Skip to main content
Use this sequence before changing configuration. It preserves evidence and prevents a secondary failure from hiding the first one.

​
Triage sequence

  1. Record the exact time, URL or JID, account, operation, and observed response.
  2. Check Windows service state and process uptime.
  3. Search the Neuron event log at that time.
  4. Open any associated exception entry.
  5. Confirm the active build and installed package versions.
  6. Reproduce once with the narrowest applicable protocol sniffer.
  7. Stop the sniffer and redact secrets before sharing evidence.

​
Service does not start

Check, in order:
  • another process already owns a required port;
  • the service identity can read program files and program-data keys;
  • Gateway.config is well-formed and matches the installed modules;
  • a newly installed assembly package loads on the current runtime;
  • the database path or external database is reachable;
  • disk space is available for database journals, logs, and package extraction.
Do not repeatedly reinstall over an existing data folder. First copy the event/exception logs and confirm where encryption keys are stored.

​
HTTPS or certificate failure

  • Resolve the configured host name from both inside and outside the network.
  • Confirm ports 80/443 reach this instance.
  • Check certificate subject alternative names and expiry.
  • Verify the service can read the private key.
  • Check whether an upstream proxy terminates TLS and which forwarded headers it sets.
  • For mTLS, verify the client actually sends a certificate and that the chain and intended usages are accepted.

​
401 Unauthorized versus 403 Forbidden

401 means the request lacks acceptable authentication or its credential is invalid/expired. 403 means the server recognized the caller but the caller lacks authorization for the resource or object. For 403, do not retry the same token in a loop. Check:
  • assigned roles and exact privilege;
  • ownership or account-specific resource path;
  • OAuth scopes granted into the token;
  • WAF rules and source-address restrictions;
  • object-level authorization for identity, contract, vault, or file resources.

​
Package update failure

  • Verify .package and .signature belong to the same build.
  • Confirm the installation key uses the expected provider public key and decryption key.
  • Inspect pre-update backup events.
  • Check module-load exceptions after restart.
  • Roll back through the package manager or restore a verified backup; do not mix individual DLLs from different package versions.

​
Database keyset or decryption errors

These often indicate the service is running under a different identity, the key container permissions changed, or program data came from another host without its keys. Stop writes, take a file-level copy, record the service identity, and use the key recovery/migration procedure for that storage provider and Neuron build.

​
Evidence bundle

Provide support with: