Enrollment
enrollment refused (401): token_unknown
enrollment refused (401): token_unknown
The token was copied wrongly, or it belongs to another dataset. Copy it again, in full, from the dataset you are connecting.
enrollment refused (410): token_expired
enrollment refused (410): token_expired
The token was not used within 7 days. Generate a new one and start the agent with it.
enrollment refused (410): token_cancelled
enrollment refused (410): token_cancelled
The token was cancelled, or replaced by a newer one. Use the most recent token you generated.
enrollment refused (410): token_used
enrollment refused (410): token_used
An agent already used this token. Two common causes:
- You recreated the container without its volume. The first agent enrolled, then lost its credentials. Generate a new token, start the agent with a persistent
/datavolume, and revoke the old agent in the dashboard. - You never ran an agent with it. Someone else did. The dashboard shows that agent. Revoke it, then generate a new token. See A token you did not use.
not enrolled yet, missing: CUBIT_ENROLL_TOKEN, CUBIT_API_URL
not enrolled yet, missing: CUBIT_ENROLL_TOKEN, CUBIT_API_URL
The agent has no credentials in its data directory, and no token to enroll with. Either this is the first start and the variables are missing, or the volume is not mounted. Mount the same volume the agent enrolled with, or enroll again with a new token.
cannot reach the Cubit API at https://api.concatflow.com/agents/enroll
cannot reach the Cubit API at https://api.concatflow.com/agents/enroll
The machine cannot open an HTTPS connection to
api.concatflow.com. Check DNS and outbound port 443. See Network requirements.CUBIT_API_URL must use TLS (https://, wss:// or tls://)
CUBIT_API_URL must use TLS (https://, wss:// or tls://)
CUBIT_API_URL starts with http://. Use https://api.concatflow.com.cannot write to /data
cannot write to /data
The data directory is read-only, or not writable by UID
10001. Mount a writable volume at /data. A named Docker volume works out of the box.Database
refusing to serve: the database account can write
refusing to serve: the database account can write
The account in Use a dedicated read-only account. See Create a read-only account. Then restart the agent. It keeps its enrollment, so no new token is needed.
DATABASE_URL has write privileges somewhere in the database. The rest of the line says where:password authentication failed for user
password authentication failed for user
The user name or password in
DATABASE_URL is wrong. URL-encode special characters such as @, : or / in the password.Name or service not known
Name or service not known
The host in
DATABASE_URL does not resolve from inside the container. Use an address the container can reach. A database on the Docker host itself is not localhost from inside the container.unsupported database scheme
unsupported database scheme
DATABASE_URL must start with postgresql://, postgres://, mysql:// or mariadb://.MySQL 8 authentication fails
With agent0.1.0, connecting to a MySQL 8 account that uses the default caching_sha2_password plugin fails with:
In the dashboard
The agent shows as Offline
The agent shows as Offline
No connection from this agent reaches Concatflow right now. Check that the container is running with
docker ps, then read its logs. If it runs but stays offline, check outbound access to agents.concatflow.com:443.Never connected
Never connected
The agent enrolled but never connected to the broker. The usual cause is a firewall or proxy that allows
api.concatflow.com but blocks agents.concatflow.com, or blocks WebSocket traffic.Unknown status
Unknown status
Concatflow cannot check agent status at the moment. The agent itself may be fine. Try again in a moment.
Queries fail with no agent is connected for this dataset
Queries fail with no agent is connected for this dataset
No agent of this dataset is online. Start one, or run two so one can take over.