{"record":{"id":"aeaf23ce3ccf7ad7","repo":"crowdsecurity/crowdsec","slug":"could-not-start-tailing-file-s-w","errorCode":null,"errorMessage":"could not start tailing file %s : %w","messagePattern":"could not start tailing file (.+?) : %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/file/run.go","lineNumber":279,"sourceCode":"\tif s.config.Mode == configuration.CAT_MODE {\n\t\tseekInfo.Whence = io.SeekStart\n\t}\n\n\tif seekEnd {\n\t\tseekInfo.Whence = io.SeekEnd\n\t}\n\n\tlogger.Infof(\"Starting tail (offset: %d, whence: %d)\", seekInfo.Offset, seekInfo.Whence)\n\n\ttail, err := tail.TailFile(file, tail.Config{\n\t\tReOpen:   true,\n\t\tFollow:   true,\n\t\tPoll:     pollFile,\n\t\tLocation: seekInfo,\n\t\tLogger:   log.NewEntry(log.StandardLogger()),\n\t})\n\tif err != nil {\n\t\treturn fmt.Errorf(\"could not start tailing file %s : %w\", file, err)\n\t}\n\n\ts.tailMapMutex.Lock()\n\ts.tails[file] = true\n\ts.tailMapMutex.Unlock()\n\n\tt.Go(func() error {\n\t\tdefer trace.ReportPanic()\n\t\treturn s.tailFile(out, t, tail)\n\t})\n\n\treturn nil\n}\n\nfunc (s *Source) tailFile(out chan pipeline.Event, t *tomb.Tomb, tail *tail.Tail) error {\n\tlogger := s.logger.WithField(\"tail\", tail.Filename)\n\tlogger.Debug(\"-> start tailing\")\n","sourceCodeStart":261,"sourceCodeEnd":297,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/file/run.go#L261-L297","documentation":"This is the tail.Init failure path in setupTailForFile: the hpcloud/tail library could not start following the file (given Follow, Poll, Location seekInfo options). It wraps the tail library's own error, which commonly is that the file no longer exists or can't be re-opened by the tailer.","triggerScenarios":"tail.TailFile(file, tail.Config{Follow:true, Poll:pollFile, Location:seekInfo, ...}) returns an error in setupTailForFile, called by StreamingAcquisition/checkAndTailFile.","commonSituations":"File deleted between validation and tail init; seek offset (Location) beyond file size after rotation/truncation with incompatible tail mode; permissions revoked; too many open files for the tailer.","solutions":["Read the wrapped tail error in the log for the concrete cause (often 'file not found').","Ensure the file exists and is readable at tail setup time.","If logs rotate aggressively, enable poll_without_inotify / poll mode so rotation is handled gracefully.","Check ulimit -n for the crowdsec process; each tailed file holds a descriptor."],"exampleFix":"// acquis.yaml before\nsource: file\nfilenames:\n  - /var/log/app.log\n// after (tolerate rotation)\nsource: file\nfilenames:\n  - /var/log/app.log\npoll_without_inotify: true","handlingStrategy":"try-catch","validationCode":"function canTail(path) {\n  return fs.existsSync(path) && fs.statSync(path).isFile();\n}","typeGuard":null,"tryCatchPattern":"// retry tail init on transient races\nfor i := 0; i < 3; i++ {\n    if err := setupTailForFile(...); err == nil { break }\n    time.Sleep(time.Second)\n}","preventionTips":["Enable poll mode (poll_without_inotify) for aggressively rotated logs.","Raise ulimit -n for the crowdsec process when tailing many files.","Ensure files exist before acquisition start or use globs to pick them up later."],"tags":["file-io","tail","acquisition","go"],"backgroundTag":"file-not-found","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}