pyr0ball
c356c1d4c5
Adds 141 new pattern entries via expansion script: Universal (all 25 files): - slow-boot-network-wait: detect NetworkManager-wait-online stalling boot - slow-boot-device-timeout: detect fstab entries for disconnected devices - slow-boot-long-running-job: surface slow service with systemd-analyze hint - ssh-permissions-key: catch unprotected private key file warning - flatpak-missing-runtime: detect missing Flatpak runtime with update/reinstall advice Per distro family: - apparmor-denial: added to windows-to-debian (only missing debian target) - xwayland-crash: added to all files missing it, with distro-correct install cmd (apt/pacman/dnf/zypper per target family) All 42 Rust unit tests pass.
231 lines
12 KiB
TOML
231 lines
12 KiB
TOML
[meta]
|
|
source_os = "macos"
|
|
target_distro_family = "arch"
|
|
|
|
[log_paths]
|
|
steam = "~/.local/share/Steam/logs/content_log.txt"
|
|
proton = "~/.local/share/Steam/logs/proton_log.txt"
|
|
retroarch = "~/.config/retroarch/retroarch.log"
|
|
lutris = "~/.cache/lutris/logs/lutris.log"
|
|
|
|
# ── AUR / package management ────────────────────────────────────────────────
|
|
|
|
[[patterns]]
|
|
id = "aur-build-failure"
|
|
sources = ["journald"]
|
|
match_text = "error: failed to build"
|
|
severity = "warn"
|
|
title = "AUR package build failed"
|
|
body = "A package failed to compile from source. This usually means a missing dependency or a broken AUR package. Check the output for the specific error, or look up the package comments on aur.archlinux.org."
|
|
|
|
[[patterns]]
|
|
id = "aur-pgp-key"
|
|
sources = ["journald"]
|
|
match_text = "unknown public key"
|
|
severity = "warn"
|
|
title = "Missing PGP key for AUR package"
|
|
body = "The package signature can't be verified. The key ID will be in the error — run: gpg --recv-keys <keyid>"
|
|
|
|
[[patterns]]
|
|
id = "pacman-db-lock"
|
|
sources = ["journald"]
|
|
match_text = "could not lock database: File exists"
|
|
severity = "warn"
|
|
title = "Pacman database is locked"
|
|
body = "Another pacman process left a lock file behind. If nothing is running: sudo rm /var/lib/pacman/db.lck — then retry your command."
|
|
|
|
[[patterns]]
|
|
id = "pacman-dep-conflict"
|
|
sources = ["journald"]
|
|
match_text = "conflicting dependencies"
|
|
severity = "warn"
|
|
title = "Package dependency conflict"
|
|
body = "Two packages need incompatible versions of something. On Arch this sometimes happens with AUR packages. Read the conflict message carefully — one of the packages usually has to be replaced or manually removed first."
|
|
|
|
[[patterns]]
|
|
id = "dkms-build-fail"
|
|
sources = ["journald"]
|
|
match_text = "Error! Build of"
|
|
severity = "warn"
|
|
title = "Kernel module failed to build"
|
|
body = "A DKMS kernel module didn't compile after a kernel update. This can break hardware that needs out-of-tree drivers (e.g. some wifi cards, VirtualBox, NVIDIA). Check: dkms status — then reinstall the failing module package."
|
|
|
|
# ── Audio ────────────────────────────────────────────────────────────────────
|
|
|
|
[[patterns]]
|
|
id = "pipewire-connect-fail"
|
|
sources = ["journald"]
|
|
match_text = "Failed to connect to PipeWire"
|
|
severity = "warn"
|
|
title = "Audio server not responding"
|
|
body = "An app can't reach PipeWire (the audio server). Try: systemctl --user restart pipewire pipewire-pulse — if that doesn't help, log out and back in."
|
|
|
|
[[patterns]]
|
|
id = "wireplumber-fail"
|
|
sources = ["journald"]
|
|
match_text = "Failed to activate"
|
|
severity = "warn"
|
|
title = "Audio session manager error"
|
|
body = "WirePlumber (the audio session manager) had a problem activating a device. Try: systemctl --user restart wireplumber — if audio devices keep disappearing, check that your user is in the 'audio' group: groups $USER"
|
|
|
|
# ── Bluetooth ────────────────────────────────────────────────────────────────
|
|
|
|
[[patterns]]
|
|
id = "bluetooth-rfkill-blocked"
|
|
sources = ["journald"]
|
|
match_text = "Blocked through rfkill"
|
|
severity = "warn"
|
|
title = "Bluetooth is blocked by rfkill"
|
|
body = "The system's radio kill switch is blocking Bluetooth. Run: rfkill list — if Bluetooth shows 'Hard blocked: no, Soft blocked: yes', run: rfkill unblock bluetooth"
|
|
|
|
[[patterns]]
|
|
id = "bluetooth-profile-unavailable"
|
|
sources = ["journald"]
|
|
match_text = "br-connection-profile-unavailable"
|
|
severity = "info"
|
|
title = "Bluetooth profile not available"
|
|
body = "A Bluetooth device connected but a required profile isn't available. This often means missing codecs. Try: sudo pacman -S pulseaudio-bluetooth (if using PulseAudio) or check that pipewire-bluetooth is installed."
|
|
|
|
# ── GPU / display ─────────────────────────────────────────────────────────────
|
|
|
|
[[patterns]]
|
|
id = "gpu-hang"
|
|
sources = ["kmsg"]
|
|
match_text = "GPU HANG"
|
|
severity = "warn"
|
|
title = "GPU hang detected"
|
|
body = "The graphics card stopped responding. Linux recovered, but this can cause game crashes and display glitches. Common causes: overheating, or a driver bug with the current kernel. Check GPU temperature and consider updating mesa or your GPU driver package."
|
|
|
|
[[patterns]]
|
|
id = "xwayland-crash"
|
|
sources = ["journald"]
|
|
match_text = "XWayland server terminated unexpectedly"
|
|
severity = "warn"
|
|
title = "XWayland crashed"
|
|
body = "The compatibility layer for older X11 apps crashed. Apps using X11 (not Wayland-native) will stop working until you restart your session. If this keeps happening, try running the affected app with WAYLAND_DISPLAY= cleared to force X11 mode."
|
|
|
|
# ── Hardware / kernel ─────────────────────────────────────────────────────────
|
|
|
|
[[patterns]]
|
|
id = "kernel-driver-firmware"
|
|
sources = ["kmsg"]
|
|
match_text = "firmware: failed to load"
|
|
severity = "warn"
|
|
title = "Missing firmware for hardware"
|
|
body = "Your system is missing a firmware file for a hardware component. On Arch: sudo pacman -S linux-firmware — then reboot."
|
|
|
|
[[patterns]]
|
|
id = "oom-killer"
|
|
sources = ["kmsg"]
|
|
match_text = "Out of memory: Kill process"
|
|
severity = "warn"
|
|
title = "System ran out of memory"
|
|
body = "Linux had to kill a process because RAM was exhausted. On macOS, the system compresses memory instead. On Linux you can add swap space as a safety net: consider a swapfile if your machine has limited RAM."
|
|
|
|
[[patterns]]
|
|
id = "disk-io-error"
|
|
sources = ["kmsg"]
|
|
match_text = "Buffer I/O error on device"
|
|
severity = "warn"
|
|
title = "Disk read/write error"
|
|
body = "A storage device had an I/O error. This can mean a failing drive, a bad cable, or a filesystem problem. Check the device with: sudo smartctl -a /dev/sdX — replace sdX with the device from the error."
|
|
|
|
# ── Network ──────────────────────────────────────────────────────────────────
|
|
|
|
[[patterns]]
|
|
id = "networkmanager-activation-fail"
|
|
sources = ["journald"]
|
|
match_text = "Activation failed"
|
|
severity = "info"
|
|
title = "Network connection failed to activate"
|
|
body = "NetworkManager couldn't connect to a network. Common causes: wrong wifi password, a driver issue, or the network requiring a login page. Check: nmcli device status"
|
|
|
|
# ── Media ────────────────────────────────────────────────────────────────────
|
|
|
|
[[patterns]]
|
|
id = "missing-codec"
|
|
sources = ["journald"]
|
|
match_text = "GStreamer: Failed to find plugin"
|
|
severity = "info"
|
|
title = "Missing media codec"
|
|
body = "A media codec isn't installed. On Arch: sudo pacman -S gst-plugins-good gst-plugins-bad gst-libav"
|
|
|
|
# ── Gaming ────────────────────────────────────────────────────────────────────
|
|
|
|
[[patterns]]
|
|
id = "proton-runtime-missing"
|
|
sources = ["applog:proton"]
|
|
match_text = "wine: cannot find"
|
|
severity = "warn"
|
|
title = "Proton runtime issue"
|
|
body = "Steam Proton couldn't find a required file. Try: right-click the game -> Properties -> Local Files -> Verify game files."
|
|
|
|
[[patterns]]
|
|
id = "steam-disk-write"
|
|
sources = ["applog:steam"]
|
|
match_text = "ERROR: failed to write"
|
|
severity = "warn"
|
|
title = "Steam disk write error"
|
|
body = "Steam can't write to its library folder. Check ownership: ls -la ~/.local/share/Steam"
|
|
|
|
[[patterns]]
|
|
id = "retroarch-shader-fail"
|
|
sources = ["applog:retroarch"]
|
|
match_text = "Failed to compile shader"
|
|
severity = "info"
|
|
title = "RetroArch shader failed to compile"
|
|
body = "A graphical shader couldn't load. Try switching preset in Settings -> Video -> Shaders."
|
|
|
|
# ── Dynamic linker / shared libraries ────────────────────────────────────────
|
|
|
|
[[patterns]]
|
|
id = "missing-shared-library"
|
|
sources = ["journald"]
|
|
match_text = "cannot open shared object file: No such file or directory"
|
|
severity = "warn"
|
|
title = "App is missing a system library"
|
|
body = "This program needs a shared library that isn't installed. On Linux, apps use shared system libraries rather than bundling their own — unlike Windows .exe files. Search for the package: pkgfile libname.so.6 (install pkgfile first: sudo pacman -S pkgfile && sudo pkgfile -u). Or search: pacman -Ss libname. Install it: sudo pacman -S packagename. Note: pip and pip3 cannot fix this — Python packages are not system libraries."
|
|
|
|
[[patterns]]
|
|
id = "slow-boot-network-wait"
|
|
sources = ["journald"]
|
|
match_text = "Failed to start Network Wait Online"
|
|
severity = "warn"
|
|
title = "Boot is slow: waiting for network"
|
|
body = "systemd is waiting for a full network connection before finishing boot. This is almost never needed on a desktop or laptop. Disable it: sudo systemctl disable systemd-networkd-wait-online.service NetworkManager-wait-online.service — then reboot. Unlike Windows, Linux lets you disable any boot step that isn't relevant to your setup."
|
|
|
|
[[patterns]]
|
|
id = "slow-boot-device-timeout"
|
|
sources = ["journald"]
|
|
match_text = "Timed out waiting for device"
|
|
severity = "warn"
|
|
title = "Boot is slow: a device that no longer exists"
|
|
body = "systemd is waiting for a disk, partition, or device that isn't connected. Common cause: /etc/fstab has an entry for an external drive or old partition. Check: cat /etc/fstab — look for lines pointing to drives that aren't always connected. Add the 'nofail' option to make them optional: UUID=xxx /mnt/point type defaults,nofail 0 0. Or comment the line out with #."
|
|
|
|
[[patterns]]
|
|
id = "slow-boot-long-running-job"
|
|
sources = ["journald"]
|
|
match_text = "A start job is running for"
|
|
severity = "info"
|
|
title = "A service is taking a long time to start"
|
|
body = "A background service is taking longer than expected during boot. To find what's slowing your startup: open a terminal after booting and run: systemd-analyze blame — the top entries are the biggest contributors. For a visual timeline saved to a file: systemd-analyze plot > ~/boot-profile.svg — then open the SVG in a browser."
|
|
|
|
# ── SSH / remote access ───────────────────────────────────────────────────────
|
|
|
|
[[patterns]]
|
|
id = "ssh-permissions-key"
|
|
sources = ["journald"]
|
|
match_text = "WARNING: UNPROTECTED PRIVATE KEY FILE"
|
|
severity = "warn"
|
|
title = "SSH key permissions are too open"
|
|
body = "Your SSH private key is readable by other users on this system — SSH refuses to use it as a security measure. Fix: chmod 600 ~/.ssh/id_rsa (replace id_rsa with the key filename shown in the error). Also lock the directory: chmod 700 ~/.ssh. This is different from Windows where file permissions are mostly advisory."
|
|
|
|
# ── Flatpak ───────────────────────────────────────────────────────────────────
|
|
|
|
[[patterns]]
|
|
id = "flatpak-missing-runtime"
|
|
sources = ["journald"]
|
|
match_text = "error: runtime/org."
|
|
severity = "warn"
|
|
title = "Flatpak app is missing a runtime"
|
|
body = "A Flatpak app can't find a required runtime (a shared set of libraries). Update all runtimes first: flatpak update — if that doesn't fix it, reinstall the app: flatpak install flathub com.example.AppName. Flatpak runtimes are like Windows runtime packages (VC++ Redistributable) but for Linux apps."
|