pyr0ball
c356c1d4c5
Adds 141 new pattern entries via expansion script: Universal (all 25 files): - slow-boot-network-wait: detect NetworkManager-wait-online stalling boot - slow-boot-device-timeout: detect fstab entries for disconnected devices - slow-boot-long-running-job: surface slow service with systemd-analyze hint - ssh-permissions-key: catch unprotected private key file warning - flatpak-missing-runtime: detect missing Flatpak runtime with update/reinstall advice Per distro family: - apparmor-denial: added to windows-to-debian (only missing debian target) - xwayland-crash: added to all files missing it, with distro-correct install cmd (apt/pacman/dnf/zypper per target family) All 42 Rust unit tests pass.
263 lines
14 KiB
TOML
263 lines
14 KiB
TOML
[meta]
|
|
source_os = "windows"
|
|
target_distro_family = "debian"
|
|
|
|
[log_paths]
|
|
steam = "~/.local/share/Steam/logs/content_log.txt"
|
|
proton = "~/.local/share/Steam/logs/proton_log.txt"
|
|
retroarch = "~/.config/retroarch/retroarch.log"
|
|
libreoffice = "~/.config/libreoffice/4/user/registrymodifications.xcu"
|
|
|
|
# ── Package management ───────────────────────────────────────────────────────
|
|
|
|
[[patterns]]
|
|
id = "apt-lock"
|
|
sources = ["journald"]
|
|
match_text = "Could not get lock /var/lib/dpkg/lock"
|
|
severity = "warn"
|
|
title = "Package manager is locked"
|
|
body = "Another process is using apt — usually an automatic update running in the background. Wait a minute and try again. If it's been stuck a long time: sudo rm /var/lib/dpkg/lock-frontend /var/lib/dpkg/lock"
|
|
|
|
[[patterns]]
|
|
id = "apt-unmet-dependency"
|
|
sources = ["journald"]
|
|
match_text = "Unmet dependencies"
|
|
severity = "warn"
|
|
title = "Package dependency conflict"
|
|
body = "apt can't resolve a dependency. Try: sudo apt --fix-broken install"
|
|
|
|
[[patterns]]
|
|
id = "dpkg-interrupted"
|
|
sources = ["journald"]
|
|
match_text = "dpkg was interrupted"
|
|
severity = "warn"
|
|
title = "Package install was interrupted"
|
|
body = "A previous install didn't complete cleanly. This is like a Windows installer that got cut off mid-run. Fix it with: sudo dpkg --configure -a — then run your install again."
|
|
|
|
# ── Audio ────────────────────────────────────────────────────────────────────
|
|
|
|
[[patterns]]
|
|
id = "pipewire-connect-fail"
|
|
sources = ["journald"]
|
|
match_text = "Failed to connect to PipeWire"
|
|
severity = "warn"
|
|
title = "Audio server not responding"
|
|
body = "An app can't reach PipeWire (the audio system). Try: systemctl --user restart pipewire pipewire-pulse — if sound still doesn't work, log out and back in."
|
|
|
|
[[patterns]]
|
|
id = "pulseaudio-connect-fail"
|
|
sources = ["journald"]
|
|
match_text = "Failed to connect to pulseaudio"
|
|
severity = "warn"
|
|
title = "Audio server not responding"
|
|
body = "An app can't reach the audio server. Try: pulseaudio --kill && pulseaudio --start — if that doesn't help, log out and back in."
|
|
|
|
# ── Bluetooth ────────────────────────────────────────────────────────────────
|
|
|
|
[[patterns]]
|
|
id = "bluetooth-rfkill-blocked"
|
|
sources = ["journald"]
|
|
match_text = "Blocked through rfkill"
|
|
severity = "warn"
|
|
title = "Bluetooth is software-blocked"
|
|
body = "A software switch is blocking Bluetooth. Run: rfkill unblock bluetooth — if it's showing Hard blocked, there may be a physical switch or BIOS setting involved."
|
|
|
|
[[patterns]]
|
|
id = "bluetooth-profile-unavailable"
|
|
sources = ["journald"]
|
|
match_text = "br-connection-profile-unavailable"
|
|
severity = "info"
|
|
title = "Bluetooth profile not available"
|
|
body = "A Bluetooth device connected but a required audio profile isn't available. Try: sudo apt install pulseaudio-module-bluetooth — then restart pulseaudio."
|
|
|
|
# ── Filesystem / storage ──────────────────────────────────────────────────────
|
|
|
|
[[patterns]]
|
|
id = "ntfs-volume-dirty"
|
|
sources = ["kmsg"]
|
|
match_text = "volume is dirty"
|
|
severity = "warn"
|
|
title = "External drive needs Windows check"
|
|
body = "An NTFS drive (probably from Windows) wasn't safely ejected and needs a check. Mount it in Windows and run chkdsk, or force-mount on Linux with: sudo mount -o remove_hiberfile /dev/sdX /mnt/point"
|
|
|
|
[[patterns]]
|
|
id = "ntfs-force-required"
|
|
sources = ["kmsg"]
|
|
match_text = "Dirty flag is set"
|
|
severity = "warn"
|
|
title = "Drive mounted read-only (dirty flag)"
|
|
body = "Linux mounted this NTFS drive read-only because Windows marked it as needing a check. Boot into Windows and do a safe shutdown, or use: sudo ntfsfix /dev/sdX"
|
|
|
|
[[patterns]]
|
|
id = "disk-io-error"
|
|
sources = ["kmsg"]
|
|
match_text = "Buffer I/O error on device"
|
|
severity = "warn"
|
|
title = "Disk read/write error"
|
|
body = "A storage device had an error. This could be a failing USB drive, a bad cable, or a corrupted filesystem. Check: sudo smartctl -a /dev/sdX — replace sdX with the device shown in the error."
|
|
|
|
[[patterns]]
|
|
id = "usb-device-reset"
|
|
sources = ["kmsg"]
|
|
match_text = "device descriptor read/64, error"
|
|
severity = "info"
|
|
title = "USB device not recognised"
|
|
body = "A USB device is having trouble connecting. Try a different USB port, or unplug and replug. If it's a hub, try plugging directly into the computer."
|
|
|
|
# ── Hardware / kernel ─────────────────────────────────────────────────────────
|
|
|
|
[[patterns]]
|
|
id = "kernel-driver-firmware"
|
|
sources = ["kmsg"]
|
|
match_text = "firmware: failed to load"
|
|
severity = "warn"
|
|
title = "Missing firmware for hardware"
|
|
body = "Your system is missing a firmware file. On Debian/Ubuntu/Mint: sudo apt install firmware-linux firmware-linux-nonfree — then reboot."
|
|
|
|
[[patterns]]
|
|
id = "oom-killer"
|
|
sources = ["kmsg"]
|
|
match_text = "Out of memory: Kill process"
|
|
severity = "warn"
|
|
title = "System ran out of memory"
|
|
body = "Linux had to forcibly close a program to free RAM. Windows handles this differently with virtual memory. If this keeps happening, consider adding a swap file or closing more background apps."
|
|
|
|
[[patterns]]
|
|
id = "gpu-hang"
|
|
sources = ["kmsg"]
|
|
match_text = "GPU HANG"
|
|
severity = "warn"
|
|
title = "GPU hang detected"
|
|
body = "The graphics card stopped responding. Linux recovered, but games or video apps may have crashed. Check for overheating, and make sure your GPU drivers are up to date."
|
|
|
|
# ── Network ──────────────────────────────────────────────────────────────────
|
|
|
|
[[patterns]]
|
|
id = "networkmanager-activation-fail"
|
|
sources = ["journald"]
|
|
match_text = "Activation failed"
|
|
severity = "info"
|
|
title = "Network connection failed"
|
|
body = "NetworkManager couldn't connect. Common causes: wrong wifi password, a captive portal (hotel/coffee shop wifi), or a driver issue. Check: nmcli device status"
|
|
|
|
# ── Printing ──────────────────────────────────────────────────────────────────
|
|
|
|
[[patterns]]
|
|
id = "cups-server-error"
|
|
sources = ["journald"]
|
|
match_text = "Unable to connect to CUPS server"
|
|
severity = "info"
|
|
title = "Printer service not running"
|
|
body = "The print server (CUPS) isn't running. Start it: sudo systemctl start cups — and enable it to start automatically: sudo systemctl enable cups"
|
|
|
|
# ── Media ────────────────────────────────────────────────────────────────────
|
|
|
|
[[patterns]]
|
|
id = "missing-codec"
|
|
sources = ["journald"]
|
|
match_text = "GStreamer: Failed to find plugin"
|
|
severity = "info"
|
|
title = "Missing media codec"
|
|
body = "A media codec isn't installed. On Ubuntu/Mint: sudo apt install ubuntu-restricted-extras — this installs common video, audio, and font packages."
|
|
|
|
[[patterns]]
|
|
id = "snap-confinement"
|
|
sources = ["journald"]
|
|
match_text = "snap: cannot use strict"
|
|
severity = "info"
|
|
title = "Snap package permission issue"
|
|
body = "A Snap package is having permission trouble. Try running it with --devmode, or look for a Flatpak or apt alternative. Note: Snap is disabled by default on Linux Mint — use apt or Flatpak instead."
|
|
|
|
# ── Gaming ────────────────────────────────────────────────────────────────────
|
|
|
|
[[patterns]]
|
|
id = "proton-runtime-missing"
|
|
sources = ["applog:proton"]
|
|
match_text = "wine: cannot find"
|
|
severity = "warn"
|
|
title = "Proton runtime issue"
|
|
body = "Steam Proton couldn't find a required file. Right-click the game -> Properties -> Local Files -> Verify game files."
|
|
|
|
[[patterns]]
|
|
id = "steam-disk-write"
|
|
sources = ["applog:steam"]
|
|
match_text = "ERROR: failed to write"
|
|
severity = "warn"
|
|
title = "Steam disk write error"
|
|
body = "Steam can't write to its library folder. Check: ls -la ~/.local/share/Steam"
|
|
|
|
# ── Dynamic linker / shared libraries ────────────────────────────────────────
|
|
|
|
[[patterns]]
|
|
id = "missing-shared-library"
|
|
sources = ["journald"]
|
|
match_text = "cannot open shared object file: No such file or directory"
|
|
severity = "warn"
|
|
title = "App is missing a system library"
|
|
body = "This program needs a shared library that isn't installed. On Linux, most apps use shared system libraries rather than bundling their own — unlike Windows .exe files. Find the right package: apt-file search libname.so.6 (swap in the missing filename). Or search by name: apt-cache search libname. Install it: sudo apt install libpackagename. Note: pip and pip3 cannot fix this — Python packages are not system libraries."
|
|
|
|
[[patterns]]
|
|
id = "slow-boot-network-wait"
|
|
sources = ["journald"]
|
|
match_text = "Failed to start Network Wait Online"
|
|
severity = "warn"
|
|
title = "Boot is slow: waiting for network"
|
|
body = "systemd is waiting for a full network connection before finishing boot. This is almost never needed on a desktop or laptop. Disable it: sudo systemctl disable systemd-networkd-wait-online.service NetworkManager-wait-online.service — then reboot. Unlike Windows, Linux lets you disable any boot step that isn't relevant to your setup."
|
|
|
|
[[patterns]]
|
|
id = "slow-boot-device-timeout"
|
|
sources = ["journald"]
|
|
match_text = "Timed out waiting for device"
|
|
severity = "warn"
|
|
title = "Boot is slow: a device that no longer exists"
|
|
body = "systemd is waiting for a disk, partition, or device that isn't connected. Common cause: /etc/fstab has an entry for an external drive or old partition. Check: cat /etc/fstab — look for lines pointing to drives that aren't always connected. Add the 'nofail' option to make them optional: UUID=xxx /mnt/point type defaults,nofail 0 0. Or comment the line out with #."
|
|
|
|
[[patterns]]
|
|
id = "slow-boot-long-running-job"
|
|
sources = ["journald"]
|
|
match_text = "A start job is running for"
|
|
severity = "info"
|
|
title = "A service is taking a long time to start"
|
|
body = "A background service is taking longer than expected during boot. To find what's slowing your startup: open a terminal after booting and run: systemd-analyze blame — the top entries are the biggest contributors. For a visual timeline saved to a file: systemd-analyze plot > ~/boot-profile.svg — then open the SVG in a browser."
|
|
|
|
# ── SSH / remote access ───────────────────────────────────────────────────────
|
|
|
|
[[patterns]]
|
|
id = "ssh-permissions-key"
|
|
sources = ["journald"]
|
|
match_text = "WARNING: UNPROTECTED PRIVATE KEY FILE"
|
|
severity = "warn"
|
|
title = "SSH key permissions are too open"
|
|
body = "Your SSH private key is readable by other users on this system — SSH refuses to use it as a security measure. Fix: chmod 600 ~/.ssh/id_rsa (replace id_rsa with the key filename shown in the error). Also lock the directory: chmod 700 ~/.ssh. This is different from Windows where file permissions are mostly advisory."
|
|
|
|
# ── Flatpak ───────────────────────────────────────────────────────────────────
|
|
|
|
[[patterns]]
|
|
id = "flatpak-missing-runtime"
|
|
sources = ["journald"]
|
|
match_text = "error: runtime/org."
|
|
severity = "warn"
|
|
title = "Flatpak app is missing a runtime"
|
|
body = "A Flatpak app can't find a required runtime (a shared set of libraries). Update all runtimes first: flatpak update — if that doesn't fix it, reinstall the app: flatpak install flathub com.example.AppName. Flatpak runtimes are like Windows runtime packages (VC++ Redistributable) but for Linux apps."
|
|
|
|
# ── Security (AppArmor) ───────────────────────────────────────────────────────
|
|
|
|
[[patterns]]
|
|
id = "apparmor-denial"
|
|
sources = ["journald"]
|
|
match_text = "apparmor=\"DENIED\""
|
|
severity = "warn"
|
|
title = "AppArmor blocked an application"
|
|
body = "AppArmor (a mandatory access control system) blocked a program from accessing a file or resource. This often happens with Wine, Bottles, or AppImages running software that wasn't installed through your package manager. To see what was blocked: sudo journalctl -b | grep apparmor. To temporarily put a profile in learning mode: sudo aa-complain /etc/apparmor.d/profile-name."
|
|
|
|
|
|
# ── Display / Wayland compatibility ──────────────────────────────────────────
|
|
|
|
[[patterns]]
|
|
id = "xwayland-crash"
|
|
sources = ["journald"]
|
|
match_text = "XWayland server terminated unexpectedly"
|
|
severity = "warn"
|
|
title = "XWayland crashed"
|
|
body = "XWayland is the compatibility layer that lets older X11 apps run under Wayland. It crashed, so apps that aren't Wayland-native will stop working until you restart your session. If XWayland keeps crashing: make sure it's installed (sudo apt install xwayland) and check GPU driver stability. Log out and back in to recover."
|
|
|