Troubleshooting

​

Connection & Authentication Errors

• Username & Password: Confirm the service account is not locked (SHOW USERS LIKE '<username>' → check locked_until_time).
• Key Pair: Verify the public key is correctly assigned: DESC USER <prizm_username> and check RSA_PUBLIC_KEY_FP. If mismatched, re-run ALTER USER <prizm_username> SET RSA_PUBLIC_KEY='<key>'. Ensure the private key file uploaded to Prizm matches the registered public key.
• OAuth: Confirm the redirect URI in the Snowflake security integration exactly matches the URL shown in the Prizm connection form — including trailing slashes and protocol (https://).

-- View your current network policy
SHOW NETWORK POLICIES;

-- Add Prizm IP range to an existing policy
ALTER NETWORK POLICY <policy_name> SET ALLOWED_IP_LIST = (
  '<existing_ips>',
  '<prizm_egress_ip_range>'
);

​

Permission Errors

-- Check what the role can access
SHOW GRANTS TO ROLE PRIZM_ROLE;

-- Verify the role is assigned to the service account
SHOW GRANTS TO USER <prizm_username>;

GRANT IMPORTED PRIVILEGES ON DATABASE SNOWFLAKE TO ROLE PRIZM_ROLE;

​

Performance & Timeout Errors

• Use a dedicated warehouse for Prizm rather than a shared one, to avoid queue contention.
• Start with X-Small or Small warehouse size for catalog and observability jobs. Increase to Medium only if profile jobs on wide tables time out.
• Narrow the asset scope (exclude DEV_*, SANDBOX_*, TEMP_* schemas) to reduce the number of objects Prizm processes per run.
• Stagger job schedules — avoid running all four job types at the same time.

1. The asset’s database and schema match the Include patterns in the connector scope.
2. The asset is not matched by an Exclude pattern.
3. PRIZM_ROLE has USAGE on the schema and SELECT on the table.
4. The Catalog job has completed at least one full run since the asset was created — check Settings → Connectors → Logs for the last successful Catalog job timestamp.
5. If the table was just created, wait for the next scheduled Catalog run or trigger a manual scan.

​

Tag Sync Errors

• Confirm IMPORTED PRIVILEGES ON DATABASE SNOWFLAKE is granted (required for ACCOUNT_USAGE.TAGS and TAG_REFERENCES).
• Tag sync runs as part of the Catalog job (daily by default). Check the last Catalog job run time in Settings → Connectors → Logs.
• Enterprise-only: confirm the Snowflake account is on Enterprise edition or above, as TAG_REFERENCES in ACCOUNT_USAGE requires it.

GRANT DATABASE ROLE SNOWFLAKE.TAG_ADMIN TO ROLE PRIZM_ROLE;

​

Alerts & Metrics

• Navigate to the asset and confirm metrics are defined and set to Active.
• Verify the evaluation schedule is active under Settings → Connectors.
• Check the time window you’re viewing — alerts outside the selected period won’t appear.

1. The baseline needs recalibration. Prizm compares values against a historical baseline. If data has legitimately shifted (migration, seasonal change), the baseline may no longer reflect the expected range. Contact your administrator to recalibrate.
2. The triggered column is not the one you expect. Review the Drift Status column and metric name in the alert details — it may be a different column than the one you inspected.

• Confirm the metric is set to Active status.
• Check whether the metric’s scope matches an asset that is in the connector’s Include scope.
• For SQL-based (Query) metrics, run the query manually in your data source to verify it returns a result.
• Review the last job run log under Settings → Connectors → Logs for errors related to metric execution.

​

Agent Deployment

kubectl logs <POD> -n app --previous
kubectl describe pod <POD> -n app

# Kubernetes
kubectl exec <POD> -n app -- env | grep NATS_ENVIRONMENT

# Docker
docker inspect <container> | grep NATS_ENVIRONMENT

kubectl logs <POD> -n app --tail=30 | grep NATS

nc -zv <NATS_HOST> 443

• AWS EKS: Security Group egress rules on the EKS node group
• AKS: NSG egress rules on the AKS subnet
• GCP GKE: VPC Firewall egress rules on the node pool
• On-Prem / VM: OS-level firewall (ufw) and network policy

kubectl describe pod <POD> -n app

# Delete and recreate the secret with new credentials
kubectl delete secret prizm-nats-secret -n app
kubectl create secret generic prizm-nats-secret \
  --from-literal=NATS_USERNAME=nats \
  --from-literal=NATS_PASSWORD=<NEW_NATS_PASSWORD> \
  --namespace app

# Rolling restart all agent pods
kubectl rollout restart deployment -n app

​

Self-Hosted Deployment

docker stack services prizm
docker service logs -f prizm_nginx
docker service logs -f prizm_ray

# Confirm ACCESS_SCHEME was updated
grep ACCESS_SCHEME ~/docker-infra/.env

# Force NGINX to reload
docker service update --force prizm_nginx

# Check NGINX logs for certificate errors
docker service logs -f prizm_nginx

openssl x509 -noout -modulus -in nginx/certs/fullchain.pem | md5sum
openssl rsa -noout -modulus -in nginx/certs/privkey.pem | md5sum
# Both hashes must be identical

docker service update --force prizm_ray
# Wait ~45 seconds, then retry the Ray URL

# Clear Redis leader keys after restart
REDIS_CID=$(docker ps --filter label=com.docker.swarm.service.name=prizm_redis --format '{{.ID}}' | head -1)
docker exec "$REDIS_CID" redis-cli -a "$REDIS_PASSWORD" \
  DEL leader:job_run_scheduler leader:job_scheduler

set -a; source ~/docker-infra/.env; set +a
docker stack deploy --with-registry-auth -c docker-stack.yml prizm

​

Integrations

• Confirm the Jira integration is enabled under Settings → Integrations → Jira.
• Verify the API token has not expired. Regenerate it in Jira under Account Settings → Security → API tokens and update it in Prizm.
• Check that the configured Jira project key exists and the token owner has permission to create issues in that project.
• Confirm the issue type (Bug, Task, etc.) configured in Prizm exists in the target Jira project.

curl -X POST -H 'Content-type: application/json' \
  --data '{"text":"Prizm test notification"}' \
  <YOUR_WEBHOOK_URL>

• Confirm the secret path in Prizm exactly matches the path in your secrets manager.
• For HashiCorp Vault with AppRole authentication, verify the AppRole token has not expired.
• For AWS Secrets Manager, confirm the IAM role has secretsmanager:GetSecretValue permission on the rotated secret’s ARN.
• Trigger a manual connector test in Prizm after rotation to confirm the new credentials are being read correctly.

​

MCP & Access Tokens

• Confirm the token was generated with generated_for: "MCP" — standard API tokens cannot be used for MCP connections.
• Verify the mcpServers config block in your AI client matches the format provided in Prizm, including the correct server URL and Authorization: Bearer <token> header.
• Check that the token has not expired. MCP tokens have a configured TTL — regenerate and replace if expired.

• Review the token’s scope in Settings → Access Tokens — the token may not include the required tool category.
• Generate a new token with the required tool scopes and update the AI client configuration.
• Internal metrics tools (create_metrics, create_alerts, create_profiles) require elevated scope — confirm with your Prizm administrator.

​

Where to Find Logs

​

Next Steps