesn't match: copy the Redirect URL from the card into the app registration exactly; the SIEMLite address on the card must be the address people use.

See Sign in with Microsoft.

AI Parsers doesn't suggest anything

• No Suggest a parser button: AI Parsers is off or not set up. An admin sets it up on the Integrations page.
• "The AI model is still downloading or Ollama isn't reachable": the AI Parsers card shows the download's progress, or why Ollama can't be reached. With Docker, Ollama runs only with ai in COMPOSE_PROFILES in .env (then docker compose up -d), and its address is http://ollama:11434.
• "Some addresses in these lines couldn't be hidden, so nothing was sent to the cloud": SIEMLite checks the exact text before sending it to OpenRouter and found an address, or part of one, still in it. Remove those lines from the samples, or use a model on this server.
• "OpenRouter refused the API key" or "out of credit": check the key and the account at openrouter.ai.
• Suggestions for JSON with dotted field names are vague in the cloud: dotted names are replaced before sending, field names included. A model on this server sees them as they are.

./update.sh doesn't finish

• "Couldn't ask GitHub for the newest release": the server can't reach api.github.com. Name the version instead: ./update.sh v0.20.
• "This SIEMLite is built from this folder, so it can't switch to ...": there's no release image in .env. Run git pull and ./update.sh, or set SIEMLITE_IMAGE=ghcr.io/justwaters/siemlite:<version> in .env to use releases.
• "SIEMLite hasn't reported healthy yet": look at docker compose logs --tail 50 siemlite. After going back to an older version, the database may need the newer one; run ./update.sh to return to the newest, or restore a backup made on the older one.
• ./update.sh: No such file or directory: the script arrived in v0.20; run git pull in the SIEMLite folder first.

Events are refused as too old, or a "Mass ingestion of late logs" alert

• "is older than the N days events are kept": the event is dated before the retention period, so it isn't stored. Make the period longer under Keep events on the System page (two years by default) if you need those logs.
• Keep events shows 30 days after updating: your .env still sets SIEMLITE_RETENTION_DAYS=30 (older copies of .env.example did). Choose the period on the System page and save; that takes precedence from then on.
• A "Mass ingestion of late logs" alert: 50 or more events more than 30 days old arrived from one source at once. If you loaded old logs on purpose, close it. Otherwise check the source: a sender replaying old logs, or one whose clock is wrong. The alert's event names the source, how many events and the dates they cover.

Still stuck

Check the server log, GET /health (details when signed in), and the audit log, then open an issue.