{"record":{"id":"c5369268bd66785b","repo":"crowdsecurity/crowdsec","slug":"failed-to-load-postoverflow-config-w","errorCode":null,"errorMessage":"failed to load postoverflow config: %w","messagePattern":"failed to load postoverflow config: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/parser/unix_parser.go","lineNumber":153,"sourceCode":"\t}\n\n\t/*\n\t Load the actual parsers\n\t*/\n\n\tlog.Infof(\"Loading parsers from %d files\", len(parsers.StageFiles))\n\n\tparsers.Nodes, err = LoadStages(parsers.StageFiles, parsers.Ctx, parsers.EnricherCtx)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to load parser config: %w\", err)\n\t}\n\n\tif len(parsers.PovfwStageFiles) > 0 {\n\t\tlog.Info(\"Loading postoverflow parsers\")\n\n\t\tparsers.Povfwnodes, err = LoadStages(parsers.PovfwStageFiles, parsers.PovfwCtx, parsers.EnricherCtx)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to load postoverflow config: %w\", err)\n\t\t}\n\t} else {\n\t\tlog.Info(\"No postoverflow parsers to load\")\n\n\t\tparsers.Povfwnodes = []Node{}\n\t}\n\n\tif cConfig.Prometheus != nil && cConfig.Prometheus.Enabled {\n\t\tparsers.Ctx.Profiling = true\n\t\tparsers.PovfwCtx.Profiling = true\n\t}\n\t/*\n\t\tReset CTX grok to reduce memory footprint after we compile all the patterns\n\t*/\n\tparsers.Ctx.Grok = grokky.Host{}\n\tparsers.PovfwCtx.Grok = grokky.Host{}\n\tparsers.StageFiles = []Stagefile{}\n\tparsers.PovfwStageFiles = []Stagefile{}","sourceCodeStart":135,"sourceCodeEnd":171,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/parser/unix_parser.go#L135-L171","documentation":"LoadStages fails while compiling the postoverflow parser YAML files, and LoadParsers wraps it in \"failed to load postoverflow config\". Postoverflow parsers (whitelisting/rewrites that run after the main stages) live in config/postoverflow/s*/ and are compiled with the PovfwCtx patterns. A single invalid file aborts startup. Only raised when PovfwStageFiles is non-empty.","triggerScenarios":"LoadStages(parsers.PovfwStageFiles, parsers.PovfwCtx, ...) returning an error — a YAML file under /etc/crowdsec/postoverflow/ has bad syntax or a node that fails compilation.","commonSituations":"Hand-edited postoverflow whitelist file with indentation errors; custom postoverflow parser referencing a missing pattern; stale file left after uninstalling a hub collection.","solutions":["Read the wrapped error to find the offending file, fix or delete it under /etc/crowdsec/postoverflow/","Validate the YAML with a linter and re-run crowdsec","Run `cscli hub upgrade` to restore pristine hub postoverflow files","Move custom postoverflow files aside and add them back one by one to isolate the bad one"],"exampleFix":"// before (postoverflow/s00-whitelist/my.yaml)\nwhitelist:\n reason: test\n  expression: evt.Parsed.x == 'y'   # bad indent\n// after\nwhitelist:\n  reason: test\n  expression: evt.Parsed.x == 'y'","handlingStrategy":"try-catch","validationCode":"import \"gopkg.in/yaml.v3\"\nfunc checkPostoverflowDir(dir string) error {\n  return filepath.Walk(dir, func(p string, _ os.FileInfo, err error) error {\n    if err != nil || !strings.HasSuffix(p, \".yaml\") { return err }\n    b, _ := os.ReadFile(p)\n    var m map[string]any\n    return yaml.Unmarshal(b, &m)\n  })\n}","typeGuard":null,"tryCatchPattern":"parsers, err := parser.LoadParsers(cfg)\nif err != nil {\n  if strings.Contains(err.Error(), \"postoverflow config\") {\n    log.Fatalf(\"bad postoverflow yaml: %v\", err)\n  }\n  return err\n}","preventionTips":["Lint postoverflow YAML before restart","Only edit hub-managed files via cscli hub commands","Keep custom postoverflow files minimal and version-controlled"],"tags":["crowdsec","parser","postoverflow","yaml","config"],"backgroundTag":"yaml-parse-error","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}