{"record":{"id":"ad6ba437898ccec6","repo":"crowdsecurity/crowdsec","slug":"unable-to-collect-sources-from-bucket-w","errorCode":null,"errorMessage":"unable to collect sources from bucket: %w","messagePattern":"unable to collect sources from bucket: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/leakybucket/overflows.go","lineNumber":350,"sourceCode":"\t\tLeakspeed:       &leakSpeed,\n\t\tMessage:         new(string),\n\t\tStartAt:         &startAt,\n\t\tStopAt:          &stopAt,\n\t\tSimulated:       &simulated,\n\t\tKind:            types.CrowdsecAlertKind.String(),\n\t}\n\n\tif leaky.Factory == nil {\n\t\treturn runtimeAlert, errors.New(\"leaky.BucketConfig is nil\")\n\t}\n\n\t// give information about the bucket\n\truntimeAlert.Mapkey = leaky.Mapkey\n\n\t// Get the sources from Leaky/Queue\n\tsources, source_scope, err := alertFormatSource(leaky, queue)\n\tif err != nil {\n\t\treturn runtimeAlert, fmt.Errorf(\"unable to collect sources from bucket: %w\", err)\n\t}\n\n\truntimeAlert.Sources = sources\n\t// Include source info in format string\n\tsourceStr := \"UNKNOWN\"\n\tif len(sources) > 1 {\n\t\tsourceStr = fmt.Sprintf(\"%d sources\", len(sources))\n\t} else if len(sources) == 1 {\n\t\tfor k := range sources {\n\t\t\tsourceStr = k\n\t\t\tbreak\n\t\t}\n\t}\n\n\t*apiAlert.Message = fmt.Sprintf(\"%s %s performed '%s' (%d events over %s) at %s\", source_scope, sourceStr, leaky.Factory.Spec.Name, leaky.Total_count, leaky.Ovflw_ts.Sub(leaky.First_ts), leaky.Last_ts)\n\t// Get the events from Leaky/Queue\n\tapiAlert.Events = EventsFromQueue(queue)\n","sourceCodeStart":332,"sourceCodeEnd":368,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/leakybucket/overflows.go#L332-L368","documentation":"NewAlert builds a runtime Alert when a bucket overflows. As part of that it calls alertFormatSource to gather the sources from the overflow queue; any failure there is wrapped with this message. Like error 1192 it is a propagation wrapper — the actionable cause is deeper (scope filter evaluation error or mixed source types), here bound to the public NewAlert entry point used by bucket overflow processing.","triggerScenarios":"overflow() → NewAlert(leaky, queue) when alertFormatSource returns an error: a scope filter expression fails at runtime, RunTimeFilter is nil with a non-Range scope, or queued events have multiple source scope types.","commonSituations":"Production overflow that should have generated an alert but didn't, with this line in logs — almost always after a scenario/parser edit changed event shape or the scope filter expression.","solutions":["Read the chained inner error after this message for the real cause (filter evaluation vs. multiple source types)","Reproduce with the offending log line using cscli/crowdsec in debug mode","Fix the scenario's scope filter or parser output as indicated by the inner error","Validate the fixed scenario by replaying the logs before reloading the hub"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Sanity-check scenario + parser before deploy by replaying real logs:\n// cscli hub item reload scenario-x && cscli metrics (alert count > 0 on expected traffic)","typeGuard":null,"tryCatchPattern":"alert, err := leakybucket.NewAlert(leaky, queue)\nif err != nil {\n    // err chain: \"unable to collect sources from bucket\" -> inner cause\n    return fmt.Errorf(\"NewAlert failed: %w\", err)\n}","preventionTips":["Always resolve the innermost wrapped error first","Replay representative logs through the parser/scenario before production","Keep scope filters resilient to missing fields","Watch for this error in crowdsec.log as a sign of broken hub items"],"tags":["crowdsec","alert","overflow"],"backgroundTag":"expr-filter-evaluation-failed","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}