Skip to main content

CAP.L0.SERVER_UNREACHABLE — the connection could not be opened, so nothing was audited

  • Category: safety
  • Level: 0
  • Stability: stable
  • Suites: audit

The audit could not open its connection. No rule ran, no catalog row was read, and the report you are holding is empty for that reason — not because the schema is in good order.

The exit code, and why it is not 1​

Exit code 1 in this package means findings breached a gate. A run that never reached a database found nothing to breach anything, so returning 1 would tell every CI reading exit codes that problems were found in a database nobody looked at.

This is an undetermined result and takes the code the contract assigns to that: 3 under --strict, 0 otherwise. If a pipeline should stop when the audit cannot run, that is what --strict is for.

It is deliberately not reported as a misconfiguration either. A wrong host, a rotated password, a firewall rule and a server that is simply restarting are indistinguishable from here, and calling all four a config error sends an operator whose database is rebooting to go and edit a config file.

What the message tells you, and what it will not​

The driver's own words are carried through, with the connection's coordinates removed: no host, no port, no database name, no role. What survives is the part that identifies the kind of failure — the SQLSTATE, and whether the server refused the connection, refused the credentials, or was not there at all.