{"record":{"id":"fd582299c0c58cbc","repo":"netbirdio/netbird","slug":"startup-check-management-not-connected","errorCode":null,"errorMessage":"startup check: management not connected","messagePattern":"startup check: management not connected","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/cmd/status.go","lineNumber":297,"sourceCode":"\tdaemonStatus := internal.StatusType(resp.GetStatus())\n\tswitch daemonStatus {\n\tcase internal.StatusIdle, internal.StatusConnecting, internal.StatusConnected:\n\t\treturn nil\n\tcase internal.StatusNeedsLogin, internal.StatusLoginFailed, internal.StatusSessionExpired:\n\t\treturn fmt.Errorf(\"readiness check: daemon status is %s\", daemonStatus)\n\tdefault:\n\t\treturn fmt.Errorf(\"readiness check: unexpected daemon status %q\", daemonStatus)\n\t}\n}\n\nfunc checkStartup(resp *proto.StatusResponse) error {\n\tfullStatus := resp.GetFullStatus()\n\tif fullStatus == nil {\n\t\treturn fmt.Errorf(\"startup check: no full status available\")\n\t}\n\n\tif !fullStatus.GetManagementState().GetConnected() {\n\t\treturn fmt.Errorf(\"startup check: management not connected\")\n\t}\n\n\tif !fullStatus.GetSignalState().GetConnected() {\n\t\treturn fmt.Errorf(\"startup check: signal not connected\")\n\t}\n\n\tvar relayCount, relaysConnected int\n\tfor _, r := range fullStatus.GetRelays() {\n\t\turi := r.GetURI()\n\t\tif !strings.HasPrefix(uri, \"rel://\") && !strings.HasPrefix(uri, \"rels://\") {\n\t\t\tcontinue\n\t\t}\n\t\trelayCount++\n\t\tif r.GetAvailable() {\n\t\t\trelaysConnected++\n\t\t}\n\t}\n","sourceCodeStart":279,"sourceCodeEnd":315,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/cmd/status.go#L279-L315","documentation":"Thrown by checkStartup (client/cmd/status.go:297). The FullStatus snapshot is present, but fullStatus.GetManagementState().GetConnected() is false: the agent's connection to the management service (control plane) is down or still being established. Without management the agent cannot receive network maps, so startup cannot be declared complete.","triggerScenarios":"'netbird status --check startup' while the daemon's gRPC channel to the management URL is connecting, broken, or repeatedly failing: management URL unreachable, DNS failure for the management host, TLS/mTLS failure, management service restarting, or IdP outage during the connect flow.","commonSituations":"On-prem management down or behind a firewall that drops 443; misconfigured --management-url; self-signed cert not trusted by the agent; DNS resolver broken on the host (agent rewrote resolv.conf previously and did not restore it).","solutions":["Run 'netbird status -d' (or check daemon logs) for the exact management connect error","Verify the management URL resolves and is reachable: curl -v https://<management-host>","Fix host DNS / firewall egress to the management port, then retry the check (the daemon reconnects on its own)","If TLS is the cause, trust the CA on the host or fix the certificate the management serves"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// preflight the management endpoint before expecting startup to pass\nu, err := url.Parse(config.ManagementURL.String())\nif err == nil {\n    if _, derr := net.DialTimeout(\"tcp\", u.Host, 3*time.Second); derr != nil {\n        log.Warnf(\"management %s unreachable before startup check\", u.Host)\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pin management connectivity (DNS, 443 egress, TLS trust) before deploying agents","Retry startup checks with a deadline; management connect is normally transient during boot","Watch 'netbird status -d' for the underlying management error instead of guessing"],"tags":["cli","management","startup","network","netbird"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}