---
title: "Edge Filer Numbered Alerts"
slug: "edge-filer-3"
updated: 2026-09-29T04:57:48Z
published: 2026-09-29T04:57:48Z
canonical: "kb.ctera.com/edge-filer-3"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://kb.ctera.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Edge Filer Numbered Alerts

Log alerts in the **System** log, either **Alert Notification Triggered** or **Alert Notification Dismissed** include an alert code. When forwarded to a Syslog server, these alert codes can be parsed to generate a monitoring system.

| Alert Code | Alert Code Text | System Assigned Severity | Possible Causes | Possible Impacts | Possible Remediation | Possible Future Preventive Measures |
| --- | --- | --- | --- | --- | --- | --- |
| 1 | RAM usage is over 90 percent for over 1 hour | Warning | • High volume of concurrent users • Memory leak in a service • Heavy caching, scanning or deduplication operations | • Degraded system performance and responsiveness • Potential service crashes (OOM Killer) • Failed file operations | • Identify memory-hungry processes via CLI (`top`) • Restart services (`systemctl restart nas`) • Reboot the device | • Increase VM memory allocation • Upgrade firmware to fix potential leaks • Adjust cache size limits |
| 2 | CPU Usage is over 95 percent for over 1 hour | Warning | • Runaway process or infinite loop • Heavy background tasks (sync, scrub, AV scan) • Ransomware protection analysis • Heavy caching, scanning or deduplication operations | • Slow user response times • Web interface timeouts • Delayed cloud synchronization | • Identify high-CPU processes via CLI (`top`, `exec NASCpuProfiler start`) • Reschedule heavy tasks to off-hours • Restart stuck services | • Increase VM vCPU allocation • Schedule scans/scrubs during low-traffic windows |
| 3 | Volume is 95 percent full | Error | • Rapid data accumulation • Cache eviction too slow or misconfigured • Large number of snapshots or logs | • Performance degradation • Risk of hitting 100% capacity | • Lower high-water mark • Delete old snapshots or temp files • Expand volume size | • Tune cache eviction policies • Implement stricter quotas |
| 4 | Volume is 100 percent full | Error | • Critical storage exhaustion • Log files filling remaining space | • Service Stoppage: Database cannot write, services crash • Potential data corruption • Sync failures | • Immediate Action: Delete unnecessary files (logs, cores) via CLI • Expand volume size immediately | • Proper capacity planning • Aggressive monitoring and alerting on lower thresholds |
| 5 | SAMBA services failed | Error | • Configuration error (`/var/samba/smb.conf`) • Active Directory connection loss • Port conflict or service crash | • Users cannot access SMB/CIFS shares • Windows file sharing downtime | • Check logs (`journalctl -u smb`) • Restart SMB service • Verify AD status | • Regular configuration backups • Monitor AD connectivity health |
| 6 | Device is unlicensed | Error | • License expired • Trial period ended • License never applied | • Cloud services disabled • Sync functionality stops | • Purchase/Renew license • Apply valid license via Portal or Local UI | • Track license expiration dates • Enable auto-renewal if available |
| 7 | Portal connection is not set up | Error | • Initial setup incomplete • Device reset to factory defaults | • No cloud backup/sync • No remote management • No centralized monitoring | • Run the setup wizard • Configure Portal address and credentials | • Run the setup wizard immediately after deployment |
| 8 | Cloud sync is suspended | Warning | • Manually suspended by admin • Cloud storage quota exceeded • Consecutive sync errors | • Data changes not backed up to cloud • Other sites not receiving file updates | • Resume sync via UI • Check cloud quotas • Investigate sync logs for errors | • Monitor cloud storage usage • Investigate sync errors promptly |
| 9 | Disconnected from Portal Services | Warning | • Internet/Network outage • Firewall blocking ports 443 (Data) or 995 (Management) • DNS resolution failure • Portal downtime | • No backup or sync • Remote access unavailable • License validation failures | • Verify network connectivity and DNS • Check Firewall rules • Check CTERA Portal status | • Implement redundant network connections • Ensure firewall rules allow CTERA traffic |
| 10 | Active Directory connection was not set up | Warning | • Device not joined to a domain • Intended standalone configuration | • Users must use local accounts • No Single Sign-On (SSO) | • Configure **Windows File Sharing** settings • Join the Active Directory domain | • N/A (If standalone mode is intended) |
| 11 | Active Directory connection failed | Error | • Domain Controller unreachable • Clock skew > 5 minutes • Computer account password expired • DNS issues | • User authentication fails • Access to shares denied for domain users | • Rejoin the domain • Sync time with NTP • Verify DNS settings pointing to DC | • Configure reliable NTP servers • Ensure redundant Domain Controllers |
| 12 | AntiVirus detected malware | Warning | • User uploaded an infected file • Malware propagation attempt | • Security risk • File quarantined or deleted (depending on policy) | • Review AV logs • Identify source user/machine • Clean infected client endpoint | • Keep AV definitions up to date • Enforce endpoint antivirus protection |
| 13 | Ransom Protect Incident detected | Error | • Rapid file encryption detected • Honeypot file access | • Potential data loss (encryption) • User blocked (if *Block Malicious Users* flag is on) | • Investigate if false positive or real attack • Isolate infected client • Restore files from snapshots | • Enable Ransom Protect on all shares • User security awareness training |
| 14 | TLS Certificate will expire in 30 days | Warning | • Certificate approaching its expiration date (within 30 calendar days) • An intermediate certificate in the TLS chain is also approaching expiry | • Early warning before HTTPS and TLS-dependent services begin failing • Clients may soon reject connections or display certificate warnings | Renew or replace the TLS certificate via **System > Certificates** • If using a self-signed certificate, regenerate it via **System > Certificates** | • Renew server certificates well before the 30-day window • Ensure intermediate certificate chain validity is aligned with the leaf certificate |
| 15 | Additional Trusted Certificate Authority will expire in 30 days | Warning | • A trusted CA certificate approaching its expiration date (within 30 calendar days) • A separate alert is raised for each affected certificate | • Trust relationships depending on that CA may fail once it expires • Services validating peers against the additional CA store may lose connectivity | Obtain a renewed CA-signed certificate from your Certificate Authority and upload the full chain via **System > Certificates** • Remove the obsolete CA if no longer needed (dismisses the alert) | Rotate additional trusted CAs before the 30-day threshold • Maintain a small, current set of trusted CAs |
| 16 | TLS Certificate expired | Error | • TLS server certificate has expired • An intermediate certificate in the TLS chain has expired or is invalid • System clock significantly out of sync, causing incorrect expiry evaluation | • Secure connections to the filer fail (HTTPS, management UI, API) • Browsers and clients block or warn on connections to the filer | • Renew or replace the TLS certificate via **System > Certificates** • If using a self-signed certificate, regenerate it via **System > Certificates** • If using a CA-signed certificate, obtain a renewed certificate from your Certificate Authority and upload the full chain via **System > Certificates** • Ensure system time is correct (NTP) | • Automated renewal or calendar reminders before certificate expiry • Configure reliable NTP to avoid clock-related validation failures |
| 17 | Additional Trusted Certificate Authority expired | Error | • One or more manually added trusted CA certificates have expired • A separate alert is raised for each affected certificate | Services and trust relationships that depend on the expired CA may fail (for example, validating peer connections or external services) | • Replace the expired CA with a renewed certificate via **System > Certificates** (trusted CA certificate settings) • Remove the CA if it is no longer needed, removing it dismisses the alert • The alert auto-dismisses once the replacement CA passes validation | Rotate trusted CA certificates before expiry • Keep the trusted CA list minimal, only include CAs actively in use |
| 18 | Log Forwarder failed | Error | • Log forwarding is enabled but one or more of its background components stopped running • Network or connectivity issues with the portal • Log forwarding service not available for this device (not included in the Portal service agreement) | • Logs and metrics are not forwarded to the CTERA Portal • Gaps in centralized logging and audit trail | • Restart the NAS service (`systemctl restart nas`) • Verify Portal connectivity • Verify the Log Forwarding feature is enabled and properly configured in the portal | • Monitor log forwarding health via the dashboard • Ensure stable network connectivity to the portal |
| 19 | SFTP Server failed | Error | • SFTP service is enabled but not running • Configuration error (`/etc/ssh/sftp_sshd_config`) • Port conflict or service crash | • SFTP clients cannot connect to the filer • SFTP-dependent workflows are blocked | • Check logs (`journalctl -u ctera-sftp`) • Restart the NAS service (`systemctl restart nas`) • Monitor SFTP service health via the dashboard |  |
| 20 | FTP service failed | Error | • FTP service is enabled and one or more shares are exported to FTP, but the FTP service is not running • Configuration error (`/var/smbftpd/smbftpd.conf`) • Port conflict or service crash | • FTP/FTPS clients cannot access exported shares | • Check logs (`journalctl -u smbftpd`) • Restart the NAS service (`systemctl restart nas`) • Verify FTP settings and share export configuration in the management UI | • Monitor FTP service health via the dashboard |
| 21 | NFS failed | Error | • NFS shares are configured but the NFS service is not running • Configuration error (`/etc/exports`) • Port conflict or service crash | • NFS clients cannot mount or access exported paths | • Check logs (`journalctl -u nfs-server`) • Restart the NFS service (`systemctl restart nfs-server`) • Verify NFS share configuration in the management UI | • Monitor NFS service health via the dashboard |
| 22 | LocalDedup failed | Error | • Local deduplication service is enabled but failed to initialize • Deduplication database could not be opened • Underlying storage or volume issues | • Data deduplication is not applied to cached cloud data • Increased local storage consumption | • Restart the NAS service (`systemctl restart nas`) • If the issue persists, contact CTERA Support | Local deduplication requires the storage volume to be formatted with XFS reflink support — this is set at initial disk format time and cannot be changed without reformatting • Monitor deduplication service status via the dashboard |
| 23 | AntiVirus signatures older than 7 days | Warning | • Automatic virus signature updates have not succeeded in over 7 days • Network, DNS, or proxy connectivity issues preventing downloads from the update repository | • Files are scanned with outdated virus definitions, reducing detection effectiveness | • Verify network connectivity to the signature update repository • Check proxy settings if applicable • Check logs (`journalctl -u ctera-av-module`) | • Ensure stable network connectivity to the update repository • Monitor signature age via the dashboard |
| 24 | SNMP service failed | Error | • SNMP service is enabled but not running • Configuration error (`/var/net-snmp/snmpd.conf`) • Port conflict or service crash | • Third-party monitoring systems and NMS platforms that poll this filer via SNMP will stop receiving data and may trigger their own alerts | • Check logs (`journalctl -u ctera-snmp`) • Restart the SNMP service (`systemctl restart ctera-snmp`) | • Monitor SNMP service health via the dashboard |
| 25 | AntiVirus failed to download initial db | Error | • No usable virus signature database exists on disk and the initial download failed • Network, DNS, or proxy connectivity issues to the update repository • Insufficient disk space for the antivirus data | • Real-time antivirus scanning cannot start until the initial signature database is downloaded • The filer is unprotected against malware | • Verify network connectivity to the update repository • Check proxy settings if applicable • Restart the antivirus service (`systemctl restart ctera-av-module`) • Check logs (`journalctl -u ctera-av-module`) | • Verify network connectivity to the update repository before enabling antivirus • Ensure sufficient free disk space for antivirus data |
| 26 | Cloud folders limit exceeded | Warning | • Edge filer operating in Caching Gateway mode with 20,000 or more cloud folders synced • Large number of cloud folders accumulated over time | • Operating beyond the supported scale may cause performance or stability issues | • Reduce the number of cloud folders for the edge filer below 20,000 in the portal • The alert auto-dismisses when the count drops below the limit | • Plan and monitor cloud folder growth before reaching the 20,000 limit |
| 27 | Automatic crash reporting is disabled | Warning | • Automatic support and crash reporting has been disabled in the device configuration | • Crash diagnostics and telemetry are not sent automatically to CTERA Support • Slower troubleshooting in case of device issues | • Enable automatic support reporting via the user interface | • Enable automatic support reporting during initial provisioning • Maintain an organizational policy to keep it enabled unless compliance requirements prohibit it |
| 28 | Samba clients reached limit | Error | • SMB connection count has reached 100% of the device's maximum allowed connections • The connection limit is hardware-dependent and varies by device model • Alert clears when usage drops below 98% | • New SMB client sessions are denied • Users cannot access SMB/CIFS shares until existing connections free up | • Disconnect idle SMB clients • Shorten idle disconnect timeout in Windows File Sharing settings • The connection limit is hardware-dependent and cannot be increased | • Capacity planning for peak SMB session load • Distribute file sharing load across multiple devices |
| 29 | Samba clients almost reached limit | Warning | • SMB connection count has reached 90% of the device's maximum allowed connections • The hard limit has not yet been reached | • Risk of hitting the hard connection limit soon • Performance pressure under high connection load | • Disconnect idle SMB clients • Shorten idle disconnect timeout in Windows File Sharing settings • The connection limit is hardware-dependent and cannot be increased | • Capacity planning for peak SMB session load • Distribute file sharing load across multiple devices |
| 30 | Local quota failure | Error | • Local quota service is enabled but failed to initialize • Quota database could not be opened A required messaging service dependency is not running | • Local quota enforcement and accounting are unreliable • Per-folder quota limits may not be applied | • Restart the NAS service (`systemctl restart nas`) • If the issue persists, contact CTERA Support | • Monitor local quota service health via the dashboard |
| 31 | Ransom protect failed | Error | • Ransom Protect or honeypot detection is enabled but the Ransom Protect service stopped or crashed • Internal service communication failure | • Ransomware detection and honeypot monitoring are not operational • The edge filer is unprotected against ransomware attacks | • Restart the Ransom Protect service (`systemctl restart ctera-ransom-protect`) • Check logs (`journalctl -u nas`) • If the issue persists, contact CTERA Support | • Monitor Ransom Protect service health via the **Services** dashboard |
| 32 | AntiVirus failed | Error | • Antivirus engine is enabled but not running • antivirus engine encountered a startup or runtime error • Proxy misconfiguration preventing the antivirus engine from reaching required services | • Files are not scanned by realtime antivirus • The filer is unprotected against malware | • Restart the antivirus service (`systemctl restart ctera-av-module`) • Check logs (`journalctl -u ctera-av-module`) • If the issue persists, contact CTERA Support | • Keep virus signature database current • Monitor antivirus service health via the **Services** dashboard |
| 33 | Metrics hub failed | Error | • One or more metrics collection services crashed or failed to start after a service or device restart System resource exhaustion (memory or CPU pressure) caused a service to be terminated • Underlying storage or volume temporarily unavailable | • Incomplete metrics collection • Monitoring dashboards may show data gaps | • Restart the failed service(s) identified in the alert details (`systemctl restart <service-name>`) • Check logs for the failed service (`journalctl -u <service-name>`) • If the issue persists, contact CTERA Support | • Monitor metrics service health |
| 34 | Global file locking is disabled on this edge filer | Warning | • Global File Locking has been explicitly force-disabled on this edge filer | • Cross-site coordinated file locks for configured file extensions are not enforced • Concurrent edits to the same file across multiple sites may cause conflicts | • Re-enable global file locking if appropriate for your environment • Confirm the portal supports global file locking, and has global file locking enabled | • The force-disable global file locking option is intended only for temporary use when global file locking is causing operational issues (for example, file access problems or sync stalls) — re-enable it after the issue is resolved • Keep portal and edge filer global file locking configuration aligned during change procedures |
| 35 | Local quota full scan required | Warning | • Local quota is enabled but one or more cloud folders have not completed their initial full scan | • Local quota enforcement and accounting may be incomplete for folders not yet fully scanned | • Allow Cloud Sync to complete full scans for all cloud folders • Check logs (`journalctl -u nas`) for Cloud Sync full-scan progress | • Plan time for initial full scans when enabling local quota or adding new cloud folders |
| 36 | NIC was removed | Error | • A network interface card (NIC) that was previously configured has been physically detached or is no longer detected by the system | • Network connectivity through the affected port is lost • Network configuration for that port may become inconsistent | • Re-seat or replace the NIC so the port becomes active again • If the NIC was intentionally removed, review and reapply network settings for the affected port • The alert auto-dismisses after 24 hours if the detached state persists | • Establish operational procedures for physical NIC changes • Include network validation steps after hardware maintenance |
| 37 | Cache is full but no files could be evicted | Warning | • Excessive amount of pinned or eviction-excluded folders • Large number of files currently open by users, preventing eviction • Files modified locally but not yet synced to the cloud cannot be evicted | • Local cache storage running out of space • New file downloads from cloud may fail or be delayed • Performance degradation as the system cannot free cache space | • Review and reduce the amount of pinned content • Identify users with large numbers of open files and coordinate file closure • Review the audit logs folder, it is eviction-excluded by default, and clear it if necessary • Verify Cloud Sync is running • The alert auto-dismisses when the next eviction cycle succeeds | • Right-size the cache volume for the working set of pinned and actively used files • Monitor pinned content growth relative to cache capacity • Ensure Cloud Sync runs without interruption so dirty files are promptly synced and become eligible for eviction |