Troubleshooting

Agent won't start

Check service status

systemctl status segla
journalctl -u segla --no-pager -n 50

Common causes

Symptom	Cause	Fix
permission denied	Not running as root / missing capabilities	Check systemd unit has CAP_NET_ADMIN
config not found	Missing config file	Create /etc/segla/config.yaml
connection refused	Can't reach backend	Check api_addr and network connectivity

Agent is running but not connecting

Test connectivity

# Check if the agent can reach the backend
curl -v https://gw.segla.io:443

Check agent registration

segla state

If agent_id is empty, the agent hasn't registered yet. Check logs for errors:

journalctl -u segla -f --grep "register"

WireGuard interface not coming up

Check WireGuard is available

# Kernel module
lsmod | grep wireguard

# Or wireguard-go
which wireguard-go

Check interface status

sudo wg show
ip link show | grep wg

Check desired state

segla state

Verify that a private network is assigned with phase: ACTIVE.

Peers not connecting

Verify UDP port is open

# Check if port 51821 is listening
ss -ulnp | grep 51821

Check firewall

# iptables
sudo iptables -L -n | grep 51821

# or ufw
sudo ufw status | grep 51821

Ensure UDP port 51821 is open for inbound traffic.

Check peer handshake

sudo wg show

If latest handshake is missing for a peer, the peer may be unreachable. Verify:

• Peer's endpoint is correct and reachable
• Peer's firewall allows UDP 51821
• Both peers have each other's public keys

Reset agent state

Danger

This will remove all local state including WireGuard keys. The agent will re-register and regenerate keys on the next cycle.

systemctl stop segla
rm -rf /var/lib/segla/*
systemctl start segla

Enable debug logging

Edit /etc/segla/config.yaml:

log_level: debug
log_format: text

Then restart:

systemctl restart segla
journalctl -u segla -f