Troubleshoot cluster configuration

Find the symptom you see in the tables below, then apply the fix beside it. Each table covers one area of cluster management.

Fix identity and sign-in problems

Symptom	Fix
Failed to join Active Directory domain	Check that the join account may join computers, that the cluster can resolve and reach the domain, and that the ou path exists.
Failed to leave Active Directory domain during destroy	If the join account no longer works, set force_leave = true, apply, then destroy. The computer account stays behind in AD.
Cannot import: cluster not joined to AD	Create qumulo_ad with an apply instead. Import works only on a cluster that is already joined.
An imported qumulo_ad force-leaves the domain on destroy	Add ad_username and ad_password to the configuration before any destroy.
A role membership for an AD group fails	Join the cluster to Active Directory first, then use the group's SID as auth_id.
The ldap_schema_description block is required when ldap_schema is set to CUSTOM	Add the block with your directory's attribute and object class names.
Missing Configuration for Required Attribute on ldap_schema_description	Add the block even with ldap_schema = "RFC2307". The provider requires it.
Warning Ignored configuration on ldap_schema_description	Nothing to fix. RFC 2307 ignores the block, which must stay in place.
Terraform is locked out after setting require_sso = true	Point the connection profile at a local account such as admin. require_sso blocks password sign-in for AD users only.
SSO users cannot sign in after SAML is disabled	Give those users passwords. Without SAML they authenticate with a password.
Deleting a local group fails	Move every user whose primary_group is that group to another group, apply, then remove the group.
A password changed outside Terraform never shows in a plan	Passwords are write-only, so Terraform cannot see the change. Set a new password in the configuration and apply.
Missing Configuration for Required Attribute on anonymous_user	Add the anonymous_user block to qumulo_ftp_settings. The provider requires it, and anonymous logins then act as the user it names.

Fix export and quota problems

Symptom	Fix
Quota already exists	Import the quota with terraform import qumulo_directory_quota.<name> <profile>,<directory_path>.
Failed to resolve directory path on a quota	Create the directory on the cluster first. A quota cannot create its directory.
The plan replaces a quota	directory_path changed. Put the old path back unless you meant to move the quota.
The plan shows a directory_path you never wrote	The directory moved on the cluster and its quota followed it. Set directory_path to the new path.
An export or share fails to create on a spoke	Check that the directory exists on that cluster and that its connection profile uses an admin account.

Fix audit logging problems

Symptom	Fix
server_address is required when enabled is true	Set server_address, or set enabled = false.
log_group_name is required when enabled is true, or the same for region	Set both log_group_name and region.
connection_status stays AUDIT_LOG_DISCONNECTED	Read error_message and error_details in terraform state show qumulo_audit_syslog.main, then check that the cluster reaches the server on server_port.
CloudWatch writes fail with AccessDenied	Grant the cluster's IAM role logs:DescribeLogGroups and logs:DescribeLogStreams beside the write actions. Qumulo Core 7.9.0 and later need them.

Fix portal and replication problems

Symptom	Fix
A portal stays PENDING	The hub has not accepted it. Check port 3713 in both directions and the hub's connection profile credentials.
No pending hub portal found	Check that the spoke can reach every address in hub_hosts on port 3713.
Connection refused on port 3713	Check that each address in hub_hosts and spoke_hosts resolves and is reachable from the other cluster, and that hub_port and spoke_port match the open port.
hub_status or spoke_status is DEGRADED	Connectivity between the clusters is limited. Check port 3713 between every address pair.
A root exists but its data is not reachable	The hub has not authorized the root. Check that qumulo_portal_root applied, or add qumulo_portal_hub_root when you use the split portal resources.
The replication target fails to authorize	Create the target after the source, with depends_on pointing at qumulo_replication_source_relationship.
Replication cannot connect	Open port 3712 from the source cluster to the target.

Fix S3 and role problems

Symptom	Fix
The plan replaces a role	A role's name cannot change in place. Keep the old name to keep the role.
The plan replaces an S3 access key	Access keys cannot change in place, and the replacement has a new secret_access_key. Read the new secret from state, since the cluster returns it only at creation.
The plan replaces an S3 bucket after an Object Lock change	object_lock_enabled is fixed when the bucket is created. Keep the original value to keep the bucket.

Know what destroy leaves behind

Symptom	Fix
The cluster keeps its name after destroy	Destroy only drops qumulo_cluster_settings from state. Rename the cluster with an apply.
The server certificate stays after destroying qumulo_cluster_ssl	The API cannot delete it. Destroy removes the CA certificate and leaves the ciphers as they were, so install a new certificate to replace the old one.
Settings return to defaults after destroy	qumulo_file_system_settings, qumulo_time_configuration, qumulo_ldap_settings, qumulo_saml_settings, qumulo_audit_syslog, and qumulo_audit_cloudwatch reset or disable their settings on destroy. Run terraform state rm on the resource first to keep the live settings.
SSO stops working after destroy	Destroying qumulo_saml_settings disables SAML, even a configuration that predates Terraform. Run terraform state rm qumulo_saml_settings.<name> before you destroy.

Get more detail

Run TF_LOG=DEBUG terraform apply for the provider's full log.