{"record":{"id":"2f640703f63d93ab","repo":"crowdsecurity/crowdsec","slug":"could-not-lstat-file-s-w","errorCode":null,"errorMessage":"could not lstat() file %s: %w","messagePattern":"could not lstat\\(\\) file (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/file/run.go","lineNumber":252,"sourceCode":"\t} else {\n\t\tnetworkFS, fsType, err := fsutil.IsNetworkFS(file)\n\t\tif err != nil {\n\t\t\tlogger.Warningf(\"Could not get fs type for %s : %s\", file, err)\n\t\t}\n\n\t\tlogger.Debugf(\"fs for %s is network: %t (%s)\", file, networkFS, fsType)\n\n\t\tif networkFS {\n\t\t\tlogger.Warnf(\"Disabling inotify polling on %s as it is on a network share. You can manually set poll_without_inotify to true to make this message disappear, or to false to enforce inotify poll\", file)\n\n\t\t\tpollFile = true\n\t\t}\n\t}\n\n\t// Check symlink status\n\tfilink, err := os.Lstat(file)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"could not lstat() file %s: %w\", file, err)\n\t}\n\n\tif filink.Mode()&os.ModeSymlink == os.ModeSymlink && !pollFile {\n\t\tlogger.Warnf(\"File %s is a symlink, but inotify polling is enabled. Crowdsec will not be able to detect rotation. Consider setting poll_without_inotify to true in your configuration\", file)\n\t}\n\n\t// Create the tailer with appropriate configuration\n\tseekInfo := &tail.SeekInfo{Offset: 0, Whence: io.SeekEnd}\n\tif s.config.Mode == configuration.CAT_MODE {\n\t\tseekInfo.Whence = io.SeekStart\n\t}\n\n\tif seekEnd {\n\t\tseekInfo.Whence = io.SeekEnd\n\t}\n\n\tlogger.Infof(\"Starting tail (offset: %d, whence: %d)\", seekInfo.Offset, seekInfo.Whence)\n","sourceCodeStart":234,"sourceCodeEnd":270,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/file/run.go#L234-L270","documentation":"setupTailForFile calls os.Lstat to check whether the path is a symlink and warn about rotation-detection limitations. If Lstat fails it returns \"could not lstat() file %s: %w\". Like the Stat error, this means the path became inaccessible (or was always inaccessible to stat) between the earlier open and this check.","triggerScenarios":"os.Lstat(file) errors in setupTailForFile during symlink status check, from StreamingAcquisition or checkAndTailFile.","commonSituations":"Symlink target replaced/removed mid-scan; dangling symlink where the target vanished; permission on symlink resolution; NFS staleness.","solutions":["Check whether the path (or symlink) still exists: ls -la the path.","If it's a dangling symlink, fix or remove it from the acquisition patterns.","Verify parent directory execute permissions for the crowdsec user.","If the file races constantly with rotation, set poll_without_inotify: true in the acquisition config."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// verify path is a resolvable, existing entry\nls -la /var/log/myapp.log\nreadlink -f /var/log/myapp.log || echo 'dangling symlink'","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Remove dangling symlinks from acquisition paths.","Set poll_without_inotify: true when tailing symlinked/rotated logs.","Re-check acquisition paths after cert/log rotation tooling changes."],"tags":["file-io","symlink","acquisition","go"],"backgroundTag":"file-not-found","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}