{"record":{"id":"663518c69c2f74de","repo":"crowdsecurity/crowdsec","slug":"unable-to-load-inband-rule-s-s","errorCode":null,"errorMessage":"unable to load inband rule %s : %s","messagePattern":"unable to load inband rule (.+?) : (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/appsec/appsec.go","lineNumber":958,"sourceCode":"\tfor _, rule := range wc.OutOfBandRules {\n\t\twc.Logger.Infof(\"loading outofband rule %s\", rule)\n\n\t\tcollections, err := LoadCollection(rule, wc.Logger.WithField(\"component\", \"appsec_collection_loader\"), hub)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"unable to load outofband rule %s : %s\", rule, err)\n\t\t}\n\n\t\tret.OutOfBandRules = append(ret.OutOfBandRules, collections...)\n\t}\n\n\twc.Logger.Infof(\"Loaded %d outofband rules\", len(ret.OutOfBandRules))\n\n\tfor _, rule := range wc.InBandRules {\n\t\twc.Logger.Infof(\"loading inband rule %s\", rule)\n\n\t\tcollections, err := LoadCollection(rule, wc.Logger.WithField(\"component\", \"appsec_collection_loader\"), hub)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"unable to load inband rule %s : %s\", rule, err)\n\t\t}\n\n\t\tret.InBandRules = append(ret.InBandRules, collections...)\n\t}\n\n\twc.Logger.Infof(\"Loaded %d inband rules\", len(ret.InBandRules))\n\n\t// Load datafiles declared directly on the appsec-config (e.g. bot lists for\n\t// MatchKnownBot) into the expr datafile registry. cwhub has already\n\t// downloaded them; this mirrors initRuleData for appsec-rules.\n\tfor _, d := range wc.Data {\n\t\tif d.DestPath == \"\" {\n\t\t\twc.Logger.Errorf(\"missing dest_file for data in appsec-config %s: %+v\", wc.Name, d)\n\t\t\tcontinue\n\t\t}\n\n\t\tif err := exprhelpers.FileInit(hub.GetDataDir(), d.DestPath, d.Type); err != nil {\n\t\t\twc.Logger.Errorf(\"unable to initialize data file %s: %s\", d.DestPath, err)","sourceCodeStart":940,"sourceCodeEnd":976,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/appsec/appsec.go#L940-L976","documentation":"Same as the outofband variant but for in-band rules: Build() calls LoadCollection for each entry in wc.InBandRules and wraps any failure. In-band rules run synchronously during request evaluation, so the appsec runtime cannot be built without them.","triggerScenarios":"Build() hitting a LoadCollection error for a name in inband_rules: collection not installed, YAML parse failure, missing dependency collection referenced by includes.","commonSituations":"Typo in `inband_rules:` entry; crowdsecurity/appsec-virtual-patching not installed; hub in a broken state after failed upgrade; hand-edited rule file with invalid indentation.","solutions":["Correct the inband_rules entry name against `cscli collections list -a`","Install missing collections: `cscli collections install crowdsecurity/appsec-virtual-patching`","Run `cscli hub update && cscli hub upgrade` to repair stale hub files","Read the wrapped error to distinguish YAML parse issues from missing-name issues"],"exampleFix":"// before\ninband_rules:\n  - crowdsecurity/virtual-patching\n// after\ninband_rules:\n  - crowdsecurity/appsec-virtual-patching","handlingStrategy":"validation","validationCode":"for _, rule := range cfg.InBandRules {\n    if !cscliCollectionExists(rule) {\n        return fmt.Errorf(\"inband rule %q not installed\", rule)\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := buildAppsecRuntime(cfg); err != nil {\n    log.Fatalf(\"appsec build failed: %v\", err) // wrapped LoadCollection cause is in %v\n}","preventionTips":["Pin the appsec collections you depend on in your hub setup scripts","Lint custom collection YAMLs (yamlfmt/yamllint) before rollout","Test appsec startup in CI with the same hub state as production"],"tags":["appsec","rules","hub"],"backgroundTag":"resource-not-found","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}