{"record":{"id":"d667a29f09fa0048","repo":"crowdsecurity/crowdsec","slug":"bad-http-response-code-d-s-w-d667a2","errorCode":null,"errorMessage":"bad HTTP response code: %d: %s: %w","messagePattern":"bad HTTP response code: (.+?): (.+?): %w","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/victorialogs/internal/vlclient/vl_client.go","lineNumber":141,"sourceCode":"\t\tcase <-ticker.C:\n\t\t\tresp, err := lc.Get(ctx, uri)\n\t\t\tif err != nil {\n\t\t\t\tif ok := lc.shouldRetry(); !ok {\n\t\t\t\t\treturn fmt.Errorf(\"querying range: %w\", err)\n\t\t\t\t}\n\n\t\t\t\tlc.increaseTicker(ticker)\n\n\t\t\t\tcontinue\n\t\t\t}\n\n\t\t\tif resp.StatusCode != http.StatusOK {\n\t\t\t\tlc.Logger.Warnf(\"bad HTTP response code for query range: %d\", resp.StatusCode)\n\t\t\t\tbody, _ := io.ReadAll(resp.Body)\n\t\t\t\tresp.Body.Close()\n\n\t\t\t\tif ok := lc.shouldRetry(); !ok {\n\t\t\t\t\treturn fmt.Errorf(\"bad HTTP response code: %d: %s: %w\", resp.StatusCode, string(body), err)\n\t\t\t\t}\n\n\t\t\t\tlc.increaseTicker(ticker)\n\n\t\t\t\tcontinue\n\t\t\t}\n\n\t\t\tn, largestTime, err := lc.readResponse(ctx, resp, c)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"querying range: %w\", err)\n\t\t\t}\n\n\t\t\tif !infinite && n < lc.config.Limit {\n\t\t\t\tlc.Logger.Infof(\"Got less than %d results (%d), stopping\", lc.config.Limit, n)\n\t\t\t\tclose(c)\n\n\t\t\t\treturn nil\n\t\t\t}","sourceCodeStart":123,"sourceCodeEnd":159,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/victorialogs/internal/vlclient/vl_client.go#L123-L159","documentation":"doQueryRange treats any non-200 HTTP status from VictoriaLogs as a failure. After the retry budget is exhausted it returns \"bad HTTP response code: %d: %s: %w\" including the status code and response body. Note it wraps `err`, which is typically nil at this point, so the final %w adds no extra cause.","triggerScenarios":"VictoriaLogs responds with 4xx/5xx to the query_range request and shouldRetry() returns false — e.g. 400 for a malformed query, 401/403 when authentication is required, 429 on rate limit, 500 on server error.","commonSituations":"Wrong query expression in the DSN (bad MetricsQL/LogsQL), missing auth credentials against a protected instance, overloaded VictoriaLogs returning 5xx, or a reverse proxy returning 404 for a wrong path.","solutions":["Read the embedded response body in the error message — it usually states the exact server-side problem","Verify the URL path points at VictoriaLogs' query range endpoint (e.g. /select/logsql/query_range)","Add or fix authentication credentials if the instance is protected (401/403)","Fix the LogsQL query parameters in the DSN if the server returns 400","Increase max_failure_duration if 429 rate limiting is transient"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// verify endpoint and auth upfront\nconst res = await fetch(baseURL + \"/select/logsql/query_range\", { headers: authHeaders() })\nif (res.status === 401 || res.status === 403) throw new Error(\"check credentials\")","typeGuard":null,"tryCatchPattern":"try {\n  await runAcquisition()\n} catch (e) {\n  const m = /bad HTTP response code: (\\d+)/.exec(String(e))\n  if (m && m[1] === \"429\") await sleep(backoff)\n  else if (m) log.error(\"VictoriaLogs returned\", m[1], e.message)\n  else throw e\n}","preventionTips":["Read the response body embedded in the error for the server's diagnosis","Validate LogsQL query syntax against the VictoriaLogs version in use","Configure credentials if the instance sits behind auth"],"tags":["http","victorialogs","server-error"],"backgroundTag":"http-error-response","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}