pyr0ball
c356c1d4c5
Adds 141 new pattern entries via expansion script: Universal (all 25 files): - slow-boot-network-wait: detect NetworkManager-wait-online stalling boot - slow-boot-device-timeout: detect fstab entries for disconnected devices - slow-boot-long-running-job: surface slow service with systemd-analyze hint - ssh-permissions-key: catch unprotected private key file warning - flatpak-missing-runtime: detect missing Flatpak runtime with update/reinstall advice Per distro family: - apparmor-denial: added to windows-to-debian (only missing debian target) - xwayland-crash: added to all files missing it, with distro-correct install cmd (apt/pacman/dnf/zypper per target family) All 42 Rust unit tests pass.
273 lines
14 KiB
TOML
273 lines
14 KiB
TOML
[meta]
|
|
source_os = "linux"
|
|
target_distro_family = "arch"
|
|
|
|
# Experienced Linux user on first Arch/CachyOS install.
|
|
# Body text assumes familiarity with the terminal, systemd, and package management.
|
|
# Explanations focus on Arch-specific divergence from Debian/Fedora conventions.
|
|
|
|
[log_paths]
|
|
pacman = "/var/log/pacman.log"
|
|
steam = "~/.local/share/Steam/logs/content_log.txt"
|
|
proton = "~/.local/share/Steam/logs/proton_log.txt"
|
|
lutris = "~/.cache/lutris/logs/lutris.log"
|
|
|
|
# ── pacman / AUR / Chaotic-AUR ───────────────────────────────────────────────
|
|
|
|
[[patterns]]
|
|
id = "pacman-db-lock"
|
|
sources = ["journald", "applog:pacman"]
|
|
match_text = "could not lock database: File exists"
|
|
severity = "warn"
|
|
title = "pacman database locked"
|
|
body = "Lock file left behind: sudo rm /var/lib/pacman/db.lck — verify nothing is actually running first (fuser /var/lib/pacman/db.lck)."
|
|
|
|
[[patterns]]
|
|
id = "pacman-dep-conflict"
|
|
sources = ["journald", "applog:pacman"]
|
|
match_text = "conflicting dependencies"
|
|
severity = "warn"
|
|
title = "Dependency conflict"
|
|
body = "Unlike apt/dnf, pacman won't silently resolve conflicts — you have to decide. Read the conflict message; usually one package replaces another (e.g. pipewire-pulse replaces pulseaudio). Explicitly remove the conflicting package first."
|
|
|
|
[[patterns]]
|
|
id = "pacman-conflicting-files"
|
|
sources = ["journald", "applog:pacman"]
|
|
match_text = "error: failed to commit transaction (conflicting files)"
|
|
severity = "warn"
|
|
title = "Conflicting files on install"
|
|
body = "A file owned by another package is in the way. Either the package is already partially installed, or there's a leftover file. Check which package owns it: pacman -Qo /path/to/file — then remove the conflict manually or use --overwrite if you're sure."
|
|
|
|
[[patterns]]
|
|
id = "aur-build-failure"
|
|
sources = ["journald", "applog:pacman"]
|
|
match_text = "error: failed to build"
|
|
severity = "warn"
|
|
title = "AUR package build failed"
|
|
body = "makepkg failed. Read the full output — common causes: missing makedepends (check the PKGBUILD), upstream tarball moved (check AUR comments), or a bad patch. paru -Si <pkg> shows the full dependency list."
|
|
|
|
[[patterns]]
|
|
id = "aur-pgp-key"
|
|
sources = ["journald", "applog:pacman"]
|
|
match_text = "unknown public key"
|
|
severity = "warn"
|
|
title = "PGP key not in keyring"
|
|
body = "gpg --recv-keys <keyid> — or if the AUR package's PKGBUILD specifies validpgpkeys, import exactly those. Don't set SKIP_PGP_CHECK unless you trust the source."
|
|
|
|
[[patterns]]
|
|
id = "makepkg-missing-deps"
|
|
sources = ["journald", "applog:pacman"]
|
|
match_text = "Missing dependencies"
|
|
severity = "warn"
|
|
title = "AUR build dependencies missing"
|
|
body = "makepkg needs packages that aren't installed. paru/yay resolve makedepends automatically; if building manually, install them first: sudo pacman -S <dep> or paru -S <dep> for AUR deps."
|
|
|
|
[[patterns]]
|
|
id = "partial-upgrade-warning"
|
|
sources = ["applog:pacman"]
|
|
match_text = "warning: database file for"
|
|
severity = "info"
|
|
title = "Package database out of sync"
|
|
body = "Running pacman -Sy without -u is dangerous on Arch — partial upgrades break things. Always use pacman -Syu. This is the biggest Arch-specific rule coming from Debian or Fedora where partial syncs are fine."
|
|
|
|
[[patterns]]
|
|
id = "chaotic-aur-sig-fail"
|
|
sources = ["journald", "applog:pacman"]
|
|
match_text = "signature from"
|
|
severity = "warn"
|
|
title = "Package signature verification failed"
|
|
body = "A package signature isn't trusted. If it's from Chaotic-AUR: sudo pacman-key --recv-key 3056513887B78AEB --keyserver keyserver.ubuntu.com && sudo pacman-key --lsign-key 3056513887B78AEB — then retry."
|
|
|
|
# ── Kernel / DKMS (rolling release gotcha) ───────────────────────────────────
|
|
|
|
[[patterns]]
|
|
id = "dkms-build-fail"
|
|
sources = ["journald"]
|
|
match_text = "Error! Build of"
|
|
severity = "warn"
|
|
title = "DKMS module failed to build"
|
|
body = "A kernel module didn't compile after a kernel update. More common on CachyOS than on stable distros because the kernel ships with custom patches. Check: dkms status — then reinstall the relevant dkms package or wait for an AUR update."
|
|
|
|
[[patterns]]
|
|
id = "cachyos-kernel-module-fail"
|
|
sources = ["kmsg"]
|
|
match_text = "module verification failed"
|
|
severity = "warn"
|
|
title = "Kernel module signature mismatch"
|
|
body = "A module doesn't match the running kernel's signing key. On CachyOS this can happen with third-party modules after a cachyos-kernel update. Reinstall the dkms module package or check if a -cachyos suffixed build exists in the AUR."
|
|
|
|
[[patterns]]
|
|
id = "kernel-driver-firmware"
|
|
sources = ["kmsg"]
|
|
match_text = "firmware: failed to load"
|
|
severity = "warn"
|
|
title = "Firmware file missing"
|
|
body = "sudo pacman -S linux-firmware — if it's a specific device (e.g. Realtek wifi), check linux-firmware-qlogic or a dedicated AUR package."
|
|
|
|
# ── System ────────────────────────────────────────────────────────────────────
|
|
|
|
[[patterns]]
|
|
id = "locale-not-set"
|
|
sources = ["journald"]
|
|
match_text = "Cannot set LC_ALL to default locale"
|
|
severity = "info"
|
|
title = "Locale not generated"
|
|
body = "Unlike Debian/Ubuntu, Arch doesn't generate locales automatically. Edit /etc/locale.gen (uncomment your locale), then run: sudo locale-gen — and set LANG in /etc/locale.conf."
|
|
|
|
[[patterns]]
|
|
id = "systemd-resolved-fail"
|
|
sources = ["journald"]
|
|
match_text = "Failed to set DNS configuration"
|
|
severity = "info"
|
|
title = "DNS configuration failed"
|
|
body = "systemd-resolved had trouble applying DNS settings. Check: resolvectl status — on Arch, /etc/resolv.conf should be a symlink to /run/systemd/resolve/stub-resolv.conf. If it's a plain file it may conflict."
|
|
|
|
[[patterns]]
|
|
id = "oom-killer"
|
|
sources = ["kmsg"]
|
|
match_text = "Out of memory: Kill process"
|
|
severity = "warn"
|
|
title = "OOM killer fired"
|
|
body = "A process was killed for RAM. CachyOS ships uksmd (userspace KSM) to help with this — check it's running: systemctl status uksmd. Also consider zram: sudo pacman -S zram-generator."
|
|
|
|
[[patterns]]
|
|
id = "disk-io-error"
|
|
sources = ["kmsg"]
|
|
match_text = "Buffer I/O error on device"
|
|
severity = "warn"
|
|
title = "Disk I/O error"
|
|
body = "Storage error on a block device. Check SMART: sudo smartctl -a /dev/sdX — or for NVMe: sudo nvme smart-log /dev/nvme0."
|
|
|
|
# ── Audio / Bluetooth ─────────────────────────────────────────────────────────
|
|
|
|
[[patterns]]
|
|
id = "pipewire-connect-fail"
|
|
sources = ["journald"]
|
|
match_text = "Failed to connect to PipeWire"
|
|
severity = "warn"
|
|
title = "PipeWire not responding"
|
|
body = "systemctl --user restart pipewire pipewire-pulse wireplumber — if it keeps failing, check: systemctl --user status pipewire"
|
|
|
|
[[patterns]]
|
|
id = "wireplumber-fail"
|
|
sources = ["journald"]
|
|
match_text = "Failed to activate"
|
|
severity = "warn"
|
|
title = "WirePlumber activation error"
|
|
body = "systemctl --user restart wireplumber — if audio devices keep disappearing after suspend/resume, this is a known CachyOS/PipeWire interaction; check AUR for wireplumber-git."
|
|
|
|
[[patterns]]
|
|
id = "bluetooth-rfkill-blocked"
|
|
sources = ["journald"]
|
|
match_text = "Blocked through rfkill"
|
|
severity = "warn"
|
|
title = "Bluetooth rfkill blocked"
|
|
body = "rfkill unblock bluetooth — if hard-blocked, check BIOS or a physical switch."
|
|
|
|
[[patterns]]
|
|
id = "bluetooth-profile-unavailable"
|
|
sources = ["journald"]
|
|
match_text = "br-connection-profile-unavailable"
|
|
severity = "info"
|
|
title = "Bluetooth audio profile missing"
|
|
body = "Check pipewire-bluetooth is installed: pacman -Q pipewire-bluetooth — and that wireplumber is running. Some headsets need libspa-bluetooth."
|
|
|
|
# ── GPU / display ─────────────────────────────────────────────────────────────
|
|
|
|
[[patterns]]
|
|
id = "gpu-hang"
|
|
sources = ["kmsg"]
|
|
match_text = "GPU HANG"
|
|
severity = "warn"
|
|
title = "GPU hang"
|
|
body = "GPU stopped responding; driver recovered. On CachyOS with AMD: check if mesa-git (from Chaotic-AUR) is newer than the stable mesa and matches your kernel. On NVIDIA: check nvidia-dkms version vs kernel version."
|
|
|
|
[[patterns]]
|
|
id = "xwayland-crash"
|
|
sources = ["journald"]
|
|
match_text = "XWayland server terminated unexpectedly"
|
|
severity = "warn"
|
|
title = "XWayland crashed"
|
|
body = "X11 apps will be dead until you restart your session. If this is reproducible with a specific app, try WAYLAND_DISPLAY= to force it onto XWayland explicitly, or check for a Wayland-native version."
|
|
|
|
# ── Gaming ────────────────────────────────────────────────────────────────────
|
|
|
|
[[patterns]]
|
|
id = "proton-runtime-missing"
|
|
sources = ["applog:proton"]
|
|
match_text = "wine: cannot find"
|
|
severity = "warn"
|
|
title = "Proton runtime issue"
|
|
body = "Verify game files via Steam, or check that the Steam runtime is intact: ~/.steam/root/ubuntu12_32/"
|
|
|
|
[[patterns]]
|
|
id = "lutris-wine-fail"
|
|
sources = ["applog:lutris"]
|
|
match_text = "Wine is not installed"
|
|
severity = "warn"
|
|
title = "Lutris: Wine not found"
|
|
body = "Lutris needs a Wine runner. In Lutris: Preferences -> Runners -> Wine -> Install — or install wine from the AUR: paru -S wine-staging"
|
|
|
|
# ── Network ───────────────────────────────────────────────────────────────────
|
|
|
|
[[patterns]]
|
|
id = "networkmanager-activation-fail"
|
|
sources = ["journald"]
|
|
match_text = "Activation failed"
|
|
severity = "info"
|
|
title = "NetworkManager: connection failed"
|
|
body = "nmcli device status — if a wifi adapter is missing, check dmesg for firmware errors. CachyOS ships most firmware in linux-firmware but some chips (Realtek 8852) need AUR packages."
|
|
|
|
# ── Dynamic linker / shared libraries ────────────────────────────────────────
|
|
|
|
[[patterns]]
|
|
id = "missing-shared-library"
|
|
sources = ["journald"]
|
|
match_text = "cannot open shared object file: No such file or directory"
|
|
severity = "warn"
|
|
title = "App is missing a system library"
|
|
body = "This program needs a shared library that isn't installed. On Linux, apps use shared system libraries rather than bundling their own — unlike Windows .exe files. Search for the package: pkgfile libname.so.6 (install pkgfile first: sudo pacman -S pkgfile && sudo pkgfile -u). Or search: pacman -Ss libname. Install it: sudo pacman -S packagename. Note: pip and pip3 cannot fix this — Python packages are not system libraries."
|
|
|
|
[[patterns]]
|
|
id = "slow-boot-network-wait"
|
|
sources = ["journald"]
|
|
match_text = "Failed to start Network Wait Online"
|
|
severity = "warn"
|
|
title = "Boot is slow: waiting for network"
|
|
body = "systemd is waiting for a full network connection before finishing boot. This is almost never needed on a desktop or laptop. Disable it: sudo systemctl disable systemd-networkd-wait-online.service NetworkManager-wait-online.service — then reboot. Unlike Windows, Linux lets you disable any boot step that isn't relevant to your setup."
|
|
|
|
[[patterns]]
|
|
id = "slow-boot-device-timeout"
|
|
sources = ["journald"]
|
|
match_text = "Timed out waiting for device"
|
|
severity = "warn"
|
|
title = "Boot is slow: a device that no longer exists"
|
|
body = "systemd is waiting for a disk, partition, or device that isn't connected. Common cause: /etc/fstab has an entry for an external drive or old partition. Check: cat /etc/fstab — look for lines pointing to drives that aren't always connected. Add the 'nofail' option to make them optional: UUID=xxx /mnt/point type defaults,nofail 0 0. Or comment the line out with #."
|
|
|
|
[[patterns]]
|
|
id = "slow-boot-long-running-job"
|
|
sources = ["journald"]
|
|
match_text = "A start job is running for"
|
|
severity = "info"
|
|
title = "A service is taking a long time to start"
|
|
body = "A background service is taking longer than expected during boot. To find what's slowing your startup: open a terminal after booting and run: systemd-analyze blame — the top entries are the biggest contributors. For a visual timeline saved to a file: systemd-analyze plot > ~/boot-profile.svg — then open the SVG in a browser."
|
|
|
|
# ── SSH / remote access ───────────────────────────────────────────────────────
|
|
|
|
[[patterns]]
|
|
id = "ssh-permissions-key"
|
|
sources = ["journald"]
|
|
match_text = "WARNING: UNPROTECTED PRIVATE KEY FILE"
|
|
severity = "warn"
|
|
title = "SSH key permissions are too open"
|
|
body = "Your SSH private key is readable by other users on this system — SSH refuses to use it as a security measure. Fix: chmod 600 ~/.ssh/id_rsa (replace id_rsa with the key filename shown in the error). Also lock the directory: chmod 700 ~/.ssh. This is different from Windows where file permissions are mostly advisory."
|
|
|
|
# ── Flatpak ───────────────────────────────────────────────────────────────────
|
|
|
|
[[patterns]]
|
|
id = "flatpak-missing-runtime"
|
|
sources = ["journald"]
|
|
match_text = "error: runtime/org."
|
|
severity = "warn"
|
|
title = "Flatpak app is missing a runtime"
|
|
body = "A Flatpak app can't find a required runtime (a shared set of libraries). Update all runtimes first: flatpak update — if that doesn't fix it, reinstall the app: flatpak install flathub com.example.AppName. Flatpak runtimes are like Windows runtime packages (VC++ Redistributable) but for Linux apps."
|