Diagnostics

The safest diagnostic pattern is observe first, change later.

Server baseline

sudo frpctl show version
sudo frpctl show status
sudo frpctl show clients
sudo frpctl show enrollments
sudo frpctl doctor

sudo frpctl show version
sudo frpctl show status
sudo frpctl show services
sudo frpctl show info
sudo frpctl doctor

Area	Examples
Installation	expected files/components, version state
Permissions	secret-file modes and ownership
PKI / trust	CA material and consistency
Runtime	systemd service state
FRP	generated config, transport, local consistency
Enrollment	allocator/HTTPS reachability and trust path
State	registry/client-state consistency
Topology	Direct/single-443 and common network mismatch

doctor is read-only.

FRP Auto Deploy does not automatically control external security groups, NAT, DNS, or the target application’s own listener/authentication.

For a local SSH target:

ss -lntp | grep ':22'

For a LAN target, prove the client itself can reach target-host:target-port before debugging the FRP public path.

Do not start by editing or replacing:

/etc/frp/frps.toml
/etc/frp/frpc.toml
/var/lib/frp-auto-deploy/registry.json
/etc/frp/client-state.json
client management identity files
project PKI

Manual edits can erase the evidence that explains the original problem or create a second consistency problem.

Use the symptom-driven Troubleshooting page for: