{"record":{"id":"d68d9bde1e20fcdb","repo":"crowdsecurity/crowdsec","slug":"while-replacing-allowlist-s-s","errorCode":null,"errorMessage":"while replacing allowlist %s: %s","messagePattern":"while replacing allowlist (.+?): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/apiserver/apic.go","lineNumber":775,"sourceCode":"\t}\n\n\tlist, err := a.dbClient.GetAllowListByID(ctx, *link.ID, false)\n\tif err != nil {\n\t\tif !ent.IsNotFound(err) {\n\t\t\treturn fmt.Errorf(\"while getting allowlist %s: %s\", *link.Name, err)\n\t\t}\n\t}\n\n\tif list == nil {\n\t\tlist, err = a.dbClient.CreateAllowList(ctx, *link.Name, description, *link.ID, true)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"while creating allowlist %s: %s\", *link.Name, err)\n\t\t}\n\t}\n\n\tadded, err := a.dbClient.ReplaceAllowlist(ctx, list, items, true)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while replacing allowlist %s: %s\", *link.Name, err)\n\t}\n\n\tlog.Infof(\"added %d values to allowlist %s\", added, list.Name)\n\n\tif list.Name != *link.Name || list.Description != description {\n\t\terr = a.dbClient.UpdateAllowlistMeta(ctx, *link.ID, *link.Name, description)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"while updating allowlist meta %s: %s\", *link.Name, err)\n\t\t}\n\t}\n\n\tlog.Infof(\"Allowlist %s updated\", *link.Name)\n\n\treturn nil\n}\n\nfunc (a *apic) UpdateAllowlists(ctx context.Context, allowlistsLinks []*modelscapi.AllowlistLink, forcePull bool) error {\n\tif len(allowlistsLinks) == 0 {","sourceCodeStart":757,"sourceCodeEnd":793,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/apiserver/apic.go#L757-L793","documentation":"After ensuring the allowlist exists, the sync calls ReplaceAllowlist(ctx, list, items, true) to atomically replace the list's contents with the freshly pulled items. This error wraps a failure of that bulk replace, so the allowlist content in the local DB was not updated from the downloaded payload.","triggerScenarios":"ReplaceAllowlist fails during a scheduled or forced allowlist pull: DB transaction error while deleting+reinserting all items, connection loss mid-transaction, constraint violation on item values, or empty/invalid items causing a write error.","commonSituations":"SQLite lock contention (backup, another crowdsec component) during the transaction; disk full when replacing a large allowlist; DB connection dropped during a long pull; schema mismatch after an upgrade.","solutions":["Read the wrapped %s message to determine transaction vs constraint vs connection failure","Check for SQLite lock/disk-space issues and retry the sync after resolving","Restart crowdsec to reset DB connections, then re-run (or wait for the periodic pull)","Verify DB schema is up to date (cscli dbstatus / proper upgrade path)","If a specific item value is rejected, inspect the pulled payload for malformed entries"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// verify the pull succeeded and items look sane before replace\nif len(items) == 0 {\n    return fmt.Errorf(\"allowlist %s: pulled 0 items, refusing to replace\", *link.Name)\n}","typeGuard":null,"tryCatchPattern":"err := a.updateOneAllowlist(ctx, client, link)\nif err != nil && strings.Contains(err.Error(), \"while replacing allowlist\") {\n    // transient DB issues (locks, lost connections) are common here — back off and retry\n    time.Sleep(30 * time.Second)\n    if retryErr := a.updateOneAllowlist(ctx, client, link); retryErr != nil {\n        log.Errorf(\"allowlist replace failed after retry: %s\", retryErr)\n    }\n}","preventionTips":["Schedule allowlist syncs away from DB backup/vacuum windows","Ensure sufficient disk space for large allowlist replacements","Wait for the periodic pull to retry rather than forcing rapid re-syncs during DB contention","Keep the DB schema current with the crowdsec version"],"tags":["database","allowlist","transaction","replace"],"backgroundTag":"database-write-failed","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}