# Troubleshoot an installation

> Locate the failing layer before changing configuration.

Source: https://usefiretower.com/docs/troubleshoot

## Collect the basics

Run these on the control-plane server. Use the directory chosen at installation.

```
firetower --dir /opt/firetower status
firetower --dir /opt/firetower doctor
firetower --dir /opt/firetower logs
```

## Follow the symptom

| Problem | Start with |
| --- | --- |
| App cannot reach the server | Open the URL in a browser; check VPN, DNS and TLS |
| Server is reachable but sign-in fails | Account status, temporary-password flow and trusted-proxy configuration |
| No machine can start work | [Worker setup](https://usefiretower.com/docs/machines) and [readiness](https://usefiretower.com/docs/machines#section-5) |
| Only one provider fails | [Agent credentials](https://usefiretower.com/docs/accounts) or [git-host authorization](https://usefiretower.com/docs/git) |
| A run waits unexpectedly | Permission requests, quota failure and worker connectivity |
| An upgrade stopped | [The update step and its recorded error](https://usefiretower.com/docs/updates) |

## Prepare a useful report

-   Include the time, affected component and versions.
-   Describe what you expected and the exact error.
-   Include relevant diagnostic output after checking it for secrets.
-   Say whether the failure affects everyone, one machine or one account.

Do not include `.env` , root keys, provider tokens or private repository content in a public report.