{"record":{"id":"953ec31db7f35902","repo":"crowdsecurity/crowdsec","slug":"while-creating-machine-entry-for-s-w","errorCode":null,"errorMessage":"while creating machine entry for %s: %w","messagePattern":"while creating machine entry for (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/apiserver/middlewares/v1/jwt.go","lineNumber":97,"sourceCode":"\t\tWhere(machine.MachineId(ret.machineID)).\n\t\tFirst(ctx)\n\tif ent.IsNotFound(err) {\n\t\t// Machine was not found, let's create it\n\t\tlogger.Infof(\"machine %s not found, create it\", ret.machineID)\n\t\t// let's use an apikey as the password, doesn't matter in this case (generatePassword is only available in cscli)\n\t\tpwd, err := GenerateAPIKey(dummyAPIKeySize)\n\t\tif err != nil {\n\t\t\tlogger.WithField(\"cn\", extractedCN).\n\t\t\t\tErrorf(\"error generating password: %s\", err)\n\n\t\t\treturn nil, errors.New(\"error generating password\")\n\t\t}\n\n\t\tpassword := strfmt.Password(pwd)\n\n\t\tret.clientMachine, err = j.DbClient.CreateMachine(ctx, &ret.machineID, &password, \"\", true, true, types.TlsAuthType)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"while creating machine entry for %s: %w\", ret.machineID, err)\n\t\t}\n\t} else if err != nil {\n\t\treturn nil, fmt.Errorf(\"while selecting machine entry for %s: %w\", ret.machineID, err)\n\t} else {\n\t\tif ret.clientMachine.AuthType != types.TlsAuthType {\n\t\t\treturn nil, fmt.Errorf(\"machine %s attempted to auth with TLS cert but it is configured to use %s\", ret.machineID, ret.clientMachine.AuthType)\n\t\t}\n\n\t\tret.machineID = ret.clientMachine.MachineId\n\t}\n\n\tloginInput := struct {\n\t\tScenarios []string `json:\"scenarios\"`\n\t}{\n\t\tScenarios: []string{},\n\t}\n\n\terr = c.ShouldBindJSON(&loginInput)","sourceCodeStart":79,"sourceCodeEnd":115,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/apiserver/middlewares/v1/jwt.go#L79-L115","documentation":"During TLS-certificate (mTLS) authentication, authTLS did not find the machine in the database and attempted to auto-create it (CreateMachine with TlsAuthType, validated=true); the DB write failed, so the whole TLS login is aborted with 'while creating machine entry for %s'.","triggerScenarios":"Authenticator -> authTLS: a client presents a valid CA-signed cert whose CN is not yet a machines table row, and j.DbClient.CreateMachine returns an error — DB down, schema migration pending, unique-constraint race from concurrent first logins, or DB write permissions.","commonSituations":"First enrollment of a bouncer/agent via TLS while LAPI cannot reach the SQLite/PostgreSQL backend; two agents authenticating simultaneously for the first time; database left in a half-migrated state after an upgrade; disk full on the SQLite host.","solutions":["Check LAPI logs/database connectivity: is the DB reachable and writable (cscli machines list works locally)?","Run 'cscli migrate' / restart crowdsec to apply pending schema migrations","Pre-enroll the machine with 'cscli machines add <CN> --autoregister' or retry the client login (races resolve on retry)","Check disk space and DB user privileges if using PostgreSQL/MySQL"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// verify DB connectivity before TLS enrollment\nif err := db.PingContext(ctx); err != nil {\n    return fmt.Errorf(\"database unreachable, machine auto-registration will fail: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"_, err := client.Login(ctx) // TLS watcher login\nif err != nil && strings.Contains(err.Error(), \"while creating machine entry\") {\n    log.Errorf(\"machine auto-registration failed, check LAPI database: %v\", err)\n    // pre-enroll from the LAPI host, then retry\n}","preventionTips":["Ensure the LAPI database is up and writable before rolling out new TLS agents","Pre-enroll machines with 'cscli machines add --autoregister' to avoid create-path races","Keep the database schema migrated when upgrading crowdsec","Monitor disk space on SQLite-backed LAPI hosts"],"tags":["tls","mtls","database","auth","go"],"backgroundTag":"database-write-failed","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}