Troubleshooting
Common issues and how to resolve them.
“no license key found”
Run siftlogd activate --key YOUR-KEY first, or set the SIFTLOGD_LICENSE environment variable. The key file lives at ~/.siftlogd/license.key.
“license verification failed”
Check that your machine has outbound HTTPS access to license.mmediasoftwarelab.com. If running behind a proxy, ensure HTTPS traffic is permitted. siftlogd operates in grace period mode for up to 7 days if the license server is unreachable — it will not stop mid-incident because of a network blip.
“no sources configured”
siftlogd cannot find a siftlog.yaml. Create one in the current directory, at ~/.siftlog/siftlog.yaml, or pass --config /path/to/config.yaml.
“source X: file not found”
The log file path in your config does not exist yet. Start your services first so the log files are created, then start siftlogd.
No signals firing
Signal detection requires a baseline warmup period equal to signal.baseline_window_minutes (default 5 minutes). During warmup, the stats bar shows event rates but no anomaly or silence signals will fire. Cascade detection is active immediately once trace IDs are observed.
If signals are still not firing after warmup, lower anomaly_threshold_multiplier to 3.0 and silence_threshold_pct to 70.0 to increase sensitivity.
Too many false positive signals
Increase anomaly_threshold_multiplier (try 10.0 or higher for services with naturally spiky traffic). Increase baseline_window_minutes to give the correlator more history to work with. For silence, increase silence_threshold_pct or configure per-service silence windows.
Terminal UI not rendering correctly
siftlogd requires a terminal that supports ANSI 256-color escape sequences. This covers every modern terminal emulator. On Windows, Virtual Terminal Processing is enabled automatically — no manual configuration required.
If running over SSH, ensure your SSH client is passing TERM=xterm-256color or similar. Run siftlogd start --no-ui for headless output if the terminal environment cannot be corrected.
CloudWatch / Datadog / Loki authentication errors
For CloudWatch, ensure the AWS credential chain is configured: environment variables, ~/.aws/credentials, or an instance profile. For Datadog and Loki, verify the API key and token values in your config. Use environment variables for secrets rather than storing them in the YAML file directly.
Still stuck?
Contact support@mmediasoftwarelab.com with your siftlogd version (siftlogd version), your operating system, and a description of the issue.
SiftLog Platform
Always-on log correlation daemon. Cascade, anomaly, and silence detection across every log source in your infrastructure.