[meta]
source_os = "linux"
target_distro_family = "debian"

# Arch/Manjaro/EndeavourOS user moving to Debian/Ubuntu/Mint.
# Body text assumes pacman, AUR, and rolling release familiarity.

[log_paths]
steam     = "~/.local/share/Steam/logs/content_log.txt"
proton    = "~/.local/share/Steam/logs/proton_log.txt"

# ── apt / dpkg ────────────────────────────────────────────────────────────────

[[patterns]]
id       = "apt-lock"
sources  = ["journald"]
match_text = "Could not get lock /var/lib/dpkg/lock"
severity = "warn"
title    = "Package manager is locked"
body     = "Another apt process is running — often unattended-upgrades (automatic background updates, no Arch equivalent). Wait a minute. If stuck: sudo rm /var/lib/dpkg/lock-frontend /var/lib/dpkg/lock && sudo dpkg --configure -a"

[[patterns]]
id       = "dpkg-interrupted"
sources  = ["journald"]
match_text = "dpkg was interrupted"
severity = "warn"
title    = "Package install was interrupted"
body     = "Like a pacman transaction that got killed, but dpkg needs manual recovery. Fix: sudo dpkg --configure -a"

[[patterns]]
id       = "apt-unmet-dependency"
sources  = ["journald"]
match_text = "Unmet dependencies"
severity = "warn"
title    = "Package dependency conflict"
body     = "Unlike pacman which puts the conflict choice on you, apt tries to auto-resolve. Let it: sudo apt --fix-broken install — if it can't, read the message for which packages conflict."

# ── System ────────────────────────────────────────────────────────────────────

[[patterns]]
id       = "kernel-driver-firmware"
sources  = ["kmsg"]
match_text = "firmware: failed to load"
severity = "warn"
title    = "Firmware file missing"
body     = "On Debian: sudo apt install firmware-linux firmware-linux-nonfree (enable non-free sources first). On Ubuntu: sudo apt install linux-firmware. Unlike Arch's single linux-firmware package, Debian splits firmware by license."

[[patterns]]
id       = "oom-killer"
sources  = ["kmsg"]
match_text = "Out of memory: Kill process"
severity = "warn"
title    = "OOM killer fired"
body     = "Debian stable has conservative defaults — Ubuntu enables zswap, Debian doesn't. If you used zram-generator on Arch, set up a swapfile here: fallocate -l 4G /swapfile && chmod 600 /swapfile && mkswap /swapfile && swapon /swapfile"

[[patterns]]
id       = "disk-io-error"
sources  = ["kmsg"]
match_text = "Buffer I/O error on device"
severity = "warn"
title    = "Disk I/O error"
body     = "Check SMART: sudo smartctl -a /dev/sdX — install: sudo apt install smartmontools"

[[patterns]]
id       = "locale-error"
sources  = ["journald"]
match_text = "failed to set locale"
severity = "info"
title    = "Locale configuration error"
body     = "Debian generates locales via dpkg-reconfigure: sudo dpkg-reconfigure locales — select your locale in the curses UI. Unlike Arch where you edit /etc/locale.gen directly, Debian abstracts this."

# ── AppArmor ──────────────────────────────────────────────────────────────────

[[patterns]]
id       = "apparmor-denial"
sources  = ["journald"]
match_text = "apparmor=\"DENIED\""
severity = "info"
title    = "AppArmor access denied"
body     = "Debian/Ubuntu ships AppArmor — Arch doesn't use MAC by default. An app is blocked by a security profile. Check: sudo aa-status — audit: sudo aa-logprof — or put the profile in complain mode: sudo aa-complain /etc/apparmor.d/<profile>"

# ── Audio ─────────────────────────────────────────────────────────────────────

[[patterns]]
id       = "pipewire-connect-fail"
sources  = ["journald"]
match_text = "Failed to connect to PipeWire"
severity = "warn"
title    = "PipeWire not responding"
body     = "Ubuntu 22.04+/Debian 12+ ship PipeWire like Arch. Restart: systemctl --user restart pipewire pipewire-pulse wireplumber"

[[patterns]]
id       = "pulseaudio-connect-fail"
sources  = ["journald"]
match_text = "Failed to connect to pulseaudio"
severity = "warn"
title    = "PulseAudio not responding"
body     = "Older Debian systems still use PulseAudio. Restart: pulseaudio --kill && pulseaudio --start — you can migrate to PipeWire: sudo apt install pipewire-audio"

[[patterns]]
id       = "bluetooth-rfkill-blocked"
sources  = ["journald"]
match_text = "Blocked through rfkill"
severity = "warn"
title    = "Bluetooth rfkill blocked"
body     = "rfkill unblock bluetooth — same as Arch."

# ── GPU / display ─────────────────────────────────────────────────────────────

[[patterns]]
id       = "gpu-hang"
sources  = ["kmsg"]
match_text = "GPU HANG"
severity = "warn"
title    = "GPU hang"
body     = "GPU stopped responding. For NVIDIA on Ubuntu: sudo apt install nvidia-driver-<version> or ubuntu-drivers autoinstall. Debian requires non-free sources: apt install nvidia-driver"

# ── Network ───────────────────────────────────────────────────────────────────

[[patterns]]
id       = "networkmanager-activation-fail"
sources  = ["journald"]
match_text = "Activation failed"
severity = "info"
title    = "NetworkManager: connection failed"
body     = "nmcli device status — Debian minimal installs may use ifupdown instead of NetworkManager. Check: systemctl status NetworkManager — install if missing: sudo apt install network-manager"

# ── Printing ──────────────────────────────────────────────────────────────────

[[patterns]]
id       = "cups-server-error"
sources  = ["journald"]
match_text = "Unable to connect to CUPS server"
severity = "info"
title    = "Printer service not running"
body     = "sudo systemctl start cups && sudo systemctl enable cups — Debian/Ubuntu handle printing through CUPS; Arch also uses CUPS but it's not always enabled by default."

# ── Gaming ────────────────────────────────────────────────────────────────────

[[patterns]]
id       = "proton-runtime-missing"
sources  = ["applog:proton"]
match_text = "wine: cannot find"
severity = "warn"
title    = "Proton runtime issue"
body     = "Right-click game in Steam -> Properties -> Local Files -> Verify integrity."

# ── Dynamic linker / shared libraries ────────────────────────────────────────

[[patterns]]
id       = "missing-shared-library"
sources  = ["journald"]
match_text = "cannot open shared object file: No such file or directory"
severity = "warn"
title    = "App is missing a system library"
body     = "This program needs a shared library that isn't installed. On Linux, most apps use shared system libraries rather than bundling their own — unlike Windows .exe files. Find the right package: apt-file search libname.so.6 (swap in the missing filename). Or search: apt-cache search libname. Install it: sudo apt install libpackagename. Note: pip and pip3 cannot fix this — Python packages are not system libraries."

[[patterns]]
id       = "slow-boot-network-wait"
sources  = ["journald"]
match_text = "Failed to start Network Wait Online"
severity = "warn"
title    = "Boot is slow: waiting for network"
body     = "systemd is waiting for a full network connection before finishing boot. This is almost never needed on a desktop or laptop. Disable it: sudo systemctl disable systemd-networkd-wait-online.service NetworkManager-wait-online.service — then reboot. Unlike Windows, Linux lets you disable any boot step that isn't relevant to your setup."

[[patterns]]
id       = "slow-boot-device-timeout"
sources  = ["journald"]
match_text = "Timed out waiting for device"
severity = "warn"
title    = "Boot is slow: a device that no longer exists"
body     = "systemd is waiting for a disk, partition, or device that isn't connected. Common cause: /etc/fstab has an entry for an external drive or old partition. Check: cat /etc/fstab — look for lines pointing to drives that aren't always connected. Add the 'nofail' option to make them optional: UUID=xxx /mnt/point type defaults,nofail 0 0. Or comment the line out with #."

[[patterns]]
id       = "slow-boot-long-running-job"
sources  = ["journald"]
match_text = "A start job is running for"
severity = "info"
title    = "A service is taking a long time to start"
body     = "A background service is taking longer than expected during boot. To find what's slowing your startup: open a terminal after booting and run: systemd-analyze blame — the top entries are the biggest contributors. For a visual timeline saved to a file: systemd-analyze plot > ~/boot-profile.svg — then open the SVG in a browser."

# ── SSH / remote access ───────────────────────────────────────────────────────

[[patterns]]
id       = "ssh-permissions-key"
sources  = ["journald"]
match_text = "WARNING: UNPROTECTED PRIVATE KEY FILE"
severity = "warn"
title    = "SSH key permissions are too open"
body     = "Your SSH private key is readable by other users on this system — SSH refuses to use it as a security measure. Fix: chmod 600 ~/.ssh/id_rsa (replace id_rsa with the key filename shown in the error). Also lock the directory: chmod 700 ~/.ssh. This is different from Windows where file permissions are mostly advisory."

# ── Flatpak ───────────────────────────────────────────────────────────────────

[[patterns]]
id       = "flatpak-missing-runtime"
sources  = ["journald"]
match_text = "error: runtime/org."
severity = "warn"
title    = "Flatpak app is missing a runtime"
body     = "A Flatpak app can't find a required runtime (a shared set of libraries). Update all runtimes first: flatpak update — if that doesn't fix it, reinstall the app: flatpak install flathub com.example.AppName. Flatpak runtimes are like Windows runtime packages (VC++ Redistributable) but for Linux apps."

# ── Display / Wayland compatibility ──────────────────────────────────────────

[[patterns]]
id       = "xwayland-crash"
sources  = ["journald"]
match_text = "XWayland server terminated unexpectedly"
severity = "warn"
title    = "XWayland crashed"
body     = "XWayland is the compatibility layer that lets older X11 apps run under Wayland. It crashed, so apps that aren't Wayland-native will stop working until you restart your session. If XWayland keeps crashing: make sure it's installed (sudo apt install xwayland) and check GPU driver stability. Log out and back in to recover."