Error monitoring

These tables return system errors and help you analyze different incidences and issues.

`devo.internal.log.error`

This table collects error messages from different background processes related to Devo components such as alerts, flows, data ingestion, etc. This table presents the following fields:

Field	Data type	Description
type	`str`	Error type. Currently, the only type shown is `background_process`
component	`str`	Devo component that is sending the error log (for example: `flow`, `alert`, `lookup`...)
resource_id	`str`	ID of the resource that is failing.
severity	`str`	Severity level of the incident. It can be one of the following: `critical` `major` `minor` `low`
error_code	`str`	Code of the error. The error code is always composed by a letter that indicates the Devo component plus a number that indicates the issue, following the rules specified in the section below.
message	`str`	Definition of the incident.

Code errors

Error codes displayed in this table are always composed of a letter and a number, as in the examples below:

I-201
Q-1103001

Letter

The letter indicates the Devo component that is affected. For example:

Q stands for query.
I stands for data ingestion.

Number

The number indicates the error type. This number may be composed either of 3 or 7 digits.

The first digit of the error code indicates the severity of the issue and informs whether it can be fixed or not.

Digit 1	Description
`1`	The error cannot be fixed.
`2`	The error requires manual action over another part of the system.
`3`	The error can be fixed in a medium-long amount of time.
`4`	The error can be fixed immediately.

The second and third digits of the error categorize the type of exception retrieved.

Digits 2-3	Description
`00`	General error.
`01`	Connection error. It may be a transient issue.
`02`	An error related to external factors, such as client’s code.
`03`	An error related to a system-wide resource, such as RAM or file handlers.
`04`	An error related to a resource that requires additional security checks, such as signed queries.
`05`	Query cancelled by an external entity.
`06`	Format error on reading input resources, such as files, fields, decoding…
`07`	Internal error. This is not a transient issue, and can be induced by a non-deterministic event.
`08`	A resource required to execute the query is missing.
`09`	Query limit reached (for example, maximum result rows, time, RAM…)
`10`	Syntax error in the query, probably a missing or misspelled token. Includes errors found in static analysis performed after parsing (refinement order, unknown operations, operations with unexpected arguments…)
`11`	Unsupported or not implemented feature.

The last 4 digits of the code are used to specify the detailed error of the exception. This detailed description is associated to the error type indicated by digits 2-3 explained above.

Digits 4-7	Description
General error
`0000`	Unknown error.
Connection error
`4000`	Affinity rules have changed during query execution and the query can no longer be processed.
Missing resource
`1000`	Missing aggregated resource to execute the query (for example, an aggregation task).
`2000`	Recursive definition for a union table.
`3000`	Missing files for Geolocation operations that use MaxMind.
`4000`	Missing files for Public suffix operations.
`5000`	Missing files for User agent operations.
`6000`	Unknown table.
System resource error
`1001`	Required registry for a computation process is missing.
`1002`	Provided registry is not suitable for the required operation.
`1003`	Memory shortage.
Internal error
`0000`	Unknown internal error.
`0001`	A listed file cannot be found in the directory, usually because it has been compressed simultaneously.
`0002`	Stall event received while executing a subquery.
`4001`	Error while caching data.
`4002`	Error while updating cached data.
`4003`	Error while deleting cached data segments.
`4004`	Error while deleting cached data entries.
`4005`	Array index out of bounds.
Query parsing error
`0001`	No language provided when parsing a query.
`0002`	Unknown query language.
`0003`	No code provided. This error relates to any kind of language, including expressions and Ty Terms.
`0004`	Query starting time no found.
`0005`	Query ending time no found.
`0006`	Cannot parse query.
`0007`	Illegal time-based grouping clause.
`0008`	Time-based group found over a non-time-based table or group.
`0009`	Inferred time constraint spans to the future.
`1001`	Reference to an identifier (table field or as-defined) that is not known or available at that stage.
`1002`	Unknown operation or known operation expecting arguments with other properties (type, constancy...)
`1003`	An identifier has been used more than once.
`1004`	An expression with boolean type or a type that can by automatically converted to boolean was expected.
`1005`	The operation expects some arguments to be constant, but a non-constant expression was given.
`1006`	Invalid filter added to an operation.
`1007`	The operation cannot be used with one or several of the given arguments.
`1008`	The operation cannot be used with one or several of the given data types.
`1009`	The operation cannot be used with the given arguments.
`1010`	The operation cannot be called at stage 1.
`1011`	Given argument for the selected operation is ambiguous.
`3000`	Grouping over a key correctly typed but with no computable tyre PR.
`3001`	Grouping over a key correctly typed but with no computable memory usage information.
`3002`	Grouping computing a correctly typed aggregation but with no computable tyre PR.
`3003`	Grouping computing a properly typed aggregation but with no computable memory usage information.
`9000`	Inferred type does not match the explicit type given with the operation.
Config parsing error
`4000`	Query is trying to access a file but cannot decode it.
Query limits
`0001`	Maximum number of elements surpassed for the selected operation.
`0002`	Stack overflow while processing the query.
`0003`	Error limit reached. The query has failed n consecutive times and is quarantined for the following n minutes.
Security error
`0001`	Authentication failed.
`0002`	Cannot change authentication for active cluster.