Error codes (AFW-###)

Every customer-facing failure carries a stable AFW-### code with its cause and fix attached, so an error points at its resolution instead of a support ticket.

You'll see codes in three places:

• Logs → Collector — the collector diagnostics timeline shows a code chip on each row. Hover it for why it happened and what to do.
• Health (and the Health check section of a collector's detail view) — every failed self-check carries its code. See Monitoring & health.
• Error messages — API errors, User-ID connector logs, and support emails end in [AFW-###].

Codes are grouped by first digit: 1xx collector install/boot · 2xx enforcement · 3xx identity · 4xx licensing · 5xx cloud sync.

1xx — collector boot

Code	Problem	Fix
AFW-111	Data plane not listening. The collector's proxy port isn't accepting connections — the data plane crashed or failed to start.	Collectors → Restart. If it repeats, check docker logs kilasec-collector on the host.
AFW-112	Collector port already in use. Another process on the host holds 8080, 8443 or 9443, so that listener wasn't started. The collector never moves to another port.	Find it with sudo ss -ltnp 'sport = :8443', stop or move it, then Collectors → Restart.
AFW-113	Device port 443 not available. Devices reach the collector on :8443 only (iptables missing, another service on :443, or a docker-compose install).	Free :443 or install iptables and restart; on older installs re-run retrofit-pinning. Otherwise allow TCP 8443. See Firewall & ports.
AFW-120	Collector CA problem. The TLS-inspection CA is missing, unreadable, expired, or expires within 30 days.	Check the collector log for the CA error and that the data directory is writable, then restart the collector. If the tenant CA was rotated, re-enroll the collector.
AFW-130	Collector update reverted. A new build crash-looped after an auto-update and the collector rolled back to the last good version.	Nothing to restore — the collector is healthy on the previous version. Leave it on its current release channel until a fixed build ships.
AFW-140	File-descriptor limit too low. The open-files limit is below 8192; connections will fail with 502s long before CPU runs out.	Raise it to 65536 and restart the collector. Docker Compose: ulimits: nofile: 65536 (shipped in the current compose file). systemd: LimitNOFILE=65536.
AFW-141	Low disk space. Under 1 GB free on the volume backing /var/lib/kilasec; event buffering and log writes will start failing.	Free space on that volume (old logs, unused images: docker system prune).

2xx — enforcement

Code	Problem	Fix
AFW-210	Policy sync refused. The collector rejected a policy or pricing update it pulled and is still enforcing the previous rulebase.	Re-save the rulebase in the console — the editor validates on save. If it persists, the diagnostics timeline names the validation error.
AFW-211	Policy tamper detected. The on-disk policy was changed outside the console; the collector restored the last synced version.	Nothing to restore. Change policy through the console or API only — direct file edits are reverted and flagged.
AFW-220	Collector degraded (pass-through). The collector lost the cloud for longer than the offline grace window, or the plan lapsed. Traffic flows but is not inspected.	Restore outbound HTTPS from the collector to the cloud, or renew the plan. The collector recovers on its next successful sync.
AFW-221	Fail-open episode. An internal error made the collector pass traffic uninspected rather than break the application.	Check the diagnostics timeline for the trigger. If it repeats, contact support — the timeline is attached to the ticket automatically.
AFW-222	Fail-closed episode. An internal error made the collector block traffic it couldn't safely evaluate.	As above; the affected requests were refused.
AFW-223	Collector overloaded (shedding). Request volume is more than this collector can inspect.	Give it more CPU, or add a collector and split traffic. See Sizing & failure modes.
AFW-230	Events dropped. The event buffer overflowed (cloud unreachable or sustained overload).	Restore cloud connectivity or reduce sustained load. Enforcement was unaffected; the dropped window has an audit gap.
AFW-231	Content not fully scanned. A request exceeded the scan budget or couldn't be decoded.	Usually a one-off oversized or encoded body. If it repeats on legitimate traffic, scope that destination out of inspection.

3xx — identity (User-ID)

Code	Problem	Fix
AFW-310	WinRM authentication failed. The domain controller rejected the service account's credentials.	Check the account and password saved under Identity → User-ID, and that the account is in Remote Management Users on the DC.
AFW-311	Access denied reading the Security log. The account authenticated but can't read the Security log over WinRM.	Add the account to Event Log Readers and grant it remote WinRM access with winrm configSDDL default (Read + Execute). Both are required. See User-ID setup.
AFW-312	Can't reach WinRM on the DC. No connection to port 5985/5986.	From the polling host, check the DC resolves and the port is open (firewall rule, Enable-PSRemoting on the DC).
AFW-313	WinRM TLS failed. The HTTPS listener's certificate failed validation (often self-signed).	Install a trusted certificate on the DC's WinRM listener, or set USERID_WINRM_VERIFY=0.

4xx — licensing

Code	Problem	Fix
AFW-410	Subscription lapsed. The grace window has ended; ingest and new enrollments are refused and collectors fall back to pass-through (AFW-220).	Renew under Settings → Plan, or use Request renewal on the plan banner. Collectors recover on their next poll.
AFW-411	Subscription suspended. Service is blocked with no grace window.	Contact ops@kilasec.com.
AFW-420	Collector limit reached. Every collector seat is in use (revoked collectors keep their seat until removed).	Remove an unused collector, start the one-time extension on the Collectors page, or use Request a limit increase in the limit dialog.
AFW-421	Device limit reached. Every device seat is in use. Enrolled devices are never kicked off.	Remove unused devices, wait for stale seats to age out, or raise the limit.

5xx — cloud sync

Code	Problem	Fix
AFW-510	Collector-to-cloud sync failing. Pushes to the cloud are failing and being retried (egress, proxy, or DNS).	Check outbound HTTPS from the collector host to kilasec.com. Events are buffered and deliver when connectivity returns.
AFW-511	Collector token rejected. The cloud refused the collector's token (rotated or revoked). The collector keeps enforcing its last policy but gets no updates.	Re-enroll: get a fresh code from Collectors → Add collector and re-run the installer.
AFW-512	Collector clock skew. The host clock is more than two minutes off the cloud's, which breaks certificate validation and token expiry in ways that look like auth failures.	Enable NTP on the host (timedatectl set-ntp true) and confirm with timedatectl status.