Find the failure boundary.
Start with privilege, embedded configuration, target drive, resource gates, build features, and destination access—in that order.
Fast diagnostic sequence
# Confirm the binary and profile
aralez.exe --version
aralez.exe --check_config
aralez.exe --show_config > active-config.yml
# Run visibly with the smallest practical test profile
aralez.exe --verbos --stream# Confirm the binary and profile
aralez --version
aralez --check_config
aralez --show_config > active-config.yml
# Run visibly with the smallest practical test profile
sudo aralez --verbos --streamCommon issues
“Aralez must be run as root/administrator”
On Linux or macOS, invoke through sudo or a root automation context. On Windows, open an elevated shell or run through SYSTEM/admin management tooling.
Configuration marker or embedded profile error
Confirm the binary was produced by the supported build/re-profile path. Recreate it with --change_config candidate.yml output_binary, then use --check_config and --show_config.
Drive is inaccessible or does not exist
Windows expects a drive letter such as C. Linux expects a valid device or mount path. macOS expects a device basename such as disk3s4s1. Verify elevation and OS-level access.
Not enough memory or disk capacity
Inspect memory_limit, disk_limit, and disk_path. In v0.11.0, min_disk_space and max_disk_usage_pct are schema fields but are not used by the active check. Use --workdir on a monitored filesystem and reduce profile scope.
“S3 upload is not available”
Rebuild with --features upload-s3 or the aggregate upload feature. Verify credentials, region, endpoint scheme, bucket, and prefix policy.
“SFTP upload is not available”
Rebuild with --features upload-sftp. A CLI SFTP URL authenticates through the SSH agent because it cannot carry password or key-path fields; use YAML for those alternatives.
SMB upload fails on Linux or macOS
Install smbclient, verify the //server/share/path form, and test authentication and directory creation independently. The CLI-created destination is anonymous unless credentials are in YAML.
Archive remains after upload
YAML-only destinations do not trigger local archive deletion. CLI local output pointing to the current archive directory also keeps it. Remote CLI destinations and different local folders remove the source after successful dispatch.
TAR.ZST is not encrypted
This is current behavior. Use ZIP for built-in AES-256 password protection, or protect TAR.ZST with approved storage/envelope encryption after collection.
Cross-build panics on unsupported architecture
The v0.11.0 build script accepts x86 and x86_64 target strings. Use a supported target or update and validate the build tooling for architectures such as aarch64.
Fleet symptoms
| Symptom | Check |
|---|---|
| SSH timeout | Reachability, port, key, user, host-key policy, parallel job limit |
| WinRM connection refused | Remoting configuration, firewall 5985/5986, Kerberos/NTLM, TrustedHosts where applicable |
| PsExec cannot reach host | SMB 445, ADMIN$ access, credentials, endpoint security response |
| Too many open files | Reduce -j / Ansible forks or raise controller file-descriptor limits |
| BITS transfer stalls | BITS service, proxy, internal source reachability, job state |
| Missing returned ZIP | A TAR run produces .tar.zst; some shipped pull scripts search only *.zip |
The archive log includes profile version, task timing, warnings, collection failures, and upload messages. Preserve it even when the evidence set is incomplete.