{"record":{"id":"47214cebf2d0b56e","repo":"crowdsecurity/crowdsec","slug":"while-selecting-machine-entry-for-s-w","errorCode":null,"errorMessage":"while selecting machine entry for %s: %w","messagePattern":"while selecting machine entry for (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/apiserver/middlewares/v1/jwt.go","lineNumber":100,"sourceCode":"\t\t// Machine was not found, let's create it\n\t\tlogger.Infof(\"machine %s not found, create it\", ret.machineID)\n\t\t// let's use an apikey as the password, doesn't matter in this case (generatePassword is only available in cscli)\n\t\tpwd, err := GenerateAPIKey(dummyAPIKeySize)\n\t\tif err != nil {\n\t\t\tlogger.WithField(\"cn\", extractedCN).\n\t\t\t\tErrorf(\"error generating password: %s\", err)\n\n\t\t\treturn nil, errors.New(\"error generating password\")\n\t\t}\n\n\t\tpassword := strfmt.Password(pwd)\n\n\t\tret.clientMachine, err = j.DbClient.CreateMachine(ctx, &ret.machineID, &password, \"\", true, true, types.TlsAuthType)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"while creating machine entry for %s: %w\", ret.machineID, err)\n\t\t}\n\t} else if err != nil {\n\t\treturn nil, fmt.Errorf(\"while selecting machine entry for %s: %w\", ret.machineID, err)\n\t} else {\n\t\tif ret.clientMachine.AuthType != types.TlsAuthType {\n\t\t\treturn nil, fmt.Errorf(\"machine %s attempted to auth with TLS cert but it is configured to use %s\", ret.machineID, ret.clientMachine.AuthType)\n\t\t}\n\n\t\tret.machineID = ret.clientMachine.MachineId\n\t}\n\n\tloginInput := struct {\n\t\tScenarios []string `json:\"scenarios\"`\n\t}{\n\t\tScenarios: []string{},\n\t}\n\n\terr = c.ShouldBindJSON(&loginInput)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"missing scenarios list in login request for TLS auth: %w\", err)\n\t}","sourceCodeStart":82,"sourceCodeEnd":118,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/apiserver/middlewares/v1/jwt.go#L82-L118","documentation":"authTLS found no machine row and the lookup itself failed: the else-if branch wraps the DbClient.SelectMachine error as 'while selecting machine entry for %s'. This means the database query for the certificate CN failed, not that the machine is merely unknown (unknown machines get created instead).","triggerScenarios":"Authenticator -> authTLS: cert CN is parsed to ret.machineID, the machine does not exist (so the create branch is skipped), and SelectMachine returns a DB error — connection refused, table missing, context canceled, DB timeout.","commonSituations":"LAPI started before the database was ready; SQLite file corrupted or moved; PostgreSQL credentials changed; long TLS handshake canceled by the client causing context cancellation mid-query.","solutions":["Verify the database is up and credentials in crowdsec.db/api section are correct","Test locally: cscli machines list (uses the same DB) — fix any connection error it reports","Restart LAPI so DB connections are re-established after a DB outage","If it's context cancellation, check why the client disconnects during login (timeouts, wrong port)"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// check the DB is queryable before the watcher connects\ncscli machines list >/dev/null || echo \"LAPI database not reachable\"","typeGuard":null,"tryCatchPattern":"_, err := client.Login(ctx)\nif err != nil && strings.Contains(err.Error(), \"while selecting machine entry\") {\n    // transient DB issue: backoff and retry login\n    time.Sleep(backoff)\n    return client.Login(ctx)\n}","preventionTips":["Start the database before LAPI (ordering/depends_on in systemd or compose)","Use DB connection retry/backoff in wrapper scripts around LAPI startup","Monitor DB health with a periodic cscli/SQL ping","Avoid client-side timeouts shorter than DB query time on loaded systems"],"tags":["tls","mtls","database","auth","go"],"backgroundTag":"database-query-failed","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}