Failed to Save Data. Please Try Again Momentarily Mustinclude: Behaviourcloud

Troubleshooting Cloud Functions

This document shows you some of the mutual issues you lot might run into and how to deal with them.

Deployment

The deployment phase is a frequent source of bug. Many of the issues you might encounter during deployment are related to roles and permissions. Others take to do with incorrect configuration.

User with Viewer role cannot deploy a function

A user who has been assigned the Projection Viewer or Cloud Functions Viewer role has read-but access to functions and function details. These roles are not allowed to deploy new functions.

The fault message

Cloud Console

              Y'all need permissions for this action. Required permission(s): cloudfunctions.functions.create                          

Cloud SDK

              Fault: (gcloud.functions.deploy) PERMISSION_DENIED: Permission 'cloudfunctions.functions.sourceCodeSet' denied on resource 'projects/<PROJECT_ID>/locations/<LOCATION>` (or resources may non exist)                          

The solution

Assign the user a role that has the appropriate admission.

User with Project Viewer or Deject Function role cannot deploy a function

In order to deploy a function, a user who has been assigned the Projection Viewer, the Cloud Role Developer, or Deject Function Admin role must be assigned an additional office.

The mistake bulletin

Deject Console

              User does non have the iam.serviceAccounts.actAs permission on <PROJECT_ID>@appspot.gserviceaccount.com required to create function. You tin can set this past running 'gcloud iam service-accounts add-iam-policy-binding <PROJECT_ID>@appspot.gserviceaccount.com --member=user: --role=roles/iam.serviceAccountUser'                          

Cloud SDK

              Fault: (gcloud.functions.deploy) ResponseError: status=[403], code=[Forbidden], message=[Missing necessary permission iam.serviceAccounts.actAs for <USER> on the service business relationship <PROJECT_ID>@appspot.gserviceaccount.com. Ensure that service account <PROJECT_ID>@appspot.gserviceaccount.com is a member of the project <PROJECT_ID>, so grant <USER> the role 'roles/iam.serviceAccountUser'. You can do that by running 'gcloud iam service-accounts add-iam-policy-bounden <PROJECT_ID>@appspot.gserviceaccount.com --fellow member=<USER> --role=roles/iam.serviceAccountUser' In case the fellow member is a service account delight use the prefix 'serviceAccount:' instead of 'user:'.]                          

The solution

Assign the user an additional office, the Service Account User IAM role (roles/iam.serviceAccountUser), scoped to the Cloud Functions runtime service account.

Deployment service account missing the Service Agent role when deploying functions

The Deject Functions service uses the Cloud Functions Service Agent service account (service-<PROJECT_NUMBER>@gcf-admin-robot.iam.gserviceaccount.com) when performing administrative actions on your project. By default this account is assigned the Cloud Functions cloudfunctions.serviceAgent function. This function is required for Cloud Pub/Sub, IAM, Cloud Storage and Firebase integrations. If you lot have changed the role for this service account, deployment fails.

The mistake message

Cloud Console

              Missing necessary permission resourcemanager.projects.getIamPolicy for serviceAccount:service-<PROJECT_NUMBER>@gcf-admin-robot.iam.gserviceaccount.com on projection <PROJECT_ID>. Please grant serviceAccount:service-<PROJECT_NUMBER>@gcf-admin-robot.iam.gserviceaccount.com the roles/cloudfunctions.serviceAgent function. You can practice that past running 'gcloud projects add-iam-policy-binding <PROJECT_ID> --member=serviceAccount:service-<PROJECT_NUMBER>@gcf-admin-robot.iam.gserviceaccount.com --role=roles/cloudfunctions.serviceAgent'                          

Cloud SDK

              ERROR: (gcloud.functions.deploy) OperationError: code=7, message=Missing necessary permission resourcemanager.projects.getIamPolicy for serviceAccount:service-<PROJECT_NUMBER>@gcf-admin-robot.iam.gserviceaccount.com on project <PROJECT_ID>. Please grant serviceAccount:service-<PROJECT_NUMBER>@gcf-admin-robot.iam.gserviceaccount.com the roles/cloudfunctions.serviceAgent role. Yous can do that past running 'gcloud projects add-iam-policy-bounden <PROJECT_ID> --member=serviceAccount:service-<PROJECT_NUMBER>@gcf-admin-robot.iam.gserviceaccount.com --function=roles/cloudfunctions.serviceAgent'                          

The solution

Reset this service account to the default part.

Deployment service account missing Pub/Sub permissions when deploying an event-driven function

The Cloud Functions service uses the Cloud Functions Service Agent service account (service-<PROJECT_NUMBER>@gcf-admin-robot.iam.gserviceaccount.com) when performing administrative actions. By default this business relationship is assigned the Cloud Functions cloudfunctions.serviceAgent part. To deploy issue-driven functions, the Cloud Functions service must access Cloud Pub/Sub to configure topics and subscriptions. If the office assigned to the service account is inverse and the appropriate permissions are non otherwise granted, the Cloud Functions service cannot access Deject Pub/Sub and the deployment fails.

The error message

Cloud Panel

              Failed to configure trigger PubSub projects/<PROJECT_ID>/topics/<FUNCTION_NAME>                          

Cloud SDK

              ERROR: (gcloud.functions.deploy) OperationError: code=13, message=Failed to configure trigger PubSub projects/<PROJECT_ID>/topics/<FUNCTION_NAME>                          

The solution

You can:

• Reset this service account to the default office.

  or

• Grant the pubsub.subscriptions.* and pubsub.topics.* permissions to your service business relationship manually.

User missing permissions for runtime service account while deploying a office

In environments where multiple functions are accessing unlike resource, it is a common do to use per-office identities, with named runtime service accounts rather than the default runtime service account (PROJECT_ID@appspot.gserviceaccount.com).

Nonetheless, to utilize a non-default runtime service business relationship, the deployer must have the iam.serviceAccounts.actAs permission on that non-default business relationship. A user who creates a not-default runtime service account is automatically granted this permission, but other deployers must have this permission granted by a user with the correct permissions.

The error message

Cloud SDK

          Fault: (gcloud.functions.deploy) ResponseError: condition=[400], lawmaking=[Bad Request], message=[Invalid part service account requested: <SERVICE_ACCOUNT_NAME@<PROJECT_ID>.iam.gserviceaccount.com]                  

The solution

Assign the user the roles/iam.serviceAccountUser function on the non-default <SERVICE_ACCOUNT_NAME> runtime service account. This part includes the iam.serviceAccounts.actAs permission.

Runtime service account missing project bucket permissions while deploying a part

Deject Functions can only exist triggered past events from Deject Storage buckets in the same Google Cloud Platform project. In improver, the Cloud Functions Service Amanuensis service account (service-<PROJECT_NUMBER>@gcf-admin-robot.iam.gserviceaccount.com) needs a cloudfunctions.serviceAgent role on your project.

The mistake message

Cloud Console

              Deployment failure: Bereft permissions to (re)configure a trigger (permission denied for saucepan <BUCKET_ID>). Delight, give possessor permissions to the editor function of the saucepan and attempt again.                          

Cloud SDK

              Error: (gcloud.functions.deploy) OperationError: code=7, message=Bereft permissions to (re)configure a trigger (permission denied for bucket <BUCKET_ID>). Please, requite possessor permissions to the editor function of the bucket and attempt again.                          

The solution

You can:

• Reset this service account to the default role.

  or

• Grant the runtime service account the cloudfunctions.serviceAgent part.

  or

• Grant the runtime service business relationship the storage.buckets.{get, update} and the resourcemanager.projects.get permissions.

User with Project Editor role cannot make a function public

To ensure that unauthorized developers cannot alter authentication settings for role invocations, the user or service that is deploying the function must have the cloudfunctions.functions.setIamPolicy permission.

The error message

Cloud SDK

          ERROR: (gcloud.functions.add-iam-policy-binding) ResponseError: status=[403], code=[Forbidden], message=[Permission 'cloudfunctions.functions.setIamPolicy' denied on resources 'projects/<PROJECT_ID>/locations/<LOCATION>/functions/<FUNCTION_NAME> (or resource may not exist).]                  

The solution

Yous can:

• Assign the deployer either the Projection Owner or the Cloud Functions Admin function, both of which comprise the cloudfunctions.functions.setIamPolicy permission.

  or

• Grant the permission manually past creating a custom office.

Function deployment fails due to Cloud Build non supporting VPC-SC

Cloud Functions uses Cloud Build to build your source code into a runnable container. In gild to utilise Deject Functions with VPC Service Controls, you must configure an access level for the Cloud Build service account in your service perimeter.

The mistake message

Deject Console

Ane of the below:

              Mistake in the build environment  OR  Unable to build your function due to VPC Service Controls. The Cloud Build service account associated with this function needs an appropriate access level on the service perimeter. Please grant admission to the Cloud Build service account: '{PROJECT_NUMBER}@cloudbuild.gserviceaccount.com' by following the instructions at https://cloud.google.com/functions/docs/securing/using-vpc-service-controls#grant-build-access"                          

Cloud SDK

One of the below:

              ERROR: (gcloud.functions.deploy) OperationError: code=13, message=Error in the build environment  OR  Unable to build your function due to VPC Service Controls. The Cloud Build service business relationship associated with this part needs an appropriate access level on the service perimeter. Delight grant access to the Cloud Build service business relationship: '{PROJECT_NUMBER}@cloudbuild.gserviceaccount.com' by post-obit the instructions at https://cloud.google.com/functions/docs/securing/using-vpc-service-controls#grant-build-access"                          

The solution

If your project's Audited Resource logs mention "Request is prohibited by organization'due south policy" in the VPC Service Controls department and have a Deject Storage label, you need to grant the Cloud Build Service Account access to the VPC Service Controls perimeter.

Office deployment fails due to IPv6 addresses non permitted in VPC-SC

Cloud Functions tin use IPv6 addresses for outbound requests to Cloud Storage. If you employ VPC Service Controls and IPv6 addresses are not permitted in your service perimeter, this can cause failures with part deployment or execution. In order to use VPC Service Controls with Deject Functions and IPv6 addresses, you lot must configure an access level to permit IPv6 addresses in your service perimeter.

The error message

In Audited Resource logs, an entry like the post-obit:

"protoPayload": {   "condition":     "message": "PERMISSION_DENIED",     "details": [       {         "@type": "type.googleapis.com/google.rpc.PreconditionFailure",         "violations": [           {             "type": "VPC_SERVICE_CONTROLS",   ...   "requestMetadata": {     "callerIp": "IPv6_ADDRESS",   ...   "serviceName": "storage.googleapis.com",   "methodName": "google.storage.buckets.become",   "metadata": {     "@type": "blazon.googleapis.com/google.cloud.audit.VpcServiceControlAuditMetadata",     "violationReason": "NO_MATCHING_ACCESS_LEVEL",   ...        

The solution

To specifically allow requests from Deject Functions and not the unabridged Net, permit the range 2600:1900::/28 to access your VPC-SC perimeter by configuring an access level for this range.

Function deployment fails due to incorrectly specified entry indicate

Cloud Functions deployment can fail if the entry point to your code, that is, the exported part name, is not specified correctly.

The error message

Cloud Console

              Deployment failure: Part failed on loading user code. Error bulletin: Error: delight examine your office logs to see the fault cause: https://cloud.google.com/functions/docs/monitoring/logging#viewing_logs                          

Deject SDK

              ERROR: (gcloud.functions.deploy) OperationError: code=3, message=Function failed on loading user code. Error bulletin: Please examine your function logs to see the error cause: https://cloud.google.com/functions/docs/monitoring/logging#viewing_logs                          

The solution

Your source code must incorporate an entry point function that has been correctly specified in your deployment, either via Cloud Console or Deject SDK.

Function deployment fails when using Resource Location Constraint arrangement policy

If your organization uses a Resource Location Constraint policy, yous may meet this error in your logs. It indicates that the deployment pipeline failed to create a multi-regional storage bucket.

The error message

In Cloud Build logs:

          Token exchange failed for projection '<PROJECT_ID>'. Org Policy Violated: '<REGION>' violates constraint 'constraints/gcp.resourceLocations'                  

In Cloud Storage logs:

          <REGION>.artifacts.<PROJECT_ID>.appspot.com` storage bucket could non be created.                  

The solution

If you are using constraints/gcp.resourceLocations in your arrangement policy constraints, yous should specify the appropriate multi-region location. For example, if you are deploying in any of the us regions, you should use us-locations.

Nevertheless, if yous require more fine grained control and want to restrict office deployment to a single region (not multiple regions), create the multi-region saucepan first:

1. Allow the whole multi-region
2. Deploy a exam function
3. Afterwards the deployment has succeeded, change the organizational policy dorsum to permit but the specific region.

The multi-region storage saucepan stays available for that region, then that subsequent deployments tin succeed. If yous later decide to allowlist a region outside of the one where the multi-region storage bucket was created, y'all must repeat the procedure.

Function deployment fails while executing function'southward global telescopic

This fault indicates that at that place was a problem with your lawmaking. The deployment pipeline finished deploying the part, but failed at the terminal pace - sending a wellness check to the function. This health bank check is meant to execute a function's global scope, which could exist throwing an exception, crashing, or timing out. The global scope is where you commonly load in libraries and initialize clients.

The error message

In Deject Logging logs:

          "Role failed on loading user code. This is likely due to a problems in the user code."                  

The solution

For a more detailed mistake message, look into your function's build logs, also as your part'southward runtime logs. If it is unclear why your function failed to execute its global scope, consider temporarily moving the lawmaking into the request invocation, using lazy initialization of the global variables. This allows you to add extra log statements around your client libraries, which could be timing out on their instantiation (particularly if they are calling other services), or crashing/throwing exceptions birthday.

Build

When you lot deploy your function'southward source lawmaking to Cloud Functions, that source is stored in a Cloud Storage bucket. Deject Build so automatically builds your code into a container image and pushes that image to Container Registry. Cloud Functions accesses this image when information technology needs to run the container to execute your function.

Build failed due to missing Container Registry Images

Cloud Functions uses Container Registry to manage images of the functions. Container Registry uses Deject Storage to shop the layers of the images in buckets named STORAGE-REGION.artifacts.Project-ID.appspot.com. Using Object Lifecycle Management on these buckets breaks the deployment of the functions as the deployments depend on these images being present.

The error bulletin

Cloud Console

              Build failed: Build error details non bachelor. Delight cheque the logs at <CLOUD_CONSOLE_LINK>  CLOUD_CONSOLE_LINK contains an error like below : failed to go OS from config file for image 'us.gcr.io/<PROJECT_ID>/gcf/us-central1/<UUID>/worker:latest'"                          

Cloud SDK

              Mistake: (gcloud.functions.deploy) OperationError: code=13, message=Build failed: Build mistake details not available. Please check the logs at <CLOUD_CONSOLE_LINK>  CLOUD_CONSOLE_LINK contains an error like beneath : failed to become OS from config file for image 'united states of america.gcr.io/<PROJECT_ID>/gcf/the states-central1/<UUID>/worker:latest'"                          

The solution

1. Disable Lifecycle Management on the buckets required by Container Registry.
2. Delete all the images of affected functions. You can admission build logs to find the image paths. Reference script to bulk delete the images. Note that this does not affect the functions that are currently deployed.
3. Redeploy the functions.

Serving

The serving phase can also be a source of errors.

Serving permission error due to the function beingness private

Cloud Functions allows you to declare functions private, that is, to restrict access to end users and service accounts with the appropriate permission. By default deployed functions are set as private. This error bulletin indicates that the caller does not have permission to invoke the function.

The fault message

HTTP Error Response code: 403 Forbidden

HTTP Error Response body: Error: Forbidden Your client does not have permission to get URL /<FUNCTION_NAME> from this server.

The solution

You lot can:

• Allow public (unauthenticated) admission to all users for the specific function.

  or

• Assign the user the Deject Functions Invoker Cloud IAM office for all functions.

Serving permission mistake due to "let internal traffic only" configuration

Ingress settings restrict whether an HTTP function can exist invoked by resources outside of your Google Deject project or VPC Service Controls service perimeter. When the "allow internal traffic merely" setting for ingress networking is configured, this mistake bulletin indicates that just requests from VPC networks in the same project or VPC Service Controls perimeter are allowed.

The error message

HTTP Mistake Response code: 403 Forbidden

HTTP Error Response body: Fault 403 (Forbidden) 403. That's an error. Admission is forbidden. That'south all we know.

The solution

You can:

• Ensure that the request is coming from your Google Deject project or VPC Service Controls service perimeter.

  or

• Change the ingress settings to permit all traffic for the function.

Role invocation lacks valid authentication credentials

Invoking a Cloud Functions function that has been set with restricted access requires an ID token. Admission tokens or refresh tokens do not work.

The error message

HTTP Mistake Response code: 401 Unauthorized

HTTP Error Response torso: Your client does not have permission to the requested URL

The solution

Make sure that your requests include an Authority: Bearer ID_TOKEN header, and that the token is an ID token, not an access or refresh token. If you are generating this token manually with a service account'due south private cardinal, you must commutation the self-signed JWT token for a Google-signed Identity token, following this guide.

Effort to invoke function using coil redirects to Google login page

If you attempt to invoke a role that does not be, Cloud Functions responds with an HTTP/ii 302 redirect which takes you to the Google account login page. This is incorrect. It should respond with an HTTP/2 404 error response code. The problem is beingness addressed.

The solution

Brand sure you specify the name of your role correctly. You tin can always check using gcloud functions phone call which returns the correct 404 mistake for a missing part.

Awarding crashes and function execution fails

This error indicates that the process running your office has died. This is usually due to the runtime crashing due to issues in the office code. This may also happen when a deadlock or some other status in your function'south code causes the runtime to become unresponsive to incoming requests.

The error message

In Cloud Logging logs: "Infrastructure cannot communicate with function. At that place was probable a crash or deadlock in the user-provided code."

The solution

Different runtimes can crash under different scenarios. To find the root cause, output detailed debug level logs, check your application logic, and test for border cases.

The Cloud Functions Python37 runtime currently has a known limitation on the rate that it can handle logging. If log statements from a Python37 runtime instance are written at a sufficiently high charge per unit, it can produce this fault. Python runtime versions >= three.8 do not have this limitation. We encourage users to migrate to a higher version of the Python runtime to avoid this issue.

If you are still uncertain about the cause of the mistake, check out our support page.

Function stops mid-execution, or continues running after your code finishes

Some Cloud Functions runtimes allow users to run asynchronous tasks. If your function creates such tasks, it must too explicitly wait for these tasks to complete. Failure to do so may cause your function to cease executing at the wrong fourth dimension.

The error behavior

Your function exhibits one of the following behaviors:

• Your function terminates while asynchronous tasks are notwithstanding running, merely before the specified timeout period has elapsed.
• Your role does not stop running when these tasks cease, and continues to run until the timeout flow has elapsed.

The solution

If your function terminates early, y'all should brand sure all your function'due south asynchronous tasks have been completed earlier doing any of the post-obit:

• returning a value
• resolving or rejecting a returned Hope object (Node.js functions only)
• throwing uncaught exceptions and/or errors
• sending an HTTP response
• calling a callback function

If your function fails to terminate in one case all asynchronous tasks have completed, you should verify that your office is correctly signaling Cloud Functions one time it has completed. In particular, make sure that you perform one of the operations listed in a higher place as shortly as your office has finished its asynchronous tasks.

JavaScript heap out of retention

For Node.js 12+ functions with memory limits greater than 2GiB, users need to configure NODE_OPTIONS to accept max_old_space_size so that the JavaScript heap limit is equivalent to the function'due south retention limit.

The error message

Deject Console

            FATAL Fault: CALL_AND_RETRY_LAST Allotment failed - JavaScript heap out of memory                      

The solution

Deploy your Node.js 12+ function, with NODE_OPTIONS configured to accept max_old_space_size fix to your function's memory limit. For case:

          gcloud functions deploy envVarMemory \ --runtime nodejs16 \ --set-env-vars NODE_OPTIONS="--max_old_space_size=8192" \ --retention 8Gi \ --trigger-http                  

Function terminated

You may run across one of the following error messages when the process running your code exited either due to a runtime fault or a deliberate exit. At that place is also a small chance that a rare infrastructure error occurred.

The fault messages

Role invocation was interrupted. Error: function terminated. Recommended activity: inspect logs for termination reason. Additional troubleshooting information can be found in Logging.

Request rejected. Error: function terminated. Recommended action: inspect logs for termination reason. Additional troubleshooting information can exist found in Logging.

Role cannot be initialized. Error: function terminated. Recommended activity: inspect logs for termination reason. Additional troubleshooting information can exist institute in Logging.

The solution

• For a background (Pub/Sub triggered) function when an executionID is associated with the asking that ended up in error, try enabling retry on failure. This allows the retrying of function execution when a retriable exception is raised. For more information for how to utilise this selection safely, including mitigations for avoiding infinite retry loops and managing retriable/fatal errors differently, meet Best Practices.

• Groundwork activity (annihilation that happens subsequently your function has terminated) tin cause problems, then bank check your code. Deject Functions does non guarantee any actions other than those that run during the execution period of the function, so fifty-fifty if an activity runs in the background, it might be terminated by the cleanup process.

• In cases when there is a sudden traffic fasten, try spreading the workload over a little more time. Also test your functions locally using the Functions Framework earlier you deploy to Cloud Functions to ensure that the error is not due to missing or conflicting dependencies.

Scalability

Scaling issues related to Cloud Functions infrastructure tin can arise in several circumstances.

The post-obit conditions can be associated with scaling failures.

• A huge sudden increase in traffic.
• A long common cold start time.
• A long request processing time.
• High function error rate.
• Reaching the maximum instance limit and hence the system cannot scale any further.
• Transient factors attributed to the Cloud Functions service.

In each case Cloud Functions might not scale upward fast enough to manage the traffic.

The error message

• The request was aborted because at that place was no available instance
  • severity=Alert ( Response code: 429 ) Cloud Functions cannot scale due to the max-instances limit you set during configuration.
  • severity=ERROR ( Response code: 500 ) Cloud Functions intrinsically cannot manage the rate of traffic.

The solution

• For HTTP trigger-based functions, have the customer implement exponential backoff and retries for requests that must non be dropped.
• For groundwork / consequence-driven functions, Cloud Functions supports at least one time delivery. Even without explicitly enabling retry, the upshot is automatically re-delivered and the function execution will be retried. See Retrying Event-Driven Functions for more than data.
• When the root cause of the effect is a period of heightened transient errors attributed solely to Cloud Functions or if you demand assistance with your outcome, please contact back up

Logging

Setting upwardly logging to help y'all runway down problems can cause problems of its own.

Logs entries take no, or incorrect, log severity levels

Cloud Functions includes unproblematic runtime logging by default. Logs written to stdout or stderr appear automatically in the Cloud Console. But these log entries, past default, comprise just simple string messages.

The fault message

No or wrong severity levels in logs.

The solution

To include log severities, y'all must ship a structured log entry instead.

Handle or log exceptions differently in the event of a crash

You lot may desire to customize how yous manage and log crash information.

The solution

Wrap your function is a attempt/take hold of block to customize treatment exceptions and logging stack traces.

Instance

                      import logging import traceback def try_catch_log(wrapped_func):   def wrapper(*args, **kwargs):     endeavor:       response = wrapped_func(*args, **kwargs)     except Exception:       # Supervene upon new lines with spaces and then every bit to prevent several entries which       # would trigger several errors.       error_message = traceback.format_exc().replace('\n', '  ')       logging.error(error_message)       return 'Error';     render response;   return wrapper;   #Example hello world function @try_catch_log def python_hello_world(request):   request_args = request.args    if request_args and 'name' in request_args:     1 + 's'   return 'Hello World!'                  

Logs too large in Node.js 10+, Python 3.eight, Go one.xiii, and Java 11

The max size for a regular log entry in these runtimes is 105 KiB.

The solution

Make sure you send log entries smaller than this limit.

Cloud Functions logs are not actualization in Log Explorer

Some Cloud Logging customer libraries use an asynchronous process to write log entries. If a function crashes, or otherwise terminates, it is possible that some log entries have not been written nevertheless and may appear later. It is also possible that some logs will be lost and cannot be seen in Log Explorer.

The solution

Utilise the client library interface to flush buffered log entries before exiting the function or use the library to write log entries synchronously. You tin also synchronously write logs directly to stdout or stderr.

Cloud Functions logs are non appearing via Log Router Sink

Log entries are routed to their diverse destinations using Log Router Sinks.

Included in the settings are Exclusion filters, which define entries that can simply be discarded.

The solution

Make sure no exclusion filter is fix for resource.type="cloud_functions"

Database connections

There are a number of issues that tin can ascend when connecting to a database, many associated with exceeding connection limits or timing out. If you come across a Deject SQL warning in your logs, for instance, "context deadline exceeded", you might need to accommodate your connection configuration. See the Cloud SQL docs for boosted details.

jaquesbachim.blogspot.com

Source: https://cloud.google.com/functions/docs/troubleshooting