Log alerts in the System log, either Alert Notification Triggered or Alert Notification Dismissed include an alert code. When forwarded to a Syslog server, these alert codes can be parsed to generate a monitoring system.
| Alert Code | Alert Code Text | System Assigned Severity | Possible Causes | Possible Impacts | Possible Remediation | Possible Future Preventive Measures |
|---|---|---|---|---|---|---|
| 1 | RAM usage is over 90 percent for over 1 hour | Warning | • High volume of concurrent users • Memory leak in a service • Heavy caching, scanning or deduplication operations |
• Degraded system performance and responsiveness • Potential service crashes (OOM Killer) • Failed file operations |
• Identify memory-hungry processes via CLI (top) • Restart services ( systemctl restart nas) • Reboot the device |
• Increase VM memory allocation • Upgrade firmware to fix potential leaks • Adjust cache size limits |
| 2 | CPU Usage is over 95 percent for over 1 hour | Warning | • Runaway process or infinite loop • Heavy background tasks (sync, scrub, AV scan) • Ransomware protection analysis • Heavy caching, scanning or deduplication operations |
• Slow user response times • Web interface timeouts • Delayed cloud synchronization |
• Identify high-CPU processes via CLI (top, exec NASCpuProfiler start) • Reschedule heavy tasks to off-hours • Restart stuck services |
• Increase VM vCPU allocation • Schedule scans/scrubs during low-traffic windows |
| 3 | Volume is 95 percent full | Error | • Rapid data accumulation • Cache eviction too slow or misconfigured • Large number of snapshots or logs |
• Performance degradation • Risk of hitting 100% capacity |
• Lower high-water mark • Delete old snapshots or temp files • Expand volume size | • Tune cache eviction policies • Implement stricter quotas |
| 4 | Volume is 100 percent full | Error | • Critical storage exhaustion • Log files filling remaining space |
• Service Stoppage: Database cannot write, services crash • Potential data corruption • Sync failures |
• Immediate Action: Delete unnecessary files (logs, cores) via CLI • Expand volume size immediately |
• Proper capacity planning • Aggressive monitoring and alerting on lower thresholds |
| 5 | SAMBA services failed | Error | • Configuration error (/var/samba/smb.conf) • Active Directory connection loss • Port conflict or service crash |
• Users cannot access SMB/CIFS shares • Windows file sharing downtime |
• Check logs (journalctl -u smb) • Restart SMB service • Verify AD status |
• Regular configuration backups • Monitor AD connectivity health |
| 6 | Device is unlicensed | Error | • License expired • Trial period ended • License never applied |
• Cloud services disabled • Sync functionality stops |
• Purchase/Renew license • Apply valid license via Portal or Local UI |
• Track license expiration dates • Enable auto-renewal if available |
| 7 | Portal connection is not set up | Error | • Initial setup incomplete • Device reset to factory defaults |
• No cloud backup/sync • No remote management • No centralized monitoring |
• Run the setup wizard • Configure Portal address and credentials |
• Run the setup wizard immediately after deployment |
| 8 | Cloud sync is suspended | Warning | • Manually suspended by admin • Cloud storage quota exceeded • Consecutive sync errors |
• Data changes not backed up to cloud • Other sites not receiving file updates | • Resume sync via UI • Check cloud quotas • Investigate sync logs for errors |
• Monitor cloud storage usage • Investigate sync errors promptly |
| 9 | Disconnected from Portal Services | Warning | • Internet/Network outage • Firewall blocking ports 443 (Data) or 995 (Management) • DNS resolution failure • Portal downtime |
• No backup or sync • Remote access unavailable • License validation failures |
• Verify network connectivity and DNS • Check Firewall rules • Check CTERA Portal status |
• Implement redundant network connections • Ensure firewall rules allow CTERA traffic |
| 10 | Active Directory connection was not set up | Warning | • Device not joined to a domain • Intended standalone configuration |
• Users must use local accounts • No Single Sign-On (SSO) |
• Configure "Windows File Sharing" settings • Join the Active Directory domain |
• N/A (If standalone mode is intended) |
| 11 | Active Directory connection failed | Error | • Domain Controller unreachable • Clock skew > 5 minutes • Computer account password expired • DNS issues |
• User authentication fails • Access to shares denied for domain users |
• Rejoin the domain • Sync time with NTP • Verify DNS settings pointing to DC |
• Configure reliable NTP servers • Ensure redundant Domain Controllers |
| 12 | AntiVirus detected malware | Warning | • User uploaded an infected file • Malware propagation attempt |
• Security risk • File quarantined or deleted (depending on policy) |
• Review AV logs • Identify source user/machine • Clean infected client endpoint |
• Keep AV definitions up to date • Enforce endpoint antivirus protection |
| 13 | Ransom Protect Incident detected | Error | • Rapid file encryption detected • Honeypot file access |
• Potential data loss (encryption) • User blocked (if "Block Malicious Users" flag is on) |
• Investigate if false positive or real attack • Isolate infected client • Restore files from snapshots |
• Enable Ransom Protect on all shares • User security awareness training |
| 14 | TLS Certificate will expire in 30 days | Warning | • Certificate approaching its expiration date (within 30 calendar days) • An intermediate certificate in the TLS chain is also approaching expiry |
• Early warning before HTTPS and TLS-dependent services begin failing • Clients may soon reject connections or display certificate warnings |
Renew or replace the TLS certificate via the management UI (System > Certificates) If using a self-signed certificate, regenerate it via the UI (System > Certificates) | • Renew server certificates well before the 30-day window • Ensure intermediate certificate chain validity is aligned with the leaf certificate |
| 15 | Additional Trusted Certificate Authority will expire in 30 days | Warning | • A trusted CA certificate approaching its expiration date (within 30 calendar days) • A separate alert is raised for each affected certificate |
• Trust relationships depending on that CA may fail once it expires • Services validating peers against the additional CA store may lose connectivity |
Obtain a renewed CA-signed certificate from your Certificate Authority and upload the full chain via the UI (System > Certificates) • Remove the obsolete CA if no longer needed (dismisses the alert) |
Rotate additional trusted CAs before the 30-day threshold Maintain a small, current set of trusted CAs |
| 16 | TLS Certificate expired | Error | • TLS server certificate has expired • An intermediate certificate in the TLS chain has expired or is invalid • System clock significantly out of sync, causing incorrect expiry evaluation |
• Secure connections to the filer fail (HTTPS, management UI, API) • Browsers and clients block or warn on connections to the filer |
• Renew or replace the TLS certificate via the UI (System > Certificates) • If using a self-signed certificate, regenerate it via the UI (System > Certificates) • If using a CA-signed certificate, obtain a renewed certificate from your Certificate Authority and upload the full chain via the UI (System > Certificates) • Ensure system time is correct (NTP) |
• Automated renewal or calendar reminders before certificate expiry • Configure reliable NTP to avoid clock-related validation failures |
| 17 | Additional Trusted Certificate Authority expired | Error | • One or more manually added trusted CA certificates have expired • A separate alert is raised for each affected certificate |
Services and trust relationships that depend on the expired CA may fail (e.g., validating peer connections or external services) | • Replace the expired CA with a renewed certificate via the management UI (trusted CA certificate settings) • Remove the CA if it is no longer needed, removing it dismisses the alert • The alert auto-dismisses once the replacement CA passes validation |
Rotate trusted CA certificates before expiry • Keep the trusted CA list minimal, only include CAs actively in use |
| 18 | Log Forwarder failed | Error | • Log forwarding is enabled but one or more of its background components stopped running • Network or connectivity issues with the CTERA Portal • Log forwarding service not available for this device (not included in the Portal service agreement) |
• Logs and metrics are not forwarded to the CTERA Portal • Gaps in centralized logging and audit trail |
• Restart the NAS service (systemctl restart nas) • Verify Portal connectivity • Verify the Log Forwarding feature is enabled and properly configured in the Portal |
• Monitor log forwarding health via the dashboard • Ensure stable network connectivity to the Portal |
| 19 | SFTP Server failed | Error | • SFTP service is enabled but not running • Configuration error (/etc/ssh/sftp_sshd_config) • Port conflict or service crash |
• SFTP clients cannot connect to the filer • SFTP-dependent workflows are blocked |
• Check logs (journalctl -u ctera-sftp) • Restart the NAS service (systemctl restart nas) • Monitor SFTP service health via the dashboard |
|
| 20 | FTP service failed | Error | • FTP service is enabled and one or more shares are exported to FTP, but the FTP service is not running • Configuration error (/var/smbftpd/smbftpd.conf) • Port conflict or service crash |
• FTP/FTPS clients cannot access exported shares | • Check logs (journalctl -u smbftpd) • Restart the NAS service ( systemctl restart nas) • Verify FTP settings and share export configuration in the management UI |
• Monitor FTP service health via the dashboard |
| 21 | NFS failed | Error | • NFS shares are configured but the NFS service is not running • Configuration error ( /etc/exports) • Port conflict or service crash |
• NFS clients cannot mount or access exported paths | • Check logs (journalctl -u nfs-server) • Restart the NFS service ( systemctl restart nfs-server) • Verify NFS share configuration in the management UI |
• Monitor NFS service health via the dashboard |
| 22 | LocalDedup failed | Error | • Local deduplication service is enabled but failed to initialize • Deduplication database could not be opened • Underlying storage or volume issues |
• Data deduplication is not applied to cached cloud data • Increased local storage consumption |
• Restart the NAS service (systemctl restart nas) • If the issue persists, contact CTERA Support |
Local deduplication requires the storage volume to be formatted with XFS reflink support — this is set at initial disk format time and cannot be changed without reformatting • Monitor deduplication service status via the dashboard |
| 23 | AntiVirus signatures older than 7 days | Warning | • Automatic virus signature updates have not succeeded in over 7 days • Network, DNS, or proxy connectivity issues preventing downloads from the update repository | • Files are scanned with outdated virus definitions, reducing detection effectiveness | • Verify network connectivity to the signature update repository • Check proxy settings if applicable • Check logs (journalctl -u ctera-av-module) |
• Ensure stable network connectivity to the update repository • Monitor signature age via the dashboard |
| 24 | SNMP service failed | Error | • SNMP service is enabled but not running • Configuration error (/var/net-snmp/snmpd.conf) • Port conflict or service crash |
• Third-party monitoring systems and NMS platforms that poll this filer via SNMP will stop receiving data and may trigger their own alerts | • Check logs (journalctl -u ctera-snmp) • Restart the SNMP service ( systemctl restart ctera-snmp) |
• Monitor SNMP service health via the dashboard |
| 25 | AntiVirus failed to download initial db | Error | • No usable virus signature database exists on disk and the initial download failed • Network, DNS, or proxy connectivity issues to the update repository • Insufficient disk space for the antivirus data |
• Real-time antivirus scanning cannot start until the initial signature database is downloaded • The filer is unprotected against malware |
• Verify network connectivity to the update repository • Check proxy settings if applicable • Restart the antivirus service ( systemctl restart ctera-av-module) • Check logs ( journalctl -u ctera-av-module) |
• Verify network connectivity to the update repository before enabling antivirus • Ensure sufficient free disk space for antivirus data |
| 26 | Cloud folders limit exceeded | Warning | • Edge filer operating in Caching Gateway mode with 20,000 or more cloud folders synced • Large number of cloud folders accumulated over time |
• Operating beyond the supported scale may cause performance or stability issues | • Reduce the number of cloud folders below 20,000 via Portal administration • The alert auto-dismisses when the count drops below the limit |
• Plan and monitor cloud folder growth before reaching the 20,000 limit |
| 27 | Automatic crash reporting is disabled | Warning | • Automatic support and crash reporting has been disabled in the device configuration | • Crash diagnostics and telemetry are not sent automatically to CTERA Support • Slower troubleshooting in case of device issues |
• Enable automatic support reporting via the management UI or CLI | • Enable automatic support reporting during initial provisioning • Maintain an organizational policy to keep it enabled unless compliance requirements prohibit it |
| 28 | Samba clients reached limit | Error | • SMB connection count has reached 100% of the device's maximum allowed connections • The connection limit is hardware-dependent and varies by device model • Alert clears when usage drops below 98% |
• New SMB client sessions are denied • Users cannot access SMB/CIFS shares until existing connections free up |
• Disconnect idle SMB clients • Shorten idle disconnect timeout in Windows File Sharing settings • The connection limit is hardware-dependent and cannot be increased |
• Capacity planning for peak SMB session load • Distribute file sharing load across multiple devices |
| 29 | Samba clients almost reached limit | Warning | • SMB connection count has reached 90% of the device's maximum allowed connections • The hard limit has not yet been reached |
• Risk of hitting the hard connection limit soon • Performance pressure under high connection load |
• Disconnect idle SMB clients • Shorten idle disconnect timeout in Windows File Sharing settings • The connection limit is hardware-dependent and cannot be increased |
• Capacity planning for peak SMB session load • Distribute file sharing load across multiple devices |
| 30 | Local quota failure | Error | • Local quota service is enabled but failed to initialize • Quota database could not be opened • A required messaging service dependency is not running |
• Local quota enforcement and accounting are unreliable • Per-folder quota limits may not be applied |
• Restart the NAS service (systemctl restart nas) • If the issue persists, contact CTERA Support |
• Monitor local quota service health via the dashboard |
| 31 | Ransom protect failed | Error | • Ransom Protect or Honeypot is enabled but the Ransom Protect service stopped or crashed • Internal service communication failure |
• Ransomware detection and honeypot monitoring are not operational • The filer is unprotected against ransomware attacks |
• Restart the Ransom Protect service (systemctl restart ctera-ransom-protect) • Check logs ( journalctl -u nas) • If the issue persists, contact CTERA Support |
• Monitor Ransom Protect service health via the Services dashboard |
| 32 | AntiVirus failed | Error | • Antivirus engine is enabled but not running • AV engine encountered a startup or runtime error • Proxy misconfiguration preventing the AV engine from reaching required services |
• Files are not scanned by realtime antivirus • The filer is unprotected against malware |
• Restart the antivirus service (systemctl restart ctera-av-module) • Check logs ( journalctl -u ctera-av-module) • If the issue persists, contact CTERA Support |
• Keep virus signature database current • Monitor antivirus service health via the dashboard |
| 33 | Metrics hub failed | Error | • One or more metrics collection services crashed or failed to start after a service or device restart • System resource exhaustion (memory or CPU pressure) caused a service to be terminated • Underlying storage or volume temporarily unavailable |
• Incomplete metrics collection • Monitoring dashboards may show data gaps |
• Restart the failed service(s) identified in the alert details (systemctl restart <service-name>) • Check logs for the failed service ( journalctl -u <service-name>) • If the issue persists, contact CTERA Support |
• Monitor metrics service health |
| 34 | Global file locking is disabled on this edge filer | Warning | • Global File Locking (GFL) has been explicitly force-disabled on this edge filer | • Cross-site coordinated file locks for configured file extensions are not enforced • Concurrent edits to the same file across multiple sites may cause conflicts |
• Re-enable Global File Locking if appropriate for your environment • Confirm the CTERA Portal supports, and has GFL enabled |
• The force-disable GFL option is intended only for temporary use when Global File Locking is causing operational issues (e.g., file access problems or sync stalls) — re-enable it after the issue is resolved • Keep Portal and edge filer GFL configuration aligned during change procedures |
| 35 | Local quota full scan required | Warning | • Local quota is enabled but one or more cloud folders have not completed their initial full scan | • Local quota enforcement and accounting may be incomplete for folders not yet fully scanned | • Allow Cloud Sync to complete full scans for all cloud folders • Check logs ( journalctl -u nas) for Cloud Sync full-scan progress |
• Plan time for initial full scans when enabling local quota or adding new cloud folders |
| 36 | NIC was removed | Error | • A network interface card (NIC) that was previously configured has been physically detached or is no longer detected by the system | • Network connectivity through the affected port is lost • Network configuration for that port may become inconsistent |
• Re-seat or replace the NIC so the port becomes active again • If the NIC was intentionally removed, review and reapply network settings for the affected port • The alert auto-dismisses after 24 hours if the detached state persists |
• Establish operational procedures for physical NIC changes • Include network validation steps after hardware maintenance |
| 37 | Cache is full but no files could be evicted | Warning | • Excessive amount of pinned or eviction-excluded folders • Large number of files currently open by users, preventing eviction • Files modified locally but not yet synced to the cloud cannot be evicted |
• Local cache storage running out of space • New file downloads from cloud may fail or be delayed • Performance degradation as the system cannot free cache space |
• Review and reduce the amount of pinned content • Identify users with large numbers of open files and coordinate file closure • Review the audit logs folder, it is eviction-excluded by default, and clear it if necessary • Verify Cloud Sync is running • The alert auto-dismisses when the next eviction cycle succeeds |
• Right-size the cache volume for the working set of pinned and actively used files • Monitor pinned content growth relative to cache capacity • Ensure Cloud Sync runs without interruption so dirty files are promptly synced and become eligible for eviction |