{"record":{"id":"6ed332a922de29ac","repo":"crowdsecurity/crowdsec","slug":"unknown-error","errorCode":null,"errorMessage":"unknown error","messagePattern":"unknown error","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/cticlient/client.go","lineNumber":27,"sourceCode":"\t\"net/http\"\n\t\"strings\"\n\n\t\"github.com/crowdsecurity/crowdsec/pkg/apiclient/useragent\"\n\tlog \"github.com/sirupsen/logrus\"\n)\n\nconst (\n\tCTIBaseUrl    = \"https://cti.api.crowdsec.net/v2\"\n\tsmokeEndpoint = \"/smoke\"\n\tfireEndpoint  = \"/fire\"\n)\n\nvar (\n\tErrUnauthorized  = errors.New(\"unauthorized\")\n\tErrLimit         = errors.New(\"request quota exceeded, please reduce your request rate\")\n\tErrNotFound      = errors.New(\"ip not found\")\n\tErrDisabled      = errors.New(\"cti is disabled\")\n\tErrUnknown       = errors.New(\"unknown error\")\n\tdefaultUserAgent = useragent.Default()\n)\n\ntype CrowdsecCTIClient struct {\n\thttpClient *http.Client\n\tapiKey     string\n\tLogger     *log.Entry\n\tUserAgent  string\n}\n\nfunc (c *CrowdsecCTIClient) doRequest(ctx context.Context, method string, endpoint string, params map[string]string) ([]byte, error) {\n\turl := CTIBaseUrl + endpoint\n\tif len(params) > 0 {\n\t\turl += \"?\"\n\t\tfor k, v := range params {\n\t\t\turl += fmt.Sprintf(\"%s=%s&\", k, v)\n\t\t}\n\t}","sourceCodeStart":9,"sourceCodeEnd":45,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/cticlient/client.go#L9-L45","documentation":"ErrUnknown is a catch-all sentinel for unexpected internal failures in CTI handling. In the expr helper it is returned when a successfully fetched CTI result fails to be stored in the local CTI cache (SetWithExpire error), aborting the lookup with an empty SmokeItem.","triggerScenarios":"CTICache.SetWithExpire fails (cache backend error) inside the IpCTI expr function after a successful API response.","commonSituations":"Cache backend (e.g. in-memory/bolt) corrupted, full, or closed; memory pressure on a long-running LAPI process.","solutions":["Restart crowdsec to reinitialize the CTI cache","Check logs for the preceding 'error while caching CTI' warning to identify the cache backend failure","Inspect memory/disk usage if the cache is persistent; enlarge limits as needed"],"exampleFix":"null","handlingStrategy":"try-catch","validationCode":"null","typeGuard":"null","tryCatchPattern":"resp, err := ctiClient.GetIPInfo(ip)\nif errors.Is(err, cticlient.ErrUnknown) {\n    log.Warning(\"CTI lookup failed internally; skipping enrichment\")\n    return &cticlient.SmokeItem{}, nil\n}","preventionTips":["Monitor logs for 'error while caching CTI' warnings","Keep adequate memory for the in-memory CTI cache","Restart the service if the cache backend persists in failing"],"tags":["cache","cti","internal","expr"],"backgroundTag":"internal-invariant-violation","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}