{"record":{"id":"21da0bd1df0dd4b9","repo":"crowdsecurity/crowdsec","slug":"cannot-create-s-dialer-w","errorCode":null,"errorMessage":"cannot create %s dialer: %w","messagePattern":"cannot create (.+?) dialer: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/kafka/config.go","lineNumber":85,"sourceCode":"\ts.logger.Debugf(\"successfully parsed kafka configuration : %+v\", s.Config)\n\n\treturn err\n}\n\nfunc (s *Source) Configure(_ context.Context, yamlConfig []byte, logger *log.Entry, metricsLevel metrics.AcquisitionMetricsLevel) error {\n\ts.logger = logger\n\ts.metricsLevel = metricsLevel\n\n\ts.logger.Debugf(\"start configuring %s source\", s.GetName())\n\n\terr := s.UnmarshalConfig(yamlConfig)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tdialer, err := s.Config.NewDialer()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"cannot create %s dialer: %w\", s.GetName(), err)\n\t}\n\n\ts.Reader, err = s.Config.NewReader(dialer, s.logger)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"cannote create %s reader: %w\", s.GetName(), err)\n\t}\n\n\tif s.Reader == nil {\n\t\treturn fmt.Errorf(\"cannot create %s reader\", s.GetName())\n\t}\n\n\ts.logger.Debugf(\"successfully configured %s source\", s.GetName())\n\n\treturn nil\n}\n\nfunc (c *Configuration) NewTLSConfig() (*tls.Config, error) {\n\ttlsConfig := tls.Config{","sourceCodeStart":67,"sourceCodeEnd":103,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/kafka/config.go#L67-L103","documentation":"Wraps any failure from Configuration.NewDialer() while the kafka acquisition source is being configured in CrowdSec. NewDialer fails when the `timeout` value is not an integer, or when TLS is configured and the client cert/key pair or CA cert file cannot be loaded/parsed. The kafka source name ('kafka') is interpolated so the operator knows which datasource failed during acquisition setup.","triggerScenarios":"CrowdSec loads a kafka datasource (yaml acquisition file) and Configure() calls Config.NewDialer(); it fires when `timeout:` is a non-numeric string (strconv.Atoi error), or when `tls.client_cert`/`tls.client_key` fail tls.LoadX509KeyPair (missing/malformed files) or `tls.ca_cert` fails os.ReadFile.","commonSituations":"Typo in the timeout value (e.g. '10s' instead of '10', since the field is seconds as an integer, not a duration); wrong paths to cert/key/CA files inside the container; certs mounted but unreadable by the crowdsec user; PEM files that are actually empty or corrupted.","solutions":["Fix the `timeout` value in the kafka acquisition yaml to a plain integer number of seconds (e.g. `timeout: 10`), or remove it to use the 10s default","Check the paths in tls.client_cert, tls.client_key and tls.ca_cert exist and are readable by the crowdsec process (ls -l, correct mounts)","Validate the cert/key pair with `openssl x509 -in cert.pem -noout` and `openssl rsa -in key.pem -check`; regenerate if malformed","Read the wrapped %w error in the crowdsec logs to identify which sub-step (timeout parse vs TLS load) failed"],"exampleFix":"// before\nsource: kafka\nbrokers:\n  - broker:9092\ntopic: crowdsec\ntimeout: 10s   # Atoi fails -> cannot create kafka dialer\n// after\nsource: kafka\nbrokers:\n  - broker:9092\ntopic: crowdsec\ntimeout: 10","handlingStrategy":"validation","validationCode":"// before writing the acquisition yaml\nif t, ok := cfg[\"timeout\"]; ok {\n    if _, err := strconv.Atoi(t.(string)); err != nil {\n        return fmt.Errorf(\"kafka timeout must be integer seconds, got %q\", t)\n    }\n}\nfor _, p := range []string{tlsCfg.ClientCert, tlsCfg.ClientKey, tlsCfg.CaCert} {\n    if _, err := os.Stat(p); err != nil {\n        return fmt.Errorf(\"TLS file missing: %s\", p)\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := src.Configure(ctx, yamlCfg, logger, lvl); err != nil {\n    var pathErr *fs.PathError\n    if errors.As(err, &pathErr) {\n        logger.Errorf(\"kafka TLS file problem: %v\", pathErr)\n    }\n    return fmt.Errorf(\"kafka datasource setup failed: %w\", err)\n}","preventionTips":["Treat `timeout` as integer seconds, never a duration string","Mount TLS files read-only and verify ownership matches the crowdsec user","Test cert/key pairs with openssl before deploying"],"tags":["kafka","tls","config","crowdsec"],"backgroundTag":"invalid-config-value","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}