{"record":{"id":"54f4abcd45b40434","repo":"crowdsecurity/crowdsec","slug":"error-tailing-logs-w","errorCode":null,"errorMessage":"error tailing logs: %w","messagePattern":"error tailing logs: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/victorialogs/internal/vlclient/vl_client.go","lineNumber":325,"sourceCode":"\tlc.Logger.Debugf(\"Since: %s (%s)\", lc.config.Since, t)\n\tlc.Logger.Infof(\"Connecting to %s\", u)\n\n\tvar (\n\t\tresp *http.Response\n\t\terr  error\n\t)\n\n\tfor {\n\t\tresp, err = lc.Get(ctx, u)\n\t\tlc.Logger.Tracef(\"Tail request done: %v | %s\", resp, err)\n\n\t\tif err != nil {\n\t\t\tif errors.Is(err, context.Canceled) {\n\t\t\t\treturn nil, nil\n\t\t\t}\n\n\t\t\tif ok := lc.shouldRetry(); !ok {\n\t\t\t\treturn nil, fmt.Errorf(\"error tailing logs: %w\", err)\n\t\t\t}\n\n\t\t\tcontinue\n\t\t}\n\n\t\tbreak\n\t}\n\n\tif resp.StatusCode != http.StatusOK {\n\t\tlc.Logger.Warnf(\"bad HTTP response code for tail request: %d\", resp.StatusCode)\n\t\tbody, _ := io.ReadAll(resp.Body)\n\t\tresp.Body.Close()\n\n\t\tif ok := lc.shouldRetry(); !ok {\n\t\t\treturn nil, fmt.Errorf(\"bad HTTP response code: %d: %s: %w\", resp.StatusCode, string(body), err)\n\t\t}\n\t}\n","sourceCodeStart":307,"sourceCodeEnd":343,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/victorialogs/internal/vlclient/vl_client.go#L307-L343","documentation":"The VictoriaLogs datasource client failed to issue the HTTP GET for the `/select/logsql/tail` live-tailing endpoint. After exhausting its retry allowance (`shouldRetry()` returned false), `Tail` wraps the underlying transport error (DNS failure, connection refused, TLS error, canceled/deadline context other than plain cancel) and gives up. CrowdSec surfaces this wrapped chain to the caller `getResponseChan`.","triggerScenarios":"`lc.Get(ctx, tailURL)` returns a non-`context.Canceled` error and `shouldRetry()` is false: VictoriaLogs host unreachable, wrong URL/port in the acquisition config, TLS handshake failure, DNS resolution failure, or the tomb/goroutine group already dying so retries are disabled.","commonSituations":"VictoriaLogs is not running or listening on the configured URL; a proxy/firewall blocks the tail endpoint; typos in `url:` or `prefix:` in the acquis yaml; the machine loses network connectivity during startup; the tail request deadline expires because the server is slow.","solutions":["Verify VictoriaLogs is reachable: `curl '<url>/health'` from the crowdsec host.","Check the `url` and `prefix` fields in the victorialogs acquisition config for typos or wrong scheme/port.","Inspect the wrapped inner error in the log to distinguish DNS vs connection-refused vs TLS and fix accordingly.","If using TLS, confirm the CA/cert chain is trusted by the crowdsec process.","Restart crowdsec once the endpoint is up; the error occurs only at tail startup."],"exampleFix":"// before (crowdsec acquis.yaml)\nurl: http://victorialogs:9428\n// after\ncurl -v http://victorialogs:9428/health  # confirm reachability first\n# then fix host/port or start VictoriaLogs:\n# ./victoria-logs -storageDataPath=/vlstore","handlingStrategy":"retry","validationCode":"// before starting acquisition\nresp, err := http.Get(cfg.URL + \"/health\")\nif err != nil || resp.StatusCode != 200 {\n    return fmt.Errorf(\"VictoriaLogs %s unreachable: %v\", cfg.URL, err)\n}","typeGuard":null,"tryCatchPattern":"if err != nil {\n    var ctxErr bool = errors.Is(err, context.Canceled) || errors.Is(err, context.DeadlineExceeded)\n    if !ctxErr {\n        // log wrapped cause and back off / retry with limiter\n    }\n}","preventionTips":["Probe /health at startup before enabling tail mode","Pin correct URL/port and prefix in acquis config","Monitor DNS and network path between crowdsec and VictoriaLogs","Keep retries enabled and configure generous backoff"],"tags":["network","http","victorialogs","tail"],"backgroundTag":"http-request-failed","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}