Preflight checks

Every check BeziSync runs on connections, runtimes and deployments. Generated from the source by bezisync check-docs — do not edit by hand. In the UI each check links here.

#PostgreSQL

#`pg_capacity`

Replication capacity

Fix:

-- drop slots nobody uses:
SELECT slot_name, active FROM pg_replication_slots;
-- or raise the limits (restart required):
ALTER SYSTEM SET max_replication_slots = 20;
ALTER SYSTEM SET max_wal_senders = 20;

#`pg_create`

Manage publications

Fix:

GRANT CREATE ON DATABASE {db} TO {user};

#`pg_failover`

Failover safety

#`pg_login`

Sign in

Fix:

# pg_hba.conf
hostssl {database} {user} <runtime-cidr> scram-sha-256
hostssl replication  <runtime-cidr> scram-sha-256

#`pg_network_blocked`

Reach the database

Why: The address is loopback, link-local or a cloud metadata endpoint, which BeziSync never contacts unless an admin allows it (BEZISYNC_SSRF_ALLOW_CIDRS).

#`pg_network_reachable`

Reach the database

Why: The host answered on the port.

#`pg_network_unreachable`

Reach the database

Why: No TCP connection: allow the port from where connectors run (firewall, security group, peering).

#`pg_replication_role`

Replication permission

#`pg_ssh`

SSH tunnel

Why: A connection through a bastion needs the SSH user and private key.

#`pg_ssh_blocked`

Reach the SSH bastion

Why: The address is loopback, link-local or a cloud metadata endpoint, which BeziSync never contacts unless an admin allows it (BEZISYNC_SSRF_ALLOW_CIDRS).

#`pg_ssh_reachable`

Reach the SSH bastion

Why: The host answered on the port.

#`pg_ssh_tunnel`

SSH tunnel

Why: Connectors reach the database through this bastion, exactly like this check.
Why: Fails when the bastion refuses the key, its host key does not match the pinned one, or it cannot reach the database (AllowTcpForwarding must be on).
Why: Warns while the bastion's host key is not pinned: pin it (ssh-keyscan) so nobody can impersonate the bastion.

#`pg_ssh_unreachable`

Reach the SSH bastion

Why: No TCP connection: allow the port from where connectors run (firewall, security group, peering).

#`pg_tables`

Selected tables

#`pg_tables_exist`

Selected tables exist

#`pg_tables_identity`

Replica identity

#`pg_tables_keys`

Row keys

#`pg_tables_owner`

Publication ownership

Fix:

CREATE PUBLICATION <pipeline-publication> FOR TABLE ;

#`pg_tables_select`

Read access

Why: The initial snapshot reads existing rows with SELECT.

#`pg_tls`

TLS

Why: Check the TLS mode and CA certificate for this database.

#`pg_version`

PostgreSQL version

#`pg_wal_level`

Logical replication

Why: Debezium reads changes from the database log. The setting needs a restart, so plan it.

#`pg_wal_retention`

WAL retention limit

Why: A stopped pipeline's slot can fill the disk. BeziSync alerts on retained WAL; a cap protects the database but invalidates the slot (re-snapshot needed) when reached.

Fix:

ALTER SYSTEM SET max_slot_wal_keep_size = '50GB';
SELECT pg_reload_conf();

#MySQL / MariaDB

#`mysql_binlog`

Binary log

Fix:

# my.cnf
[mysqld]
log_bin = mysql-bin
server_id = 1
binlog_format = ROW

#`mysql_binlog_format`

Row-based binlog

#`mysql_grants`

Permissions

Fix:

GRANT {REQUIRED_PRIVILEGES} ON *.* TO '{user}'@'%';
GRANT ALL ON {MANAGED_DB}.* TO '{user}'@'%';

#`mysql_gtid`

Failover safety

Fix:

SET GLOBAL enforce_gtid_consistency = ON;
SET GLOBAL gtid_mode = OFF_PERMISSIVE;
SET GLOBAL gtid_mode = ON_PERMISSIVE;
SET GLOBAL gtid_mode = ON;

#`mysql_login`

Sign in

#`mysql_network_blocked`

Reach the database

Why: The address is loopback, link-local or a cloud metadata endpoint, which BeziSync never contacts unless an admin allows it (BEZISYNC_SSRF_ALLOW_CIDRS).

#`mysql_network_reachable`

Reach the database

Why: The host answered on the port.

#`mysql_network_unreachable`

Reach the database

Why: No TCP connection: allow the port from where connectors run (firewall, security group, peering).

#`mysql_retention`

Binlog retention

Fix:

SET GLOBAL binlog_expire_logs_seconds = 604800;  -- 7 days

Fix:

CALL mysql.rds_set_configuration('binlog retention hours', 72);

#`mysql_row_image`

Full row images

Fix:

SET GLOBAL binlog_row_image = 'FULL';

#`mysql_ssh`

SSH tunnel

Why: A connection through a bastion needs the SSH user and private key.

#`mysql_ssh_blocked`

Reach the SSH bastion

Why: The address is loopback, link-local or a cloud metadata endpoint, which BeziSync never contacts unless an admin allows it (BEZISYNC_SSRF_ALLOW_CIDRS).

#`mysql_ssh_reachable`

Reach the SSH bastion

Why: The host answered on the port.

#`mysql_ssh_tunnel`

SSH tunnel

Why: Connectors reach the database through this bastion, exactly like this check.
Why: Fails when the bastion refuses the key, its host key does not match the pinned one, or it cannot reach the database (AllowTcpForwarding must be on).
Why: Warns while the bastion's host key is not pinned: pin it (ssh-keyscan) so nobody can impersonate the bastion.

#`mysql_ssh_unreachable`

Reach the SSH bastion

Why: No TCP connection: allow the port from where connectors run (firewall, security group, peering).

#`mysql_tables`

Selected tables

#`mysql_tables_exist`

Selected tables exist

#`mysql_tables_keys`

Row keys

#`mysql_version`

Server version

#SQL Server

#`mssql_agent`

SQL Server Agent

Fix:

Start the SQL Server Agent service (and set it to start automatically).

#`mssql_cdc_db`

Change data capture

Why: Debezium reads SQL Server's CDC change tables.

#`mssql_login`

Sign in

#`mssql_network_blocked`

Reach the database

Why: The address is loopback, link-local or a cloud metadata endpoint, which BeziSync never contacts unless an admin allows it (BEZISYNC_SSRF_ALLOW_CIDRS).

#`mssql_network_reachable`

Reach the database

Why: The host answered on the port.

#`mssql_network_unreachable`

Reach the database

Why: No TCP connection: allow the port from where connectors run (firewall, security group, peering).

#`mssql_permissions`

Permissions

Fix:

ALTER ROLE db_owner ADD MEMBER {user};

#`mssql_ssh`

SSH tunnel

Why: A connection through a bastion needs the SSH user and private key.

#`mssql_ssh_blocked`

Reach the SSH bastion

Why: The address is loopback, link-local or a cloud metadata endpoint, which BeziSync never contacts unless an admin allows it (BEZISYNC_SSRF_ALLOW_CIDRS).

#`mssql_ssh_reachable`

Reach the SSH bastion

Why: The host answered on the port.

#`mssql_ssh_tunnel`

SSH tunnel

Why: Connectors reach the database through this bastion, exactly like this check.
Why: Fails when the bastion refuses the key, its host key does not match the pinned one, or it cannot reach the database (AllowTcpForwarding must be on).
Why: Warns while the bastion's host key is not pinned: pin it (ssh-keyscan) so nobody can impersonate the bastion.

#`mssql_ssh_unreachable`

Reach the SSH bastion

Why: No TCP connection: allow the port from where connectors run (firewall, security group, peering).

#`mssql_tables`

Selected tables

#`mssql_tables_cdc`

CDC on tables

#`mssql_tables_exist`

Selected tables exist

#`mssql_tables_keys`

Row keys

#MongoDB

#`mongo_change_stream`

Read change streams

Fix:

db.grantRolesToUser('<user>', [{ role: 'read', db: '<database>' }, { role: 'readAnyDatabase', db: 'admin' }])

#`mongo_collections_exist`

Selected collections exist

#`mongo_connect`

Connect

Why: For replica sets, every member's advertised hostname must resolve from the runtime.

#`mongo_login`

Sign in

#`mongo_network_blocked`

Reach MongoDB

Why: The address is loopback, link-local or a cloud metadata endpoint, which BeziSync never contacts unless an admin allows it (BEZISYNC_SSRF_ALLOW_CIDRS).

#`mongo_network_reachable`

Reach MongoDB

Why: The host answered on the port.

#`mongo_network_unreachable`

Reach MongoDB

Why: No TCP connection: allow the port from where connectors run (firewall, security group, peering).

#`mongo_topology`

Change streams available

Fix:

mongod --replSet rs0 …
mongosh --eval 'rs.initiate()'

#`mongo_version`

MongoDB version

#Oracle

#`ora_archive_retention`

Archived log retention

Why: A pipeline that stops for longer than the archived logs reach back loses changes. Keep at least a day (RMAN deletion policy, recovery area size; on RDS 'archivelog retention hours').

Fix:

BEGIN rdsadmin.rdsadmin_util.set_configuration('archivelog retention hours', 24); END;
/

#`ora_archivelog`

Archive log mode

Why: LogMiner reads archived redo logs; without ARCHIVELOG, redo is overwritten before Debezium reads it. Switching modes restarts the database.
Why: Amazon RDS and OCI Base Database run in ARCHIVELOG mode while automated backups are on.

Fix:

SHUTDOWN IMMEDIATE;
STARTUP MOUNT;
ALTER DATABASE ARCHIVELOG;
ALTER DATABASE OPEN;
ALTER PLUGGABLE DATABASE ALL OPEN;   -- multitenant databases only

Fix:

aws rds modify-db-instance --db-instance-identifier <your-instance> --backup-retention-period 7 --apply-immediately

#`ora_login`

Sign in

Why: Debezium signs in to the database's own service (the CDB root of a multitenant database).
Why: ORA-01017: wrong user name or password; ORA-28000: the account is locked; ORA-12514: the listener doesn't know the service name.

Fix:

ALTER USER {user} ACCOUNT UNLOCK;

Fix:

lsnrctl services   # lists the service names this listener serves

#`ora_managed_tables`

BeziSync tables

Why: Snapshots on demand go through BZ_SIGNAL_ (and the delivery canary through BZ_CANARY_) in the connector user's schema: the user needs a quota on its default tablespace.

Fix:

ALTER USER {user} QUOTA 100M ON {tablespace};

#`ora_network_blocked`

Reach the database

Why: The address is loopback, link-local or a cloud metadata endpoint, which BeziSync never contacts unless an admin allows it (BEZISYNC_SSRF_ALLOW_CIDRS).

#`ora_network_reachable`

Reach the database

Why: The host answered on the port.

#`ora_network_unreachable`

Reach the database

Why: No TCP connection: allow the port from where connectors run (firewall, security group, peering).

#`ora_pdb`

Pluggable database

Why: BeziSync reads the tables through the PDB's service; it must open the PDB named in the connection.
Why: Set the PDB service name (Expert) when it differs from the PDB's name.

#`ora_privileges`

Permissions

Why: Debezium reads the redo log with LogMiner and existing rows with flashback queries: the user needs CREATE SESSION, SET CONTAINER (multitenant), FLASHBACK ANY TABLE, SELECT ANY TABLE, SELECT ANY TRANSACTION, LOGMINING, CREATE TABLE, LOCK ANY TABLE, CREATE SEQUENCE, SELECT_CATALOG_ROLE, EXECUTE_CATALOG_ROLE, SELECT on the V_$ views LogMiner reads and EXECUTE on DBMS_LOGMNR and DBMS_LOGMNR_D.
Why: On Amazon RDS, SYS objects are granted with rdsadmin.rdsadmin_util.grant_sys_object.

Fix:

GRANT CREATE SESSION, SET CONTAINER, FLASHBACK ANY TABLE, SELECT ANY TABLE, SELECT ANY TRANSACTION, LOGMINING, CREATE TABLE, LOCK ANY TABLE, CREATE SEQUENCE, SELECT_CATALOG_ROLE, EXECUTE_CATALOG_ROLE TO {user} CONTAINER=ALL;
GRANT SELECT ON V_$DATABASE TO {user} CONTAINER=ALL;   -- and the other V_$ views
GRANT EXECUTE ON DBMS_LOGMNR TO {user} CONTAINER=ALL;
GRANT EXECUTE ON DBMS_LOGMNR_D TO {user} CONTAINER=ALL;

Fix:

BEGIN rdsadmin.rdsadmin_util.grant_sys_object('V_$DATABASE', '{user}', 'SELECT'); END;
/

#`ora_redo`

Redo logs

Why: Each log switch makes LogMiner rebuild its session; Debezium recommends at least 3 redo log groups and about 4 switches an hour.

Fix:

ALTER DATABASE ADD LOGFILE GROUP <n> SIZE 1G;

#`ora_ssh`

SSH tunnel

Why: A connection through a bastion needs the SSH user and private key.

#`ora_ssh_blocked`

Reach the SSH bastion

Why: The address is loopback, link-local or a cloud metadata endpoint, which BeziSync never contacts unless an admin allows it (BEZISYNC_SSRF_ALLOW_CIDRS).

#`ora_ssh_reachable`

Reach the SSH bastion

Why: The host answered on the port.

#`ora_ssh_tunnel`

SSH tunnel

Why: Connectors reach the database through this bastion, exactly like this check.
Why: Fails when the bastion refuses the key, its host key does not match the pinned one, or it cannot reach the database (AllowTcpForwarding must be on).
Why: Warns while the bastion's host key is not pinned: pin it (ssh-keyscan) so nobody can impersonate the bastion.

#`ora_ssh_unreachable`

Reach the SSH bastion

Why: No TCP connection: allow the port from where connectors run (firewall, security group, peering).

#`ora_supplemental`

Supplemental logging

Why: The redo log must record enough to rebuild changed rows: at least minimal supplemental logging on the database.

Fix:

ALTER DATABASE ADD SUPPLEMENTAL LOG DATA;

Fix:

BEGIN rdsadmin.rdsadmin_util.alter_supplemental_logging(p_action => 'ADD'); END;
/

#`ora_tables`

Selected tables

Why: The selected tables exist and log all columns.

#`ora_tables_exist`

Selected tables exist

Why: Every selected table must exist and be readable by the connector user.

#`ora_tables_keys`

Row keys

Why: Without a primary key, events carry no key, so consumers cannot tell which row an update or delete belongs to; re-copies use ROWID.

#`ora_tables_logging`

Table logging

Why: Debezium needs supplemental logging of all columns on every captured table (or on the whole database) to rebuild updates.

Fix:

ALTER TABLE "{schema}"."{table}" ADD SUPPLEMENTAL LOG DATA (ALL) COLUMNS;

#`ora_undo`

Undo retention

Why: The first copy reads every table AS OF one SCN; when the undo it needs is gone it fails with ORA-01555 (snapshot too old).

Fix:

ALTER SYSTEM SET UNDO_RETENTION = <seconds>;

#`ora_version`

Oracle version

Why: Debezium 3 supports Oracle 19c and newer.

#CockroachDB

#`crdb_create`

BeziSync tables

Why: Snapshots on demand go through bezisync.signal_ (and the delivery canary through bezisync.canary_): the user needs to create the bezisync schema, or rights on it.

Fix:

CREATE SCHEMA IF NOT EXISTS {database}.bezisync;
GRANT ALL ON SCHEMA {database}.bezisync TO {user};

#`crdb_gc_ttl`

Garbage collection window

Why: A changefeed resumes only within the tables' gc.ttlseconds: a pipeline stopped for longer must copy its tables again. Warns under an hour, or when the zone configuration can't be read.

Fix:

ALTER TABLE {table} CONFIGURE ZONE USING gc.ttlseconds = 14400;

#`crdb_login`

Sign in

Why: Debezium signs in with the same user and password; a cluster without passwords accepts the user as it is.

#`crdb_network_blocked`

Reach the cluster

Why: The address is loopback, link-local or a cloud metadata endpoint, which BeziSync never contacts unless an admin allows it (BEZISYNC_SSRF_ALLOW_CIDRS).

#`crdb_network_reachable`

Reach the cluster

Why: The host answered on the port.

#`crdb_network_unreachable`

Reach the cluster

Why: No TCP connection: allow the port from where connectors run (firewall, security group, peering).

#`crdb_rangefeed`

Rangefeeds

Why: Changefeeds need the cluster setting kv.rangefeed.enabled. Reading it needs VIEWCLUSTERSETTING; without it the check can't confirm it is on.

Fix:

SET CLUSTER SETTING kv.rangefeed.enabled = true;

Fix:

GRANT SYSTEM VIEWCLUSTERSETTING TO {user};

#`crdb_ssh`

SSH tunnel

Why: A connection through a bastion needs the SSH user and private key.

#`crdb_ssh_blocked`

Reach the SSH bastion

Why: The address is loopback, link-local or a cloud metadata endpoint, which BeziSync never contacts unless an admin allows it (BEZISYNC_SSRF_ALLOW_CIDRS).

#`crdb_ssh_reachable`

Reach the SSH bastion

Why: The host answered on the port.

#`crdb_ssh_tunnel`

SSH tunnel

Why: Connectors reach the database through this bastion, exactly like this check.
Why: Fails when the bastion refuses the key, its host key does not match the pinned one, or it cannot reach the database (AllowTcpForwarding must be on).
Why: Warns while the bastion's host key is not pinned: pin it (ssh-keyscan) so nobody can impersonate the bastion.

#`crdb_ssh_unreachable`

Reach the SSH bastion

Why: No TCP connection: allow the port from where connectors run (firewall, security group, peering).

#`crdb_tables`

Selected tables

Why: The selected tables exist and the user may stream and read them.

#`crdb_tables_changefeed`

Changefeed permission

Why: Debezium opens a changefeed on the selected tables: the user needs CHANGEFEED on each (or ALL, or admin).

Fix:

GRANT CHANGEFEED ON TABLE {tables} TO {user};

#`crdb_tables_exist`

Selected tables exist

Why: Every selected table must exist in the database.

#`crdb_tables_select`

Read access

Why: The first copy and re-copies read the existing rows.

Fix:

GRANT SELECT ON TABLE {tables} TO {user};

#`crdb_tls`

TLS

Why: Secure clusters need TLS (require or stricter); CockroachDB Cloud also needs its CA certificate for verify-full.

#`crdb_version`

CockroachDB version

Why: The CHANGEFEED privilege Debezium relies on needs CockroachDB v22.2 or newer.

#Vitess

#`vt_binlog_retention`

Binlog retention

Why: How long the tablets keep their binlogs is not visible through VTGate: a pipeline stopped for longer must copy its tables again. Keep at least a day on every tablet's MySQL.

Fix:

SET PERSIST binlog_expire_logs_seconds = 86400;

#`vt_grpc_blocked`

Reach VTGate's gRPC port

Why: The address is loopback, link-local or a cloud metadata endpoint, which BeziSync never contacts unless an admin allows it (BEZISYNC_SSRF_ALLOW_CIDRS).

#`vt_grpc_reachable`

Reach VTGate's gRPC port

Why: The host answered on the port.

#`vt_grpc_unreachable`

Reach VTGate's gRPC port

Why: No TCP connection: allow the port from where connectors run (firewall, security group, peering).

#`vt_keyspace`

Keyspace

Why: A Vitess connection captures one keyspace, across all its shards.

#`vt_login`

Sign in

Why: BeziSync reads tables through VTGate's MySQL port with the connection's user (VTGate's static authentication); Debezium streams over its gRPC port.

#`vt_mysql_blocked`

Reach VTGate's MySQL port

Why: The address is loopback, link-local or a cloud metadata endpoint, which BeziSync never contacts unless an admin allows it (BEZISYNC_SSRF_ALLOW_CIDRS).

#`vt_mysql_reachable`

Reach VTGate's MySQL port

Why: The host answered on the port.

#`vt_mysql_unreachable`

Reach VTGate's MySQL port

Why: No TCP connection: allow the port from where connectors run (firewall, security group, peering).

#`vt_ssh`

SSH tunnel

Why: A connection through a bastion needs the SSH user and private key.

#`vt_ssh_blocked`

Reach the SSH bastion

Why: The address is loopback, link-local or a cloud metadata endpoint, which BeziSync never contacts unless an admin allows it (BEZISYNC_SSRF_ALLOW_CIDRS).

#`vt_ssh_reachable`

Reach the SSH bastion

Why: The host answered on the port.

#`vt_ssh_tunnel`

SSH tunnel

Why: Connectors reach the database through this bastion, exactly like this check.
Why: Fails when the bastion refuses the key, its host key does not match the pinned one, or it cannot reach the database (AllowTcpForwarding must be on).
Why: Warns while the bastion's host key is not pinned: pin it (ssh-keyscan) so nobody can impersonate the bastion.

#`vt_ssh_unreachable`

Reach the SSH bastion

Why: No TCP connection: allow the port from where connectors run (firewall, security group, peering).

#`vt_tables`

Selected tables

Why: The selected tables exist in the keyspace.

#`vt_tables_exist`

Selected tables exist

Why: Every selected table must exist in the keyspace.

#`vt_tables_keyspace`

One keyspace

Why: Every selected table must be in the connection's keyspace.

#`vt_tablets`

Tablets

Why: VStream reads every shard from a serving tablet of the chosen type (primary, replica or read-only).

#`vt_version`

VTGate

Why: The connection must point at VTGate; a plain MySQL server needs a MySQL / MariaDB connection.

#Google Cloud Spanner

#`sp_capture_type`

Captured values

Why: With OLD_AND_NEW_VALUES or NEW_VALUES, update events carry only the columns that changed: destinations that replace rows lose the others.

Fix:

ALTER CHANGE STREAM {name} SET OPTIONS (value_capture_type = 'NEW_ROW_AND_OLD_VALUES');

#`sp_change_stream`

Change stream

Why: The connector reads a change stream. BeziSync creates one per pipeline (bz_, watching the pipeline's tables without its removed columns) when the service account may change the schema (roles/spanner.databaseAdmin); otherwise create one yourself and use it.

Fix:

CREATE CHANGE STREAM {name} FOR ALL OPTIONS (retention_period = '7d', value_capture_type = 'NEW_ROW_AND_OLD_VALUES');

Fix:

ALTER CHANGE STREAM {name} SET FOR {tables};

Fix:

gcloud spanner databases add-iam-policy-binding {database} --instance={instance} --project={project} \
  --member=serviceAccount:<service-account-email> --role=roles/spanner.databaseAdmin

#`sp_coordination`

Coordination Kafka

Why: Debezium's Spanner connector keeps its partition state in two Kafka topics of its own (sync_topic_spanner_connector, rebalancing_topic_spanner_connector), even in Debezium Server. BeziSync checks it like a Kafka destination and removes the topics with the pipeline.

#`sp_credentials`

Credentials

Why: Without a service-account key, BeziSync and the connector use the default credentials where they run: on GKE with Workload Identity, the runtime's service account.

#`sp_database`

Database

Why: BeziSync reads the database's schema with the connection's credentials; the connector needs the same access (roles/spanner.databaseReader).

Fix:

gcloud spanner databases add-iam-policy-binding {database} --instance={instance} --project={project} \
  --member=serviceAccount:<service-account-email> --role=roles/spanner.databaseReader

#`sp_dialect`

SQL dialect

Why: Debezium's Spanner connector supports GoogleSQL databases only, not the PostgreSQL dialect.

#`sp_emulator`

Emulator

Why: The emulator address is host:port (its gRPC port, 9010 by default).

#`sp_emulator_blocked`

Reach the Spanner emulator

Why: The address is loopback, link-local or a cloud metadata endpoint, which BeziSync never contacts unless an admin allows it (BEZISYNC_SSRF_ALLOW_CIDRS).

#`sp_emulator_reachable`

Reach the Spanner emulator

Why: The host answered on the port.

#`sp_emulator_unreachable`

Reach the Spanner emulator

Why: No TCP connection: allow the port from where connectors run (firewall, security group, peering).

#`sp_retention`

Change stream retention

Why: A stopped pipeline can resume only within the change stream's retention_period (BeziSync's streams keep 7 days; up to 30 are possible).

#`sp_tables_exist`

Selected tables exist

Why: Every selected table must exist in the database's default schema.

#Kafka

#`kafka_auth`

Sign in

#`kafka_bootstrap`

Broker list

#`kafka_create_topics`

Create topics

Why: Turn off 'Create topics automatically' if topics are provisioned another way.

Fix:

kafka-acls --bootstrap-server <broker> --add --allow-principal User: --operation Create --operation Write --operation Describe --topic '*' --resource-pattern-type literal

#`kafka_metadata`

Talk to Kafka

Why: An open port is not enough: the connector must authenticate and fetch metadata.

Fix:

Check security protocol (PLAINTEXT vs SASL_SSL) and that advertised.listeners resolve from the runtime.

#`kafka_network`

Reach brokers

#`kafka_network_blocked`

Reach {b}:{b}

Why: The address is loopback, link-local or a cloud metadata endpoint, which BeziSync never contacts unless an admin allows it (BEZISYNC_SSRF_ALLOW_CIDRS).

#`kafka_network_reachable`

Reach {b}:{b}

Why: The host answered on the port.

#`kafka_network_unreachable`

Reach {b}:{b}

Why: No TCP connection: allow the port from where connectors run (firewall, security group, peering).

#`kafka_replication`

Replication factor

#HTTP

#`http_network_blocked`

Reach the endpoint

Why: The address is loopback, link-local or a cloud metadata endpoint, which BeziSync never contacts unless an admin allows it (BEZISYNC_SSRF_ALLOW_CIDRS).

#`http_network_reachable`

Reach the endpoint

Why: The host answered on the port.

#`http_network_unreachable`

Reach the endpoint

Why: No TCP connection: allow the port from where connectors run (firewall, security group, peering).

#`http_status`

Endpoint answers

#Google Pub/Sub

#`pubsub_auth`

Sign in

Fix:

gcloud projects add-iam-policy-binding {project_id} --member=serviceAccount:<sa-email> --role=roles/pubsub.editor

#AWS Kinesis

#`kinesis_auth`

Sign in

Fix:

Allow kinesis:ListStreams, kinesis:DescribeStreamSummary, kinesis:CreateStream, kinesis:PutRecord, kinesis:PutRecords for the BeziSync and runtime principals.

#`kinesis_connect`

Reach Kinesis

#Redis Streams

#`redis_auth`

Sign in

#`redis_connect`

Talk to Redis

#`redis_memory`

Memory headroom

Why: Set a stream length limit or add memory.

#`redis_network_blocked`

Reach Redis

Why: The address is loopback, link-local or a cloud metadata endpoint, which BeziSync never contacts unless an admin allows it (BEZISYNC_SSRF_ALLOW_CIDRS).

#`redis_network_reachable`

Reach Redis

Why: The host answered on the port.

#`redis_network_unreachable`

Reach Redis

Why: No TCP connection: allow the port from where connectors run (firewall, security group, peering).

#`redis_write`

Write streams

#NATS JetStream

#`nats_jetstream`

JetStream available

#`nats_network_blocked`

Reach NATS

Why: The address is loopback, link-local or a cloud metadata endpoint, which BeziSync never contacts unless an admin allows it (BEZISYNC_SSRF_ALLOW_CIDRS).

#`nats_network_reachable`

Reach NATS

Why: The host answered on the port.

#`nats_network_unreachable`

Reach NATS

Why: No TCP connection: allow the port from where connectors run (firewall, security group, peering).

#Apache Iceberg

#`iceberg_auth`

Sign in

Why: The catalog refused the credentials or the request signature.

Fix:

Give the credentials permission to list and create namespaces, and to create, load and commit tables.

#`iceberg_catalog`

Catalog

Why: BeziSync signs in to the catalog and lists namespaces, as the connector will.

#`iceberg_catalog_blocked`

Reach the catalog

Why: Connection checks may not contact loopback, link-local or cloud metadata addresses.

#`iceberg_catalog_unreachable`

Reach the catalog

Why: Connectors run where the runtime runs; if BeziSync cannot reach the catalog, neither can they.

Fix:

Allow HTTPS from the runtime to the catalog (firewall, security group, private endpoint).

#`iceberg_config`

Settings

Why: A choice in the connection needs another field (the catalog URL, OAuth2 client, token, region or secret key).

#`iceberg_existing_tables`

Existing tables

Why: The pipeline writes into tables that already exist, keeping their partitioning; without identifier fields they get changes appended.

Fix:

ALTER TABLE … SET IDENTIFIER FIELDS <key columns> (Spark), or drop the table so the pipeline creates it.

#`iceberg_namespace`

Namespace

Why: Tables are created in the connection's namespace; BeziSync creates it on deploy when missing.

#`iceberg_no_key`

Row identity

Why: Upserts need a key; a table without one gets every change appended.

Fix:

Choose key columns for them in the Transform step (Message key).

#`iceberg_partitioning`

Partitioning

Why: New tables are bucketed by their key column, recorded by the wizard from discovery.

Fix:

Open the Destination step and continue: BeziSync records each table's key again.

#`iceberg_rustfs_upsert`

Rows

Why: RustFS S3 Tables (preview) refuses a row-level commit on a table without an earlier snapshot, which every upsert pipeline's first commit is.

Fix:

Choose "Every change appended" in the Destination step.

#`iceberg_write`

Write a test table

Why: The connector creates tables and writes Parquet files with these credentials: BeziSync creates a one-row table, reads it back and drops it.

#Database (JDBC)

#`jdbc_config`

Settings

Why: Database and schema names go into a JDBC URL and SQL: letters, digits, _, - and $ only.

#`jdbc_create_table`

Create tables

Why: Pipelines that create their tables (the default) need it; BeziSync creates and drops a test table.

Fix:

GRANT USAGE, CREATE ON SCHEMA {schema} TO {user};

#`jdbc_login`

Sign in

Why: The connector signs in with the same user and TLS setting.

Fix:

GRANT USAGE, CREATE ON SCHEMA {schema} TO {user};

#`jdbc_name_length`

Table names

Why: PostgreSQL allows 63 characters, MySQL and MariaDB 64, SQL Server 128.

Fix:

Shorten the destination naming in the Destination step.

#`jdbc_network_blocked`

Reach the database

Why: Connection checks may not contact loopback, link-local or cloud metadata addresses.

#`jdbc_network_reachable`

Reach the database

Why: The host answered on the port.

#`jdbc_network_unreachable`

Reach the database

Why: No TCP connection: allow the port from where connectors run (firewall, security group, peering).

#`jdbc_no_key`

Row keys

Why: Upserts and deletes find rows by the record key; without one the connector stops.

Fix:

Choose key columns for them in the Transform step (Message key), or insert only in the Destination step.

#Amazon SQS

#`sqs_auth`

Sign in

Why: AWS rejected the request, or the queue does not exist.

Fix:

Allow sqs:GetQueueAttributes, sqs:SendMessage and sqs:ReceiveMessage on the queue for the BeziSync and runtime principals.

#`sqs_connect`

Reach SQS

Why: The SQS endpoint did not answer.

#`sqs_fifo_dedup`

FIFO deduplication

Why: Debezium sends no deduplication ID, so a FIFO queue must deduplicate by content.

Fix:

aws sqs set-queue-attributes --queue-url <url> --attributes ContentBasedDeduplication=true

#`sqs_preview`

Events tab

Why: Peeking counts as a receive; with a low dead-letter redrive count BeziSync does not peek.

#`sqs_queue`

Queue

Why: BeziSync reads the queue's attributes, as the connector sends to it.

#Amazon SNS

#`sns_auth`

Sign in

Why: AWS rejected the request.

Fix:

Allow sns:ListTopics, sns:CreateTopic, sns:GetTopicAttributes, sns:Publish, sns:Subscribe and sns:Unsubscribe on the topics.

#`sns_connect`

Reach SNS

Why: The SNS endpoint did not answer.

#`sns_preview`

Events tab

Why: SNS keeps nothing to read back: BeziSync subscribes a small queue of its own to each topic for the Events tab and the delivery canary.

Fix:

Allow sqs:CreateQueue, sqs:SetQueueAttributes, sqs:GetQueueAttributes, sqs:ReceiveMessage and sqs:DeleteQueue on bz-preview-* queues.

#Azure Event Hubs

#`eventhubs_auth`

Sign in

Why: The connector sends with this connection string; the hub must exist.

Fix:

Create a shared access policy on the namespace with Send (and Listen for the Events tab), and use its connection string.

#`eventhubs_config`

Settings

Why: The sink adds the hub to the connection string itself, so it must not name one (EntityPath).

#`eventhubs_listen`

Events tab

Why: Reading the hub back (Events tab, delivery canary) needs Listen rights; sending needs only Send.

Fix:

Add a connection string with Listen rights for reading.

#`eventhubs_network_blocked`

Reach Event Hubs

Why: Connection checks may not contact loopback, link-local or cloud metadata addresses.

#`eventhubs_network_reachable`

Reach Event Hubs

Why: The namespace answered on its AMQP port.

#`eventhubs_network_unreachable`

Reach Event Hubs

Why: No TCP connection on port 5671 (AMQP over TLS): allow it from where connectors run.

#Apache Pulsar

#`pulsar_admin`

Admin API

Why: BeziSync checks the namespace, creates topics and reads recent messages through the admin URL.

#`pulsar_auth`

Sign in

Why: Pulsar refused the token.

Fix:

bin/pulsar-admin namespaces grant-permission <tenant>/<namespace> --role <role> --actions produce,consume

#`pulsar_config`

Settings

Why: The connector needs a pulsar:// or pulsar+ssl:// service URL.

#`pulsar_namespace`

Namespace

Why: Topics are created in the connection's tenant and namespace.

Fix:

bin/pulsar-admin namespaces create <tenant>/<namespace>

#`pulsar_network_blocked`

Reach the Pulsar broker

Why: Connection checks may not contact loopback, link-local or cloud metadata addresses.

#`pulsar_network_reachable`

Reach the Pulsar broker

Why: The broker answered on its binary port.

#`pulsar_network_unreachable`

Reach the Pulsar broker

Why: No TCP connection on the service URL's port (6650, 6651 with TLS): allow it from where connectors run.

#Deploy

#`agent_upgrade_required`

Agent version

Why: The destination's own Debezium Server build serves health on another port; older agents probe 8080 and restart the connector.

Fix:

Upgrade the agent to this BeziSync version (Settings → Runtimes shows the install command).

#`checked_from_control_plane`

Checked from BeziSync

#`config_valid`

Configuration

#`debezium_image_deprecated`

Debezium version

Why: Your Admins marked this image deprecated; move to one they offer.

#`debezium_image_unlisted`

Debezium version

Why: Your Admins keep a catalog of tested Debezium Server images; this one is not among them.

#`debezium_source_version`

Debezium version

Why: Some sources need a recent Debezium Server: CockroachDB's sinkless changefeed arrived in Debezium 3.7. Blocks for an older official image; warns for a custom image whose release BeziSync can't read.

Fix:

Move the pipeline to Debezium 3.7.0 or newer (Change → Debezium version).

#`delivery_canary_unavailable`

Delivery canary

#`pii_mask_unsupported`

Personal data

Why: These columns can't be masked, so they would reach the destination as they are: {columns}. Debezium hashes text columns only and sends any other column (a date, a number) as it is; MongoDB values can't be hashed at all.

Fix:

In Tables, choose Remove (or Keep as is) for each listed column.

#`pii_protected`

Personal data

#`pii_rule_column_missing`

Personal data

Why: These columns have a masking rule but are not in their table, so the rule does nothing: {columns}. The column was renamed or dropped after the rule was made; if it was renamed, the new name is sent as it is.

Fix:

In Tables, check the table's columns and choose again.

#`pii_unknown`

Personal data

Why: BeziSync could not read the tables' columns, so it could not check which ones hold personal data.

#`pii_unprotected`

Personal data

Why: These columns look like personal data and are sent as they are: {columns}. Their names suggest personal data (email, phone, address, birth date, card or ID numbers), and nobody chose what to do with them yet.

Fix:

In Tables, choose Mask or Remove for each listed column, or Keep as is when it may be sent.

#`runtime_capacity`

Runtime capacity

Why: The connector may stay pending until resources free up.

#`runtime_disabled`

Runtime {name}

Why: An admin disabled (cordoned) this runtime. Pipelines already running there keep running.

#`runtime_ready`

Runtime {name}

#`sink_image_platform`

Image platform

Why: A connector scheduled on another architecture cannot start (exec format error).

Fix:

Run these connectors where nodes are {platforms} (a runtime namespace pinned to those nodes, or a Docker host of that architecture).

#`sink_resources`

Connector size

Why: Smaller connectors run out of memory while the destination buffers its writes.

Fix:

Choose the {size} size (or larger) in the Review step.

#`tables_added_not_copied`

Added tables

Why: Tables added to a running pipeline are copied with an incremental snapshot; Vitess and Spanner have none, so such tables stream only their new changes.

#`transform_column_missing`

Transforms: columns

Why: {table}, step {n} refers to {column}, which the table does not send (it does not exist or is excluded). A rename then does nothing and a filter rule sees an empty value.

Fix:

Under Transform, pick a column the table has, or remove the step.

#`transform_columns_unknown`

Transforms: columns

Why: Could not read the tables' columns to check the transform steps: {error}

Fix:

Fix the source connection, then run the checks again.

#`transform_custom_class_unknown`

Transforms: custom classes

Why: Debezium Server 3.7 does not ship {class}; the pipeline's image must add it, or the connector stops when it starts.

Fix:

Use a Debezium image that ships the class (Settings → Debezium versions), or remove the step.

#`transform_field_conflict`

Transforms: field names

Why: {table}, step {n}: two fields would get one name. Debezium Server stops with "Cannot create field because of field name duplication" (an added field or a rename onto a field the event already has, or flattening that produces an existing name).

Fix:

Pick a field name the events do not have yet, under Transform.

#`transform_key_column_missing`

Transforms: message keys

Why: {table} has no column {column}: Debezium ignores it, so the message key falls back to the primary key (or none).

Fix:

Under Transform, choose key columns the table has.

#`transform_rule_type`

Transforms: filter rules

Why: {table}, step {n}: the rule compares {column} ({type}) in a way that never matches (for example a number with text, or a masked column whose value is a hash).

Fix:

Compare the column with a value of its type, or pick another column.

#Secret stores

#`secret_missing`

Saved secrets

Why: The connection was copied from another project without its secrets, and nobody has entered them here yet.

#`secret_ref_unresolved`

Secrets from the secret store

Why: The connection takes a secret from an external store, and reading it failed.

#Project policies

#`policy_custom_transform`

Custom transforms

Why: {steps} run(s) a custom transform class ({names}); this project does not allow custom transforms. Custom classes cannot be previewed or checked by BeziSync, so an Admin decides who may use them.

Fix:

Ask an Admin to change the policy under Settings → Policies.

#`policy_ok`

Project policies

#`policy_resources`

Resources

Why: The '{size}' preset exceeds this project's limit ({max_resources}).

Fix:

Choose {max_resources} or smaller.

#`policy_runtime`

Runtime

Why: This project does not allow pipelines on that runtime.

#`policy_scripted_transform`

Scripted transforms

Why: {steps} run(s) a script you wrote ({names}); this project does not allow scripted transforms. Scripts run inside the connector, next to its database credentials, so an Admin decides who may use them.

Fix:

Ask an Admin to change the policy under Settings → Policies.

#`policy_sink_type`

Destination type

Why: This project does not allow {sink_type} destinations.

#`policy_snapshot_mode`

Snapshot mode

Why: Snapshot mode '{mode}' is not allowed here. Allowed: {allowed_snapshot_modes}.

Fix:

Pick an allowed snapshot mode in the pipeline settings.

#`policy_source_budget`

Pipelines per source

Why: The source already feeds {other_pipelines_on_source} pipeline(s); this project allows {limit}. Each one holds a replication slot or log reader on the database.

Fix:

Reuse an existing pipeline (add tables to it) or ask an admin to raise the limit.

#`policy_source_type`

Source type

Why: This project does not allow {source_type} sources.

#`policy_transform_type`

Transforms

Why: This project does not allow {steps}. Admins choose which transform types pipelines may use.

Fix:

Ask an Admin to change the policy under Settings → Policies.

Preflight checks

#PostgreSQL

#pg_capacity

#pg_create

#pg_failover

#pg_login

#pg_network_blocked

#pg_network_reachable

#pg_network_unreachable

#pg_replication_role

#pg_ssh

#pg_ssh_blocked

#pg_ssh_reachable

#pg_ssh_tunnel

#pg_ssh_unreachable

#pg_tables

#pg_tables_exist

#pg_tables_identity

#pg_tables_keys

#pg_tables_owner

#pg_tables_select

#pg_tls

#pg_version

#pg_wal_level

#pg_wal_retention

#MySQL / MariaDB

#mysql_binlog

#mysql_binlog_format

#mysql_grants

#mysql_gtid

#mysql_login

#mysql_network_blocked

#mysql_network_reachable

#mysql_network_unreachable

#mysql_retention

#mysql_row_image

#mysql_ssh

#mysql_ssh_blocked

#mysql_ssh_reachable

#mysql_ssh_tunnel

#mysql_ssh_unreachable

#mysql_tables

#mysql_tables_exist

#mysql_tables_keys

#mysql_version

#SQL Server

#mssql_agent

#mssql_cdc_db

#mssql_login

#mssql_network_blocked

#mssql_network_reachable

#mssql_network_unreachable

#mssql_permissions

#mssql_ssh

#mssql_ssh_blocked

#mssql_ssh_reachable

#mssql_ssh_tunnel

#mssql_ssh_unreachable

#mssql_tables

#mssql_tables_cdc

#mssql_tables_exist

#mssql_tables_keys

#MongoDB

#mongo_change_stream

#mongo_collections_exist

#mongo_connect

#mongo_login

#mongo_network_blocked

#mongo_network_reachable

#mongo_network_unreachable

#mongo_topology

#mongo_version

#Oracle

#ora_archive_retention

#ora_archivelog

#ora_login

#ora_managed_tables

#ora_network_blocked

#ora_network_reachable

#ora_network_unreachable

#`pg_capacity`

#`pg_create`

#`pg_failover`

#`pg_login`

#`pg_network_blocked`

#`pg_network_reachable`

#`pg_network_unreachable`

#`pg_replication_role`

#`pg_ssh`

#`pg_ssh_blocked`

#`pg_ssh_reachable`

#`pg_ssh_tunnel`

#`pg_ssh_unreachable`

#`pg_tables`

#`pg_tables_exist`

#`pg_tables_identity`

#`pg_tables_keys`

#`pg_tables_owner`

#`pg_tables_select`

#`pg_tls`

#`pg_version`

#`pg_wal_level`

#`pg_wal_retention`

#`mysql_binlog`

#`mysql_binlog_format`

#`mysql_grants`

#`mysql_gtid`

#`mysql_login`

#`mysql_network_blocked`

#`mysql_network_reachable`

#`mysql_network_unreachable`

#`mysql_retention`

#`mysql_row_image`

#`mysql_ssh`

#`mysql_ssh_blocked`

#`mysql_ssh_reachable`

#`mysql_ssh_tunnel`

#`mysql_ssh_unreachable`

#`mysql_tables`

#`mysql_tables_exist`

#`mysql_tables_keys`

#`mysql_version`

#`mssql_agent`

#`mssql_cdc_db`

#`mssql_login`

#`mssql_network_blocked`

#`mssql_network_reachable`

#`mssql_network_unreachable`

#`mssql_permissions`

#`mssql_ssh`

#`mssql_ssh_blocked`

#`mssql_ssh_reachable`

#`mssql_ssh_tunnel`

#`mssql_ssh_unreachable`

#`mssql_tables`

#`mssql_tables_cdc`

#`mssql_tables_exist`

#`mssql_tables_keys`

#`mongo_change_stream`

#`mongo_collections_exist`

#`mongo_connect`

#`mongo_login`

#`mongo_network_blocked`

#`mongo_network_reachable`

#`mongo_network_unreachable`

#`mongo_topology`

#`mongo_version`

#`ora_archive_retention`

#`ora_archivelog`

#`ora_login`

#`ora_managed_tables`

#`ora_network_blocked`

#`ora_network_reachable`

#`ora_network_unreachable`

#`ora_pdb`

#`ora_privileges`

#`ora_redo`

#`ora_ssh`

#`ora_ssh_blocked`

#`ora_ssh_reachable`