{"record":{"id":"0d5681e5d4e43f31","repo":"netbirdio/netbird","slug":"upload-failed-s","errorCode":null,"errorMessage":"upload failed: %s","messagePattern":"upload failed: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/cmd/debug.go","lineNumber":193,"sourceCode":"\trequest := &proto.DebugBundleRequest{\n\t\tAnonymize:      anonymizeEnabled,\n\t\tAnonymizeLevel: anonymizeLevel.String(),\n\t\tSystemInfo:     systemInfoFlag,\n\t\tLogFileCount:   logFileCount,\n\t\tCliVersion:     version.NetbirdVersion(),\n\t}\n\tif uploadBundleFlag {\n\t\trequest.UploadURL = uploadBundleURLFlag\n\t\trequest.UploadInsecure = uploadBundleInsecureFlag\n\t}\n\tresp, err := client.DebugBundle(cmd.Context(), request)\n\tif err != nil {\n\t\treturn daemonCallError(\"bundle debug\", err)\n\t}\n\tcmd.Printf(\"Local file:\\n%s\\n\", resp.GetPath())\n\n\tif resp.GetUploadFailureReason() != \"\" {\n\t\treturn fmt.Errorf(\"upload failed: %s\", resp.GetUploadFailureReason())\n\t}\n\n\tif uploadBundleFlag {\n\t\tcmd.Printf(\"Upload file key:\\n%s\\n\", resp.GetUploadedKey())\n\t}\n\n\treturn nil\n}\n\nfunc setLogLevel(cmd *cobra.Command, args []string) error {\n\tconn, err := getClient(cmd)\n\tif err != nil {\n\t\treturn err\n\t}\n\tdefer func() {\n\t\tif err := conn.Close(); err != nil {\n\t\t\tlog.Errorf(errCloseConnection, err)\n\t\t}","sourceCodeStart":175,"sourceCodeEnd":211,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/cmd/debug.go#L175-L211","documentation":"After the daemon assembled the debug bundle, it attempted the upload and reported a failure reason string in the response, which the CLI surfaces here. The bundle file itself was still created locally (its path is printed just above this error). The reason text comes from the daemon's upload attempt: unreachable or invalid upload URL, TLS verification failure against the target, an HTTP error status from the receiving endpoint, or a blocked egress path.","triggerScenarios":"--upload with a URL that is wrong (typo, wrong scheme, missing endpoint path); the receiving endpoint returns 4xx/5xx (auth required, size limits); self-signed or internal-CA certificate on the upload server without --upload-insecure; device egress blocking the upload host (firewall/proxy); DNS failure for the upload host.","commonSituations":"Support-tool flows where the URL was transcribed manually; uploads to an internal collector with a private CA while the flag for insecure upload was not passed; large bundles exceeding a reverse-proxy body limit (nginx client_max_body_size); cloud environments with egress allow-lists.","solutions":["Read the printed reason: DNS/connectivity messages mean fix reachability; TLS messages mean fix the certificate or pass --upload-insecure (only for trusted internal endpoints); HTTP status text means inspect the server side","Verify the URL with curl -v --data-binary @<bundle-path> <url> from the same machine to reproduce independently","For proxy body-size limits, raise the limit on the receiving server or reduce bundle size (fewer log files via --log-file-count, disable system info)","The local file path printed before the error still holds the full bundle — share it manually if upload cannot be fixed"],"exampleFix":"# before: private-CA upload endpoint, secure verify fails\nnetbird debug bundle --upload --url https://collector.internal/debug\n# -> upload failed: tls: failed to verify certificate\n\n# after: trust the internal endpoint explicitly\nnetbird debug bundle --upload --url https://collector.internal/debug --upload-insecure","handlingStrategy":"validation","validationCode":"// Probe the upload endpoint before asking the daemon to upload:\nu, err := url.Parse(uploadURL)\nif err != nil || (u.Scheme != \"https\" && u.Scheme != \"http\") {\n    return fmt.Errorf(\"invalid upload URL\")\n}\nif _, err := http.Head(uploadURL); err != nil && !isHTTPOK(err) {\n    // connectivity/TLS problem: fix before running with --upload\n}","typeGuard":"// Distinguish the three failure families from the reason string:\nfunc classifyUploadFailure(reason string) string {\n    switch {\n    case strings.Contains(reason, \"tls:\"):\n        return \"certificate\"\n    case strings.Contains(reason, \"connection refused\"), strings.Contains(reason, \"no such host\"):\n        return \"connectivity\"\n    default:\n        return \"server\"\n    }\n}","tryCatchPattern":"// Always keep the local bundle even when upload fails:\nif err := runBundle(); err != nil {\n    if strings.HasPrefix(err.Error(), \"upload failed\") {\n        warn(err) // local path was already printed; upload can be retried manually\n        return nil\n    }\n    return err\n}","preventionTips":["curl-test the upload URL from the same host before enabling --upload","Pass --upload-insecure only for internal endpoints with private CAs, never for public ones","Shrink bundles (fewer log files) when a size-limited proxy sits in front of the collector"],"tags":["debug","upload","network","tls","cli","support"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}