Troubleshooting

This page lists common problems with the message SiteManager shows for each one. If you cannot solve a problem, download a diagnostics bundle and send it to MultiTaction support with a description of what you did.

The web interface does not open

The page does not load at all. The service is not running, or something blocks the port.

1. Check that the service runs. On Linux: sudo systemctl status sitemanagerd. On Windows, open Services and look for MultiTaction SiteManager. On macOS, check the terminal where you started sitemanagerd.
2. Read the log for the reason it stopped. On Linux: sudo journalctl -u sitemanagerd. On Windows and Linux, also read sitemanagerd.log in the state directory. On Windows, a start-up failure is also in the Application event log.
3. From another computer, remember that SiteManager in local mode (the default) listens on its own computer only. Other computers cannot reach it until you open SiteManager to the network. In network mode, check Ports and firewall. TCP 8790 must be open into the SiteManager computer.

The page does not load, and the address starts with https://. A service in local mode serves plain HTTP. Use http://127.0.0.1:8790/. A service in network mode needs https://.

The browser says 403 and SiteManager runs in local mode and answers only to localhost, 127.0.0.1 and [::1] on port 8790. A service in local mode accepts only those three host names, with the port it listens on. This protects it from web pages that try to reach it through another name. Open http://127.0.0.1:8790/ or http://localhost:8790/. (http://[::1]:8790/ works only when the service listens on [::1].) A computer name, a LAN address or a different port is refused. The port in the message is the port the service listens on. The same refusal appears as JSON, {"error": "..."}, for an address under /api/.

A page opened through an SSH tunnel gives the same 403. A tunnel to a service in local mode must use the same port number on both ends, because the browser sends that port in the Host header. For a service on port 8790 forward 8790 to 127.0.0.1:8790, then open http://127.0.0.1:8790/. If you forward a different local port, the service refuses it. If you need other computers to connect without a tunnel, open SiteManager to the network.

A change gives 403 and cross-site request refused. A change (POST, PUT, PATCH or DELETE) with an Origin header that is not the service's own address is refused. A script should send no Origin header, or send the service's own address.

Pages are slow to load, or wait, when many tabs are open in local mode. Over plain HTTP a browser allows 6 connections to one address, and each SiteManager page keeps some of them open. About 5 SiteManager tabs can be open at once. Close tabs you do not need. In network mode, over HTTPS, the connections are shared.

The log or the console says --public-url names the address other computers use; local mode (a loopback --listen) serves this computer only. Use a network --listen such as :8790. The service did not start, because --public-url is set and --listen is a loopback address. Remove --public-url, or give --listen a network address such as :8790.

The log says listen tcp ...: bind: address already in use. Another program already uses the port. Pick another port with the --listen option, for example --listen 127.0.0.1:8443 to stay in local mode (--listen :8443 opens SiteManager to the network), or stop the other program.

The browser warns that the connection is not private. This happens only in network mode. It is expected, because the service uses its own certificate. Compare the fingerprint in the page footer with the one the installer showed before you accept it. See First start. A service in local mode uses plain HTTP and has no certificate, so there is no warning.

Signing in and setup

These messages appear in network mode. Local mode has no setup and no login.

Message	What it means and what to do
wrong setup token	The token you typed is not the first-run token. Print it again with sitemanagerd --state-dir DIR --print-setup-token.
setup is already done	The first administrator already exists. Sign in. --print-setup-token prints nothing any more.
password must be at least 12 characters	Choose a longer password.
password must be at most 72 bytes	Choose a shorter password. A character outside plain English letters can take more than one byte.
wrong user name or password	Check the user name. User names are case-sensitive. Ask an administrator to set a new password on the Users page.
too many login attempts, try again later	Your address had too many failed password logins. Wait a few minutes. The API answers with status 429 and a Retry-After header. API tokens are not affected.
login required	The command line or script used a token that is wrong or has been revoked. Create a new token on the Account page.

The command line

Message	What it means and what to do
"displays" needs the SiteManager service, and there is none to use: no service in local mode answers on this computer and no API token is configured. Start the service, or run sitemanager login --server URL --fingerprint FINGERPRINT --token TOKEN for a service in network mode (create the token on its Account page)	The command exists only in service mode. No service in local mode answers on this computer, and no token is stored. Start the service on this computer, or log in to a service in network mode. Exit code 4.
not available in local mode: SiteManager listens on this computer only and has no logins, users or API tokens; to let other computers connect, restart it with a network --listen address (for example --listen :8790)	You ran a command or an API operation that needs logins: users, tokens or password, or an API operation for setup, login, users, tokens, sessions or passwords (status 403). Local mode has none of these. The Account and Users pages are not there in local mode: opening them takes you back to the overview. If you need users, open SiteManager to the network. The command exits with 2.
the SiteManager service at http://127.0.0.1:8790 runs in local mode: commands on this computer need no login. To reach it from other computers, open it to the network (README: Opening SiteManager to the network)	You ran sitemanager login against a service in local mode. It needs no login. Run your command without login. To use SiteManager from other computers, open it to the network. Exit code 4.
--service: no API token is configured, and no SiteManager service in local mode answers at http://127.0.0.1:8790 (set SITEMANAGER_LOCAL_SERVICE=host:port if it listens elsewhere)	You asked for service mode, and no local-mode service answered on this computer and no token is stored. Check that the service runs and listens on 127.0.0.1:8790, or set SITEMANAGER_LOCAL_SERVICE. Exit code 4.
login needs --fingerprint (or SITEMANAGER_FINGERPRINT): the SHA-256 fingerprint of the service's certificate...	The fingerprint is required for a service in network mode. Read it in the footer of the login page.
cannot reach the service at https://...: dial tcp ...: connect: connection refused	Nothing answers at that address and port. Check the address, that the service runs, and the firewall. Exit code 3.
the certificate fingerprint of the service is X, not the pinned Y; ...	The service presents another certificate than the one you pinned. If you replaced the certificate on purpose, check the new fingerprint and run sitemanager login again. If you did not, do not continue: you may not be talking to your service. Exit code 3.
the service is reached over https only (the API token must not travel in clear)	Write the server address as https://....
the service answered with a redirect to ...; redirects are never followed	The address points at something that redirects, such as a proxy. Use the address of the service itself.
permission denied: needs manage	Your token has the viewer role. Use a token of an administrator. Exit code 2.
... holds an API token but is readable by other users (mode 0644); run: chmod 600 ...	Other users can read your stored login. Run the chmod command shown.
select displays with --displays SERIAL[,SERIAL...], --wall WALL or --all	A command that acts on displays needs a selection.
select displays with --hosts ADDRESS[,ADDRESS...] ... to use the service instead, runsitemanager login``	In direct mode, give the displays by address. Or use the service: one in local mode on this computer needs no login, and for one in network mode you log in first.
--hosts addresses displays directly; with a service, select displays with --displays, --wall or --all (or add --direct)	You used --hosts in service mode. A service in local mode on this computer counts: select displays with --displays, --wall or --all, or add --direct to talk to the displays without the service.
flag provided but not defined: -...	The option does not exist for that command. Run sitemanager help COMMAND. Exit code 4.
Unknown option 'json'.	You mixed a 2.x style command line with an option of the new command line. See Moving from SiteManager 2.x.
timeout: 9999 is above the maximum 6600	The value is out of range. SiteManager refuses it before sending anything. Exit code 4.
sweep ...: ... hosts is more than the 4094 allowed; use a /20 or smaller	Use a smaller range.

A write has an unknown outcome

If a write is cut short by Control-C or --timeout, or a display does not answer after a write was sent, SiteManager reports UNKNOWN, or a message ending in the write may or may not have been applied - check with .... It exits with 3. Do not assume it failed or that it worked. Run the command the message names, for example sitemanager displays or sitemanager settings unsaved, and look at the display.

Finding and managing displays

A broadcast finds nothing. A broadcast reaches only the local subnet. If the displays are on another subnet, use a sweep of their address range, or add them by IP address. Also check that UDP 37812 is not blocked.

The discovery result shows one of these notes:

Message	What it means
no answer on 8080 or 5502: ...	Nothing answers at that address on either port. Check the address and the network.
no SiteManager API on 8080; NetBridge answers on 5502	The host takes part in touch, but has no SiteManager interface. SiteManager cannot manage it.
... answered but reports no serial number: it cannot be added	SiteManager identifies displays by serial number, so it cannot add this one.
discovery reply, but /v1/info failed: ...	The display answered the broadcast, but reading its identity failed. Try again.

A display shows wrong display (SERIAL answers here). The address now belongs to another display, for example after an address change. SiteManager refuses to write to it. Run a discovery so SiteManager follows the display to its new address, or correct the address.

A display is offline. SiteManager missed two readings. Check the display's power and network. The Last error column shows why the last reading failed.

A command fails with the display is busy in job j-.... A display can be in only one job at a time. Wait for that job, or cancel it with sitemanager jobs cancel ID.

Settings are gone after a reboot. Applied settings stay unsaved until you save them. Select Save to the displays, or run sitemanager settings save. The unsaved badge shows displays with pending changes.

Jobs that wait

A reboot, calibration, firmware update or profile apply can stop and wait for your go-ahead. Open the job on the Jobs page and read why.

• The wall is in use. At least one display's touch traffic is above its normal level. Wait, or choose Go ahead.
• unknown: no touch connections to these displays from this computer. SiteManager cannot tell whether anyone is using the wall, because the SiteManager computer holds no touch connection to the displays. This is normal when SiteManager does not run on the wall's application computer, or when Canvus is not running. SiteManager never treats unknown as idle, so it asks you. See the idle-wall check.
• Settings are unsaved. A reboot would lose them. Save them first, or go ahead.

Cornerstone files

Message	What it means and what to do
Apply is unavailable: ... or apply is unavailable: ...	SiteManager cannot write the files. The text after the colon says why, for example that the Cornerstone user does not exist. Set --cornerstone-user. You can still generate and download the files.
applying files is not available on this service	The service has no writer for the Cornerstone files.
mt-canvus.ini is never created	SiteManager only edits an existing mt-canvus.ini. Point --canvus-ini at the file Canvus uses.
the target is a symbolic link	SiteManager does not write through links. Point the option at the real file.
the file changed on disk since it was read	Someone changed the file after you looked at the preview. Open Cornerstone files again, check the new preview and apply again.
refusing to write an empty file	The file would have been empty, which is almost certainly wrong. Check the layout.

An error in the list of findings on a wall page, such as two displays in one place, blocks generating and applying files until you fix it.

After you apply files, restart Canvus or Showcase. SiteManager never restarts them.

Firmware

• The catalogue could not be read: ... The computer cannot reach the update server. Check the network, or import a .swu file instead.
• A display went back to its previous firmware, or the alert Firmware went back is active. The new firmware did not start properly and the display fell back. Try the update again. If it happens again, collect a diagnostics bundle and contact MultiTaction support. See If a display went back.
• A display page says SiteManager checks again at .... SiteManager has not yet seen the display confirm its new firmware and will look again at that time. See After the update: the re-check.
• A rollout does not start. The check lists the problem for each display. Fix it, or leave that display out, and check again.
• ... is ... bytes; the service accepts at most 2 GiB The file is too large for an import.

Display security

• A display shows identity changed instead of offline. It presented another certificate. If it was repaired or reset, open its page and choose Trust the new identity. If not, find out what is answering at its address. See Identity changed.
• A display shows returned from older firmware. It came back with a new certificate after running older firmware. Trust it only if you updated it on purpose. See Returned from older firmware.
• A display shows claimed elsewhere, or Secured by another SiteManager or tool. It refuses SiteManager's key. Use Reset API access on the display's on-screen menu, then choose Secure this display.
• A display shows reset on the display. Someone reset its API access on its menu. It is open again. Choose Secure this display.
• A display shows encrypted connection unavailable. Restart the display. For a secured display, if that does not help, use Reset API access and secure it again.
• SiteManager cannot read display-access.json. SiteManager cannot read the file that holds the pinned certificates and access keys, so it cannot secure, change or release a display. Restore the file from a backup of the state directory, or use Reset API access on each secured display and secure it again.
• An older tool, or SiteManager 2.x, cannot reach a display. The display is secured. Release it in the SiteManager that secured it.
• This display is secured by a SiteManager service. Run the command through that service, or release the display there first. A command that talks to the display directly cannot use its key. Run it through the service.
• This looks like a private key. Never paste a private key here. Paste the public key, the file that ends in .pub.
• A firmware image is refused for a display. The display installs only firmware signed by MultiTaction. See What a refusal means.

See Display security for every state.

Alerts

• Alerts are off: ... The page gives the reason. The counter in the menu reads Alerts off.
• A channel does not deliver. The line Last error under the channel shows the reason. Use Send a test message. A test works even when the channel is disabled.
• Emails are missing. Check the Security and Port settings. If you left Port empty, SiteManager uses 587 for starttls, 465 for tls and 25 for none.

Diagnostics bundle

A second bundle request while one is running is refused. Wait for the first to finish. A bundle of many displays can take a long time. See Diagnostics and capabilities.

Platform notes

Windows. If the installer could not start the service, its last page or the setup log (a line starting with Problem:) says what to do. If an ordinary user runs sitemanagerd.exe against the default state directory, it stops with the state directory ... belongs to the SiteManager service (SYSTEM and Administrators only): run as administrator, or use another --state-dir. Run it from an administrator prompt.

macOS. If macOS refuses to open sitemanagerd or sitemanager, clear the quarantine flag: xattr -dr com.apple.quarantine <folder>. See SiteManager on macOS.

Linux. After an upgrade the service stays stopped if you had disabled it. That is intended. Start it again with sudo systemctl enable --now sitemanagerd.