Solve a problem

Use this page when you know the symptom but are not sure which Sauron page to read first. If your question is about how to use a Sauron feature, start with the linked help page for that feature. Escalate only after you have completed the relevant checks below or when the request requires a Sauron-team action.

Can I do this myself?

What you need to do	Start here	Who can act?
Get access to an existing Sauron	First browser sign-in and OIM roles	You request access; your OIM approver approves it. New entitlements require Sauron support.
Fix an SSO sign-in error	Login checks	You can check the URL, approval, and browser session. Your owner or Sauron support must fix SSO configuration.
Send a first metric or log	First metric or first log	Your team can do this with the approved client access and network path.
Find why a metric, dashboard, log, or alert is missing	Symptoms below	Your team can run the checks. Changes depend on the role and system you own.
Create a dashboard or alert	First dashboard or first alert	Your team can do this with the required editing or API access.
Change Sauron's own alert settings	Self-alerting	An authorized team member can make the documented API changes.
Restore an index from a listed snapshot	Restore guide	Follow the guide for a supported small restore; ask Sauron support for large or uncertain restores.
Provision a new Sauron or create OIM entitlements	Provisioning request or OIM setup	Sauron support acts after your team supplies the required details.
Change retention, unlock or re-enable an instance	Retention request or locked API	Sauron support acts; include the instance and reason.
Enable SMTP, mTLS, or new plugins	Email setup, mTLS request, or plugin request	Sauron support reviews or enables these changes.

Common Symptoms

I am not sure which page to read

Use Help Home to choose Explore my Sauron or Connect my service. For a failed task, choose the symptom below. Include the page you tried and what you were doing if you still need help.

I cannot log in, or I get Access denied

First, confirm which endpoint failed. Grafana, Prometheus, Thanos, Alertmanager, API, Help, Console, and OpenSearch Dashboards can have different access paths depending on how your Sauron is configured.

Check these items:

• Confirm you are using the correct Sauron URL.
• Confirm the expected OIM entitlement has been requested and approved.
• Sign out of Oracle SSO and sign back in, or test in an incognito browser.
• If only Grafana fails, confirm whether the expected role is Admin, Editor, or Viewer.
• If a non-Grafana endpoint fails, confirm whether your role is allowed to use that endpoint.

More details:

• Access to your Sauron endpoints
• OIM Entitlements for Sauron RBAC
• Oracle SSO for Sauron Endpoints

My Grafana dashboard shows no data

Check the time range first. A dashboard can look empty when the selected time range does not overlap with available metrics.

Then check:

• The dashboard datasource.
• The PromQL query in the panel.
• Dashboard variables and selected labels.
• Whether the same query returns data in Thanos or Prometheus.
• Whether the expected metric exists and is still being scraped.

More details:

• Create Grafana Dashboards
• Sending Metrics

My Prometheus target is missing or down

A successful configuration update means Sauron accepted the request. It does not prove the target is reachable or valid.

Check these items:

• Fetch the current Prometheus config and confirm your scrape job is present.
• Check the Prometheus targets page for the job and target health.
• Confirm the target host, port, scheme, path, TLS settings, and credentials.
• Confirm the network allowlist permits Sauron Prometheus to reach the target.
• If using Kubernetes discovery, confirm labels, namespaces, and service port names match the scrape configuration.

More details:

• Sending Metrics
• Shuttleproxy

Shuttleproxy returns 403, 504, or does not register

Shuttleproxy problems usually come from egress/DNS, authentication or domain configuration, client registration, target reachability, or changed endpoint allowlists.

Check these items:

• The Shuttleproxy client can resolve and reach the Shuttleproxy endpoint.
• The configured domain ID and client ID match the Sauron setup.
• The client is using real credentials, not placeholder values.
• The expected target appears in the Prometheus targets page.
• Recent endpoint IP or firewall changes have been allowlisted.

More details:

• Shuttleproxy

Logs are missing from OpenSearch Dashboards or Kibana

First widen the time range in OpenSearch Dashboards or Kibana and confirm the index pattern you are searching. Then check the client sending logs.

Check these items:

• Endpoint URL and credentials.
• Client type and version.
• Output plugin and index name.
• Bulk request errors or proxy errors.
• Whether any documents are visible in a wider time range.

More details:

• Sending Logs
• Access to your Sauron endpoints

Alert notifications are not delivered

First confirm whether the alert is firing. If an alert is not firing, debug the rule or query before debugging notification delivery.

Check these items:

• Alert rule state.
• Alertmanager route matchers.
• Receiver configuration.
• Silences and inhibitions.
• Webhook, email, Slack, PagerDuty, or Ocean delivery errors.
• Expired or rotated tokens, without sharing token values in Slack.

More details:

• Defining Alerts
• Sauron Self-Alerting

Escalate After These Checks

Escalate only after the relevant symptom checklist above has been completed, or when the request requires Sauron-team action such as a large or uncertain restore, retention change, unlock, re-enable, provisioning, plugin enablement, SMTP enablement, or mTLS enablement.

When you escalate in #sauron-support, include enough detail for the Sauron team to identify the affected instance and reproduce the symptom:

Sauron URL:
Component:
Endpoint:
Auth method:
Start time:
Expected behavior:
Actual behavior:
Exact error/status or screenshot:
Recent changes:
Production impact:
Checks completed:
Page followed:

Do not paste passwords, bearer tokens, private keys, SMTP credentials, webhook tokens, or other secret values in Slack.

I am getting [WARNING] Certificate did not match expected hostname error when accessing my Sauron endpoint

Check that the URL is the one in your welcome email or Console Endpoints and that you are using the intended region. A hostname mismatch alone does not identify why the endpoint is unavailable. If the current URL still fails, send the URL, certificate warning, and time to #sauron-support. Ask the Sauron team to check the endpoint and whether the instance is enabled; do not bypass the certificate warning.