{"record":{"id":"47d5e8d03a6da9b1","repo":"crowdsecurity/crowdsec","slug":"failed-to-create-sqlite-database-file-q-w","errorCode":null,"errorMessage":"failed to create SQLite database file %q: %w","messagePattern":"failed to create SQLite database file %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"pkg/database/database.go","lineNumber":85,"sourceCode":"\n\tif config == nil {\n\t\treturn nil, errors.New(\"DB config is empty\")\n\t}\n\n\tentLogger := logger.WithField(\"context\", \"ent\")\n\tentOpt := ent.Log(entLogger.Debug)\n\n\ttyp, dia, err := config.ConnectionDialect()\n\tif err != nil {\n\t\treturn nil, err // unsupported database caught here\n\t}\n\n\tif config.Type == \"sqlite\" && config.DbPath != \":memory:\" {\n\t\t/*if it's the first startup, we want to touch and chmod file*/\n\t\tif _, err = os.Stat(config.DbPath); os.IsNotExist(err) {\n\t\t\tf, err := os.OpenFile(config.DbPath, os.O_CREATE|os.O_RDWR, 0o600)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"failed to create SQLite database file %q: %w\", config.DbPath, err)\n\t\t\t}\n\n\t\t\tif err := f.Close(); err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"failed to create SQLite database file %q: %w\", config.DbPath, err)\n\t\t\t}\n\t\t}\n\t\t// Always try to set permissions to simplify a bit the code for windows (as the permissions set by OpenFile will be garbage)\n\t\tif err = setFilePerm(config.DbPath, 0o640); err != nil {\n\t\t\treturn nil, fmt.Errorf(\"unable to set perms on %s: %w\", config.DbPath, err)\n\t\t}\n\t}\n\n\tdbConnectionString, err := config.ConnectionString()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to generate DB connection string: %w\", err)\n\t}\n\n\tdrv, err := getEntDriver(typ, dia, dbConnectionString, config)","sourceCodeStart":67,"sourceCodeEnd":103,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/database/database.go#L67-L103","documentation":"NewClient pre-creates the SQLite file when db_config.type is sqlite and the path isn't :memory:. If os.OpenFile(O_CREATE|O_RDWR, 0600) cannot create/open the file, the error is wrapped with this message and client startup aborts. This runs only on first startup (file does not exist yet).","triggerScenarios":"The parent directory does not exist or is not writable, the path points to a directory, permission is denied (wrong user, read-only filesystem, sandboxed dir), or the path is invalid for the OS.","commonSituations":"db_config.db_path in /etc/crowdsec/config.yaml pointing at a non-existent directory or a path the crowdsec user can't write (e.g. running under systemd with a different User=); Docker volume mounted read-only; SELinux/AppArmor denial.","solutions":["Check that the directory containing db_path exists and is writable by the crowdsec user (mkdir -p / chown)","Verify db_path in the YAML points to a file path, not a directory, and is not :memory:-typoed","Check for read-only mounts or MAC-policy (SELinux/AppArmor) denials in audit logs","Run crowdsec as a user with write access to the data dir"],"exampleFix":"// before (crowdsec.yaml)\ndb_config:\n  type: sqlite\n  db_path: /var/lib/crowdsec/data/crowdsec.db   # dir missing\n// after\nsudo mkdir -p /var/lib/crowdsec/data && sudo chown crowdsec:crowdsec /var/lib/crowdsec/data","handlingStrategy":"validation","validationCode":"// before starting crowdsec\npath := \"/var/lib/crowdsec/data/crowdsec.db\"\ndir := filepath.Dir(path)\nif info, err := os.Stat(dir); err != nil || !info.IsDir() {\n\tos.MkdirAll(dir, 0o750)\n}\nf, err := os.OpenFile(path, os.O_CREATE|os.O_RDWR, 0o600)\nif err != nil { log.Fatalf(\"db path not writable: %v\", err) }\nf.Close()","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pre-create the data directory and chown it to the service user","Never point db_path at a directory or read-only mount","Check SELinux/AppArmor audit logs on permission denials","Verify config YAML db_path on fresh installs"],"tags":["sqlite","filesystem","permissions","startup"],"backgroundTag":"file-open-failed","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}