Troubleshoot Message Streaming on CloudFerro Cloud

A missing product, a failed client connection, and missing retained events need different checks. Start with the symptom below to identify whether the problem concerns portal access, NATS credentials, or the application’s streams and consumers.

Prerequisites

No. 1 Identify the affected resource

Have the organization, region, and account name ready. For a client problem, also identify the endpoint, NATS user, and any affected subjects, streams, or consumers. Record the error message and when it occurred without including the contents of a credentials file.

No. 2 Access for the check you will perform

Portal checks need an account that can access Message Streaming in the selected organization; Create your first NATS account on CloudFerro Cloud explains the required service availability. Client checks use the CLI and the NATS_URL and NATS_CREDS variables from Connect with the NATS CLI on CloudFerro Cloud. Substitute your own stream and consumer names for JOB_STATUS and reporting.

The product is missing or access is restricted

A product can be hidden, or can return an error page, when:

  • it is not listed in the Product Catalogue;

  • it has no configured endpoint in the selected region;

  • the user does not have the required role;

  • the product interface did not load;

  • the organization has no active service or contract.

If Access restricted appears, check the selected organization, your permissions, and product availability in the catalogue. This screen does not mean that a resource has failed.

The account is missing in the selected region

  • Check the region selector in Message Streaming itself. Its selection is remembered separately from Functions and Message Broker.

  • Resources are regional and are not replicated between regions automatically.

The client cannot connect

  1. Copy the endpoint from the intended account in My Portal. Check the selected region and port 4222.

  2. Keep tls:// and the required --tlsfirst option in the connection command.

  3. Check that the credentials path identifies the downloaded file and that the process running the client can read it.

  4. Check whether the NATS user has been deleted or the application still uses credentials that were replaced.

  5. Check that the application environment can reach the public endpoint on port 4222.

Check the client version, local file access, and server connection in that order:

nats --version
test -r "$NATS_CREDS" && echo "Credentials file is readable"
nats --tlsfirst --timeout=5s server check connection

If the readability message is absent, correct the file path or permissions first. If the CLI rejects --tlsfirst, update the client. A successful connection check reports OK Connection OK; a failure leaves the endpoint, credentials, TLS, or network path to investigate.

Repeat the connection check after correcting the connection values. A successful portal sign-in alone does not establish a NATS client connection.

The credentials file is lost

The credentials file can be downloaded only once. To replace a lost file:

  1. Create a new NATS user and download its credentials.

  2. Switch the application to the new file and check the connection.

  3. Delete the old user to revoke its access.

When checking with the CLI, update NATS_CREDS to the replacement file before running the connection check again.

The account is active but there is no stream

  • Creating an account does not create a named stream.

  • Use the NATS CLI or an SDK to create streams and consumers and check their configuration. My Portal does not manage them.

nats --tlsfirst stream ls
nats --tlsfirst stream info JOB_STATUS

If the account connection succeeds but JOB_STATUS is absent, the stream has not been created in this account or has been removed. The stream exercise linked below creates it explicitly.

Stream creation is rejected

Inspect existing streams and account capacity:

nats --tlsfirst stream ls
nats --tlsfirst account info

  • If the error reports overlapping subjects, another stream already stores a matching subject. Use the intended existing stream or choose an unused subject for the exercise.

  • If the error concerns limits, compare the requested storage and stream count with the account’s available capacity. Adjust the example within those limits or request the required capacity.

A consumer cannot read earlier events

  • Check that the stream stores the subjects used by the publisher.

  • Inspect the stream’s retention and storage settings and the consumer configuration.

  • Events removed by retention cannot be replayed from that stream.

nats --tlsfirst stream info JOB_STATUS
nats --tlsfirst stream get JOB_STATUS --last-for=jobs.status
nats --tlsfirst consumer info JOB_STATUS reporting

If the latest event is stored, compare the consumer’s Filter Subject and Deliver Policy with the intended reader. Unprocessed Messages shows events awaiting delivery; Outstanding Acks shows deliveries awaiting acknowledgment. In the exercise, reporting can have unread events even after dashboard has finished.

A Functions integration stops working

  • Check the region of both resources.

  • Check whether the NATS user was deleted; deletion revokes its access.

  • Check whether the account was deleted. This also deletes its users and can break integrations that use them.

Run Test configuration on the function’s Triggers and output tab. If that succeeds, publish a test event with a distinct job_id and check the function’s invocation logs. A stored event with no invocation points to the trigger or reader configuration; an invocation that fails needs investigation in the function’s processing.

What to do next

Still need help?
If this article doesn’t answer all of your questions, our support team will do their best to help you.
Contact support