{"record":{"id":"5fc50665c3951e65","repo":"crowdsecurity/crowdsec","slug":"while-describing-group-s-w","errorCode":null,"errorMessage":"while describing group %s: %w","messagePattern":"while describing group (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/cloudwatch/run.go","lineNumber":134,"sourceCode":"\t\tcase <-s.t.Dying():\n\t\t\ts.logger.Infof(\"stopping group watch\")\n\t\t\treturn nil\n\t\tcase <-ticker.C:\n\t\t\tp := cloudwatchlogs.NewDescribeLogStreamsPaginator(\n\t\t\t\ts.cwClient,\n\t\t\t\t&cloudwatchlogs.DescribeLogStreamsInput{\n\t\t\t\t\tLogGroupName: aws.String(s.Config.GroupName),\n\t\t\t\t\tDescending:   aws.Bool(true),\n\t\t\t\t\tOrderBy:      cwTypes.OrderByLastEventTime,\n\t\t\t\t\tLimit:        s.Config.DescribeLogStreamsLimit,\n\t\t\t\t},\n\t\t\t\t)\n\n\t\t\tPageloop:\n\t\t\tfor p.HasMorePages() {\n\t\t\t\tpage, err := p.NextPage(ctx)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"while describing group %s: %w\", s.Config.GroupName, err)\n\t\t\t\t}\n\n\t\t\t\tfor _, event := range page.LogStreams {\n\t\t\t\t\t// we check if the stream has been written to recently enough to be monitored\n\t\t\t\t\tif event.LastIngestionTime == nil {\n\t\t\t\t\t\tcontinue\n\t\t\t\t\t}\n\n\t\t\t\t\t// aws uses millisecond since the epoch\n\t\t\t\t\toldest := time.Now().UTC().Add(-*s.Config.MaxStreamAge)\n\t\t\t\t\t// TBD : verify that this is correct : Unix 2nd arg expects Nanoseconds, and have a code that is more explicit.\n\t\t\t\t\tLastIngestionTime := time.Unix(0, *event.LastIngestionTime*int64(time.Millisecond))\n\t\t\t\t\tif LastIngestionTime.Before(oldest) {\n\t\t\t\t\t\ts.logger.Tracef(\"stop iteration, %s reached oldest age, stop (%s < %s)\", aws.ToString(event.LogStreamName), LastIngestionTime, time.Now().UTC().Add(-*s.Config.MaxStreamAge))\n\t\t\t\t\t\tbreak Pageloop\n\t\t\t\t\t}\n\n\t\t\t\t\tvar expectMode int","sourceCodeStart":116,"sourceCodeEnd":152,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/cloudwatch/run.go#L116-L152","documentation":"WatchLogGroupForStreams calls DescribeLogGroups pages to discover streams in the log group. If any page fetch fails (network error, throttling, auth failure, missing permissions) the error is wrapped as `while describing group <name>: <err>`, aborting the streaming acquisition loop.","triggerScenarios":"StreamingAcquisition calls WatchLogGroupForStreams and a p.NextPage(ctx) call fails — network interruption, AWS throttling (rate exceeded), IAM lacking logs:DescribeLogGroups, or the group region/profile being wrong.","commonSituations":"Long-running streaming hitting transient AWS API errors or rate limits; IAM policy missing logs:DescribeLogGroups on the group; wrong region configured so the group lookup fails mid-poll.","solutions":["Check IAM permissions include logs:DescribeLogGroups for the group ARN","Retry on transient network errors; consider restarting crowdsec — the loop stops on first error","Check for throttling in the wrapped error and reduce poll frequency or request a quota increase","Verify aws_region matches where the log group lives"],"exampleFix":"// before\n{\"log_group\": \"/aws/lambda/missing-perms\"}\n// after — attach policy\n{\"Effect\": \"Allow\", \"Action\": \"logs:DescribeLogGroups\", \"Resource\": \"arn:aws:logs:*:*:log-group:/aws/*\"}","handlingStrategy":"retry","validationCode":"_, err := client.DescribeLogGroups(ctx, &cwlogs.DescribeLogGroupsInput{LogGroupNamePrefix: aws.String(group)})\nif err != nil { return fmt.Errorf(\"preflight describe failed: %w\", err) }","typeGuard":null,"tryCatchPattern":"page, err := p.NextPage(ctx)\nif err != nil {\n    var tae smithy.APIError\n    if errors.As(err, &tae) && tae.ErrorCode() == \"ThrottlingException\" {\n        time.Sleep(backoff); continue // retry with backoff\n    }\n    return fmt.Errorf(\"while describing group %s: %w\", group, err)\n}","preventionTips":["Grant logs:DescribeLogGroups in the IAM policy","Add retry/backoff around long-running streaming pages","Verify group/region existence at startup with a preflight call","Monitor for repeated warnings indicating throttling"],"tags":["aws","cloudwatch","iam","network"],"backgroundTag":"api-request-failed","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}