{"record":{"id":"9725bbc202570f01","repo":"crowdsecurity/crowdsec","slug":"unable-to-get-allowlists-w","errorCode":null,"errorMessage":"unable to get allowlists: %w","messagePattern":"unable to get allowlists: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/database/allowlists.go","lineNumber":369,"sourceCode":"func (c *Client) IsAllowlisted(ctx context.Context, value string) (bool, string, error) {\n\treasons, err := c.IsAllowlistedBy(ctx, value)\n\tif err != nil {\n\t\treturn false, \"\", err\n\t}\n\n\tif len(reasons) == 0 {\n\t\treturn false, \"\", nil\n\t}\n\n\treason := strings.Join(reasons, \", \")\n\n\treturn true, reason, nil\n}\n\nfunc (c *Client) GetAllowlistsContentForAPIC(ctx context.Context) ([]netip.Addr, []netip.Prefix, error) {\n\tallowlists, err := c.ListAllowLists(ctx, true)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"unable to get allowlists: %w\", err)\n\t}\n\n\tvar (\n\t\tips  []netip.Addr\n\t\tnets []netip.Prefix\n\t)\n\n\tfor _, allowlist := range allowlists {\n\t\tfor _, item := range allowlist.Edges.AllowlistItems {\n\t\t\tif item.ExpiresAt.IsZero() || item.ExpiresAt.After(time.Now().UTC()) {\n\t\t\t\tif strings.Contains(item.Value, \"/\") {\n\t\t\t\t\tipNet, err := netip.ParsePrefix(item.Value)\n\t\t\t\t\tif err != nil {\n\t\t\t\t\t\tc.Log.Errorf(\"unable to parse CIDR %s: %s\", item.Value, err)\n\t\t\t\t\t\tcontinue\n\t\t\t\t\t}\n\n\t\t\t\t\tnets = append(nets, ipNet)","sourceCodeStart":351,"sourceCodeEnd":387,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/database/allowlists.go#L351-L387","documentation":"GetAllowlistsContentForAPIC aggregates all console-managed allowlists into IPs and prefixes to push to APIC. It starts by calling ListAllowLists(ctx, true); if listing fails, this error wraps the failure and no addresses are returned.","triggerScenarios":"Calling GetAllowlistsContentForAPIC (from ApplyApicWhitelists) when ListAllowLists fails: DB unavailable, locked, or the allowlist table missing.","commonSituations":"APIC whitelist push during SQLite contention with the crowdsec daemon; DB not yet migrated after an upgrade.","solutions":["Inspect the wrapped error from ListAllowLists for lock/IO issues","Ensure only one process writes to the SQLite DB at a time","Verify the allowlist schema exists with 'cscli allowlists list'; run migrations if needed","Retry the APIC push - it is a periodic sync and safe to repeat"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"if err := dbHealthy(ctx, c); err != nil {\n    return fmt.Errorf(\"skip APIC push, DB unavailable: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"ips, nets, err := c.GetAllowlistsContentForAPIC(ctx)\nif err != nil {\n    log.Warnf(\"APIC allowlist push skipped: %v\", err)\n    return // next sync cycle retries automatically\n}","preventionTips":["Treat the APIC push as periodic: log and skip on failure rather than crashing","Avoid running competing writers against the SQLite DB during sync","Ensure migrations have run so the allowlist tables exist"],"tags":["database","allowlist","capi","crowdsec"],"backgroundTag":"database-query-failed","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}