{"record":{"id":"7b956f6cdcd55b8f","repo":"crowdsecurity/crowdsec","slug":"failed-to-load-enrich-plugin-w","errorCode":null,"errorMessage":"failed to load enrich plugin: %w","messagePattern":"failed to load enrich plugin: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/parser/unix_parser.go","lineNumber":134,"sourceCode":"\t/* load base regexps for two grok parsers */\n\tparsers.Ctx, err = NewUnixParserCtx(patternDir, cConfig.ConfigPaths.DataDir)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to load parser patterns: %w\", err)\n\t}\n\n\tparsers.PovfwCtx, err = NewUnixParserCtx(patternDir, cConfig.ConfigPaths.DataDir)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to load postovflw parser patterns: %w\", err)\n\t}\n\n\t/*\n\t\tLoad enrichers\n\t*/\n\tlog.Info(\"Loading enrich plugins\")\n\n\tparsers.EnricherCtx, err = Loadplugin()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to load enrich plugin: %w\", err)\n\t}\n\n\t/*\n\t Load the actual parsers\n\t*/\n\n\tlog.Infof(\"Loading parsers from %d files\", len(parsers.StageFiles))\n\n\tparsers.Nodes, err = LoadStages(parsers.StageFiles, parsers.Ctx, parsers.EnricherCtx)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to load parser config: %w\", err)\n\t}\n\n\tif len(parsers.PovfwStageFiles) > 0 {\n\t\tlog.Info(\"Loading postoverflow parsers\")\n\n\t\tparsers.Povfwnodes, err = LoadStages(parsers.PovfwStageFiles, parsers.PovfwCtx, parsers.EnricherCtx)\n\t\tif err != nil {","sourceCodeStart":116,"sourceCodeEnd":152,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/parser/unix_parser.go#L116-L152","documentation":"LoadParsers calls Loadplugin() to load enrichment plugins (geoip, goICE, etc.) and wraps any failure in \"failed to load enrich plugin\". Enrichers are external Go plugins registered to enrich parsed events; if they cannot be loaded, the enricher stage cannot be built and startup fails. The wrapped error names the specific plugin that failed.","triggerScenarios":"Loadplugin() returning an error during LoadParsers — plugin shared object cannot be opened, plugin init fails, or a plugin dependency (e.g. GeoLite2 database file) is missing.","commonSituations":"Installing the geoip-enrich collection but not downloading the mmdb database; a plugin .so built against an incompatible Go version; read permissions on the plugin/data files; hub installed plugins missing after an upgrade.","solutions":["Read the wrapped error to identify the failing plugin and run `cscli hub upgrade` to reinstall its assets","If using geoip, download the GeoLite2-City.mmdb / GeoLite2-ASN.mmdb into DataDir as documented","Check plugin file permissions and that plugins were built for the running crowdsec version","Temporarily remove the failing enricher from the config to isolate the issue"],"exampleFix":"// before\n$ cscli hub list | grep geoip   # installed but db missing\n// after\n$ cd /etc/crowdsec && ./cscli hub update && ./cscli hub upgrade\n$ ls /var/lib/crowdsec/data/GeoLite2-City.mmdb   # confirm present","handlingStrategy":"try-catch","validationCode":"// before startup\ninfo, err := os.Stat(filepath.Join(dataDir, \"GeoLite2-City.mmdb\"))\nif err != nil { log.Fatal(\"geoip database missing; install geoip collection\") }","typeGuard":null,"tryCatchPattern":"parsers, err := parser.LoadParsers(cfg)\nif err != nil {\n  var perr *pluginError\n  if errors.As(err, &perr) { log.Fatalf(\"enrich plugin failed: %v\", err) }\n  return err\n}","preventionTips":["Install enricher data assets (mmdb files) as part of provisioning","Rebuild plugins against the same Go version as crowdsec","Re-run `cscli hub upgrade` after every version bump"],"tags":["crowdsec","parser","plugin","enricher","startup"],"backgroundTag":"module-init-failed","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}