Troubleshooting Guide

# Check container status
docker ps -a | grep bitwarden

# Test health endpoints
curl http://localhost/healthz
curl http://localhost/healthz/extended

# View service logs
docker logs --tail 100 bitwarden-api
docker logs --tail 100 bitwarden-identity
docker logs --tail 100 bitwarden-mssql

# Test SQL Server connection
docker exec -it bitwarden-mssql /opt/mssql-tools18/bin/sqlcmd \
  -S localhost -U sa -P "${SA_PASSWORD}" -C \
  -Q "SELECT @@VERSION;"

# Check database state
docker exec -it bitwarden-mssql /opt/mssql-tools18/bin/sqlcmd \
  -S localhost -U sa -P "${SA_PASSWORD}" -C \
  -Q "SELECT name, state_desc FROM sys.databases WHERE name = 'vault';"

# Test service connectivity from API container
docker exec bitwarden-api curl -I http://identity:5000

# Check DNS resolution
docker exec bitwarden-api nslookup identity

# Verify port bindings
netstat -tulpn | grep -E '(80|443|5000)'

# Check user permissions in database
docker exec -it bitwarden-mssql /opt/mssql-tools18/bin/sqlcmd \
  -S localhost -U sa -P "${SA_PASSWORD}" -C -Q "
  SELECT u.Email, ou.Status, ou.Type 
  FROM [dbo].[User] u 
  JOIN [dbo].[OrganizationUser] ou ON u.Id = ou.UserId 
  WHERE u.Email = 'user@example.com';
  "

# Check collection access
docker exec -it bitwarden-mssql /opt/mssql-tools18/bin/sqlcmd \
  -S localhost -U sa -P "${SA_PASSWORD}" -C -Q "
  SELECT c.Name, cg.ReadOnly, cg.HidePasswords
  FROM [dbo].[Collection] c
  JOIN [dbo].[CollectionGroup] cg ON c.Id = cg.CollectionId
  WHERE c.OrganizationId = '<org-id>';
  "

# Check resource usage
docker stats

# Identify slow queries
docker exec -it bitwarden-mssql /opt/mssql-tools18/bin/sqlcmd \
  -S localhost -U sa -P "${SA_PASSWORD}" -C -Q "
  SELECT TOP 10 
      total_elapsed_time/execution_count AS avg_time_ms,
      execution_count,
      SUBSTRING(st.text, (qs.statement_start_offset/2)+1,
      ((CASE qs.statement_end_offset
        WHEN -1 THEN DATALENGTH(st.text)
        ELSE qs.statement_end_offset
      END - qs.statement_start_offset)/2) + 1) AS statement_text
  FROM sys.dm_exec_query_stats AS qs
  CROSS APPLY sys.dm_exec_sql_text(qs.sql_handle) AS st
  ORDER BY total_elapsed_time/execution_count DESC;
  "

# Check for blocking
docker exec -it bitwarden-mssql /opt/mssql-tools18/bin/sqlcmd \
  -S localhost -U sa -P "${SA_PASSWORD}" -C -Q "
  SELECT * FROM sys.dm_exec_requests WHERE blocking_session_id <> 0;
  "

# Container memory
docker stats --no-stream

# Host memory
free -h

# Check for blocking processes
docker exec -it bitwarden-mssql /opt/mssql-tools18/bin/sqlcmd \
  -S localhost -U sa -P "${SA_PASSWORD}" -C -Q "
  SELECT session_id, blocking_session_id, wait_type, wait_time
  FROM sys.dm_exec_requests
  WHERE blocking_session_id <> 0;
  "

# Kill blocking session if found
KILL <session_id>;

DBCC CHECKDB (vault) WITH NO_INFOMSGS;

docker logs bitwarden-api | grep -i "error\|exception" | tail -50

# Verify Identity configuration
docker exec bitwarden-identity cat /etc/bitwarden/config.yml

# Test OpenID endpoint
curl http://localhost/.well-known/openid-configuration

# Verify storage configuration
docker exec bitwarden-api cat /etc/bitwarden/config.yml | grep -A 5 attachment

# Check permissions
ls -la /etc/bitwarden/core/attachments/
chown -R bitwarden:bitwarden /etc/bitwarden/core/attachments/

# Check disk space
df -h /etc/bitwarden/

# Test connection string
az storage blob list \
  --account-name <account> \
  --container-name attachments \
  --connection-string "${CONNECTION_STRING}"

{
  "Logging": {
    "LogLevel": {
      "Default": "Debug",
      "Bit.Api": "Trace",
      "Bit.Core": "Debug"
    }
  }
}

#!/bin/bash
# Diagnostic collection script

DIAG_DIR="bitwarden-diagnostics-$(date +%Y%m%d_%H%M%S)"
mkdir -p "$DIAG_DIR"

# Container status
docker ps -a > "$DIAG_DIR/containers.txt"

# Logs from all services
for service in api identity admin notifications events; do
    docker logs "bitwarden-$service" > "$DIAG_DIR/$service.log" 2>&1
done

# System info
uname -a > "$DIAG_DIR/system.txt"
df -h >> "$DIAG_DIR/system.txt"
free -h >> "$DIAG_DIR/system.txt"

# Network info
docker network inspect bitwarden_default > "$DIAG_DIR/network.json"

# Create archive
tar -czf "$DIAG_DIR.tar.gz" "$DIAG_DIR"
rm -rf "$DIAG_DIR"

echo "Diagnostics collected: $DIAG_DIR.tar.gz"