{"record":{"id":"16873f25680306a9","repo":"crowdsecurity/crowdsec","slug":"unable-to-get-allowlist-items-w","errorCode":null,"errorMessage":"unable to get allowlist items: %w","messagePattern":"unable to get allowlist items: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/database/allowlists.go","lineNumber":417,"sourceCode":"\t}\n\n\treturn ips, nets, nil\n}\n\nfunc (c *Client) ApplyAllowlistsToExistingDecisions(ctx context.Context) (int, error) {\n\t// Soft delete (set expiration to now) all decisions that matches any allowlist\n\ttotalCount := 0\n\n\t// Get all non-expired allowlist items\n\tallowlistItems, err := c.Ent.AllowListItem.Query().\n\t\tWhere(\n\t\t\tallowlistitem.Or(\n\t\t\t\tallowlistitem.ExpiresAtGTE(time.Now().UTC()),\n\t\t\t\tallowlistitem.ExpiresAtIsNil(),\n\t\t\t),\n\t\t).All(ctx)\n\tif err != nil {\n\t\treturn 0, fmt.Errorf(\"unable to get allowlist items: %w\", err)\n\t}\n\n\tif len(allowlistItems) == 0 {\n\t\treturn 0, nil\n\t}\n\n\tipv4Items := make([]*ent.AllowListItem, 0)\n\tipv6Items := make([]*ent.AllowListItem, 0)\n\n\tfor _, item := range allowlistItems {\n\t\tswitch item.IPSize {\n\t\tcase 4:\n\t\t\tipv4Items = append(ipv4Items, item)\n\t\tcase 16:\n\t\t\tipv6Items = append(ipv6Items, item)\n\t\tdefault:\n\t\t\tc.Log.Errorf(\"unexpected IP size %d for allowlist item %s\", item.IPSize, item.Value)\n\t\t}","sourceCodeStart":399,"sourceCodeEnd":435,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/database/allowlists.go#L399-L435","documentation":"ApplyAllowlistsToExistingDecisions fetches all non-expired allowlist items so their entries can be applied to existing ban decisions. If the ent query over allowlist items fails, this error wraps the DB failure and no decisions are modified.","triggerScenarios":"Calling ApplyAllowlistsToExistingDecisions (startup management loop, 'cscli decisions import', PullTop) when the query filtering on expires_at fails: DB locked, IO error, or missing schema.","commonSituations":"Crowdsec startup racing another process writing to SQLite; 'cscli decisions import' while the daemon bulk-writes decisions.","solutions":["Check the wrapped error; 'database is locked' means serialize writers or raise the SQLite busy timeout","Verify DB integrity ('cscli db check' if available) and disk space","Re-run the operation; the function is read-only with respect to allowlist items"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"n, err := c.ApplyAllowlistsToExistingDecisions(ctx, ip, existingDecisions)\nif err != nil {\n    if strings.Contains(err.Error(), \"database is locked\") {\n        return retryAfterBackoff(ctx, func() error { _, err := c.ApplyAllowlistsToExistingDecisions(ctx, ip, existingDecisions); return err })\n    }\n    return err\n}","preventionTips":["Schedule decision imports/pulls to avoid overlapping heavy DB write windows","Increase SQLite busy_timeout for CLI/daemon contention","Run migrations after upgrades before starting the management loop"],"tags":["database","allowlist","query","sqlite"],"backgroundTag":"database-query-failed","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}