{"record":{"id":"2f7c33ba98aa20dc","repo":"crowdsecurity/crowdsec","slug":"failed-opening-connection-to-s-w","errorCode":null,"errorMessage":"failed opening connection to %s: %w","messagePattern":"failed opening connection to (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/database/database.go","lineNumber":105,"sourceCode":"\n\t\t\tif err := f.Close(); err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"failed to create SQLite database file %q: %w\", config.DbPath, err)\n\t\t\t}\n\t\t}\n\t\t// Always try to set permissions to simplify a bit the code for windows (as the permissions set by OpenFile will be garbage)\n\t\tif err = setFilePerm(config.DbPath, 0o640); err != nil {\n\t\t\treturn nil, fmt.Errorf(\"unable to set perms on %s: %w\", config.DbPath, err)\n\t\t}\n\t}\n\n\tdbConnectionString, err := config.ConnectionString()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to generate DB connection string: %w\", err)\n\t}\n\n\tdrv, err := getEntDriver(typ, dia, dbConnectionString, config)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed opening connection to %s: %w\", config.Type, err)\n\t}\n\n\tclient = ent.NewClient(ent.Driver(drv), entOpt)\n\n\tif config.LogLevel >= log.DebugLevel {\n\t\tlogger.Debugf(\"Enabling request debug\")\n\n\t\tclient = client.Debug()\n\t}\n\n\tif err = client.Schema.Create(ctx, dropLegacyIndex(\"decisions\", \"decision_value\")); err != nil {\n\t\treturn nil, fmt.Errorf(\"failed creating schema resources: %w\", err)\n\t}\n\n\treturn &Client{\n\t\tEnt:              client,\n\t\tLog:              logger,\n\t\tType:             config.Type,","sourceCodeStart":87,"sourceCodeEnd":123,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/database/database.go#L87-L123","documentation":"NewClient wraps the error from getEntDriver when the ent ORM driver cannot open a connection using the generated DSN. Unlike error 960, the connection string was built but the actual driver open failed — usually wrong credentials, unreachable host, or bad DSN syntax for the DB type.","triggerScenarios":"database.NewClient with a mysql/postgres server that is down or refusing auth; sqlite file path that cannot be opened (locked, on read-only FS); malformed connection string parameters rejected by the driver.","commonSituations":"MySQL container not started before crowdsec; wrong db password after rotation; connecting to postgres over SSL without sslmode configured; sqlite db on an NFS/immutable mount.","solutions":["Check the wrapped inner error for driver specifics (auth failed, unknown host, dialect error).","Verify the DB server is reachable: test with the mysql/psql client using the same host/port/credentials.","For sqlite, confirm the db_path exists and is writable by the crowdsec process.","Add/adjust driver options like sslmode for postgres or timeout params in the config."],"exampleFix":"// before (postgres w/o TLS setup)\ndb_config:\n  type: postgres\n  host: db.internal\n  sslmode: verify-full\n// after\ndb_config:\n  type: postgres\n  host: db.internal\n  sslmode: require","handlingStrategy":"retry","validationCode":"// pre-check reachability\nconn, err := net.DialTimeout(\"tcp\", net.JoinHostPort(cfg.Host, cfg.Port), 3*time.Second)\nif err != nil {\n    return fmt.Errorf(\"db %s:%s unreachable: %w\", cfg.Host, cfg.Port, err)\n}\nconn.Close()","typeGuard":null,"tryCatchPattern":"drv/open errors are wrapped; retry with backoff only for transient errors:\nfor i := 0; i < 5; i++ {\n    client, err = database.NewClient(ctx, cfg)\n    if err == nil || !isTransient(err) { break }\n    time.Sleep(time.Duration(1<<i) * time.Second)\n}","preventionTips":["Ensure the DB service starts before crowdsec (systemd After=/depends)","Test credentials with a native client before deployment","Pin sslmode/TLS settings for postgres","Keep sqlite db on a local writable filesystem"],"tags":["database","connection","ent-orm"],"backgroundTag":"connection-refused","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}