{"record":{"id":"cb44b707d58ecca6","repo":"crowdsecurity/crowdsec","slug":"while-getting-decisions-from-blocklist-s-w","errorCode":null,"errorMessage":"while getting decisions from blocklist %s: %w","messagePattern":"while getting decisions from blocklist (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/apiserver/apic.go","lineNumber":973,"sourceCode":"\t}\n\n\tblocklistConfigItemName := fmt.Sprintf(\"blocklist:%s:last_pull\", *blocklist.Name)\n\n\tvar (\n\t\tlastPullTimestamp string\n\t\terr               error\n\t)\n\n\tif !forcePull {\n\t\tlastPullTimestamp, err = a.dbClient.GetConfigItem(ctx, blocklistConfigItemName)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"while getting last pull timestamp for blocklist %s: %w\", *blocklist.Name, err)\n\t\t}\n\t}\n\n\tdecisions, hasChanged, err := client.Decisions.GetDecisionsFromBlocklist(ctx, blocklist, lastPullTimestamp)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while getting decisions from blocklist %s: %w\", *blocklist.Name, err)\n\t}\n\n\tif !hasChanged {\n\t\tif lastPullTimestamp == \"\" {\n\t\t\tlog.Infof(\"blocklist %s hasn't been modified or there was an error reading it, skipping\", *blocklist.Name)\n\t\t} else {\n\t\t\tlog.Infof(\"blocklist %s hasn't been modified since %s, skipping\", *blocklist.Name, lastPullTimestamp)\n\t\t}\n\n\t\treturn nil\n\t}\n\n\terr = a.dbClient.SetConfigItem(ctx, blocklistConfigItemName, time.Now().UTC().Format(http.TimeFormat))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while setting last pull timestamp for blocklist %s: %w\", *blocklist.Name, err)\n\t}\n\n\tif len(decisions) == 0 {","sourceCodeStart":955,"sourceCodeEnd":991,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/apiserver/apic.go#L955-L991","documentation":"Wraps the error from client.Decisions.GetDecisionsFromBlocklist, the CAPI HTTP call that downloads decisions changed since lastPullTimestamp. Failures are network/HTTP-level: unreachable CAPI, non-2xx response, TLS error, or response decode failure.","triggerScenarios":"updateBlocklist calls GetDecisionsFromBlocklist and the request to the blocklist URL fails: DNS failure, connection refused/timeout, HTTP 5xx from CAPI, invalid response body.","commonSituations":"Firewall blocking api.crowdsec.net, no internet access, proxy misconfiguration, CAPI outage or rate limiting, expired/invalid machine credentials.","solutions":["Test connectivity: `cscli capi status` or curl the CAPI URL from the host.","Check proxy/firewall settings and DNS resolution.","Re-register with CAPI if auth fails: `cscli machines` / `cscli capi status`.","Retry later if CAPI is having an outage (status.crowdsec.net)."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"resp, err := http.Head(capiURL)\nif err != nil || resp.StatusCode >= 500 {\n    // postpone pull; CAPI unreachable\n}","typeGuard":null,"tryCatchPattern":"decisions, hasChanged, err := client.Decisions.GetDecisionsFromBlocklist(ctx, blocklist, lastPullTimestamp)\nif err != nil {\n    log.Warnf(\"blocklist pull failed, keeping existing decisions: %v\", err)\n    return nil // decisions from last successful pull remain active\n}","preventionTips":["Run `cscli capi status` in monitoring to catch CAPI outages early.","Ensure outbound HTTPS (443) to api.crowdsec.net is allowed.","Configure proxy env vars correctly if the host sits behind a proxy.","Keep existing decisions active until a pull succeeds."],"tags":["network","http","capi","blocklist","pull"],"backgroundTag":"upstream-api-error","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}