{"record":{"id":"53f0a3e5e7eb140f","repo":"crowdsecurity/crowdsec","slug":"while-extracting-scope-from-bucket-s-w","errorCode":null,"errorMessage":"while extracting scope from bucket %s: %w","messagePattern":"while extracting scope from bucket (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/leakybucket/overflows.go","lineNumber":277,"sourceCode":"\t\tevents = append(events, &ovflwEvent)\n\t}\n\n\treturn events\n}\n\n// alertFormatSource iterates over the queue to collect sources\nfunc alertFormatSource(leaky *Leaky, queue *pipeline.Queue) (map[string]models.Source, string, error) {\n\tvar source_type string\n\n\tsources := make(map[string]models.Source)\n\n\tlog.Debugf(\"Formatting (%s) - scope Info : scope_type:%s / scope_filter:%s\", leaky.Factory.Spec.Name, leaky.Factory.Spec.ScopeType.Scope, leaky.Factory.Spec.ScopeType.Filter)\n\n\tqEvents := queue.GetQueue()\n\tfor idx := range qEvents {\n\t\tsrcs, err := SourceFromEvent(qEvents[idx], leaky)\n\t\tif err != nil {\n\t\t\treturn nil, \"\", fmt.Errorf(\"while extracting scope from bucket %s: %w\", leaky.Factory.Spec.Name, err)\n\t\t}\n\n\t\tfor key, src := range srcs {\n\t\t\tif source_type == types.Undefined {\n\t\t\t\tsource_type = *src.Scope\n\t\t\t}\n\n\t\t\tif *src.Scope != source_type {\n\t\t\t\treturn nil, \"\",\n\t\t\t\t\tfmt.Errorf(\"event has multiple source types : %s != %s\", *src.Scope, source_type)\n\t\t\t}\n\n\t\t\tsources[key] = src\n\t\t}\n\t}\n\n\treturn sources, source_type, nil\n}","sourceCodeStart":259,"sourceCodeEnd":295,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/leakybucket/overflows.go#L259-L295","documentation":"alertFormatSource aggregates the per-event sources of all queued events in an overflowing bucket. It calls SourceFromEvent for each queued event; if any per-event scope extraction fails (e.g. the scope filter evaluation errors), it aborts alert creation and wraps the error naming the bucket. This is a propagation wrapper — the root cause is inside SourceFromEvent (scope filter evaluation).","triggerScenarios":"An overflow triggers NewAlert → alertFormatSource; SourceFromEvent returns an error for any queued event (scope filter runtime failure, or RunTimeFilter nil with non-Range scope); the error is wrapped with the bucket name via this message.","commonSituations":"A scenario whose scope filter breaks only for certain parsed events in the overflow queue — the alert itself then fails to build even though the bucket overflowed; commonly after a parser/hub update changed event shape.","solutions":["Look at the wrapped inner error (scope filter / empty scope information) for the root cause","Run the scenario with a debug bucket or cscli hub test to reproduce on the offending events","Fix the scenario's scope filter expression or parser output that made SourceFromEvent fail","Reload the hub (cscli hub reload) after editing the scenario"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Reproduce before deploy:\n// crowdsec -type nginx -config dev.yaml (debug) and check bucket formatting on a sample overflow\ncscli metrics  # confirm buckets overflow and alerts are produced","typeGuard":null,"tryCatchPattern":"// Where alerts are built programmatically:\nalert, err := leakybucket.NewAlert(leaky, queue)\nif err != nil {\n    log.Errorf(\"alert creation failed for bucket %s: %v\", leaky.Factory.Spec.Name, err)\n    return err // surface the chain; inner error names the failing filter\n}","preventionTips":["Fix the root cause reported by the inner SourceFromEvent error, not the wrapper","Test scenarios with debug enabled before production reload","Monitor crowdsec.log for repeated occurrences of this wrapper"],"tags":["crowdsec","alert","scope-filter"],"backgroundTag":"expr-filter-evaluation-failed","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}