crowdsecurity/crowdsec · error

can't access parsing configuration file %s : %s

Error message

can't access parsing configuration file %s : %s

What it means

Wraps an os.Open failure when reading a parser stage YAML file in processStageFile. Unlike 1215, the file stat'ed OK but opening it failed — typically a permission problem (or a race where the file vanished between stat and open). CrowdSec aborts loading that stage file because the YAML cannot be read.

Source

Thrown at pkg/parser/stage.go:86

	if !strings.HasSuffix(stageFile.Filename, ".yaml") && !strings.HasSuffix(stageFile.Filename, ".yml") {
		log.Warningf("skip non yaml : %s", stageFile.Filename)
		return nil, nil
	}

	log.Debugf("loading parser file '%s'", stageFile)

	st, err := os.Stat(stageFile.Filename)
	if err != nil {
		return nil, fmt.Errorf("failed to stat %s : %v", stageFile, err)
	}

	if st.IsDir() {
		return nil, nil
	}

	yamlFile, err := os.Open(stageFile.Filename)
	if err != nil {
		return nil, fmt.Errorf("can't access parsing configuration file %s : %s", stageFile.Filename, err)
	}
	defer yamlFile.Close()
	// process the yaml
	dec := yaml.NewDecoder(yamlFile)
	dec.SetStrict(true)

	var nodes []Node

	nodesCount := 0

	for {
		node := Node{}
		node.OnSuccess = "continue" // default behavior is to continue

		if err = dec.Decode(&node); err != nil {
			if errors.Is(err, io.EOF) {
				log.Tracef("End of yaml file")
				break

View on GitHub (pinned to 909b515798)

Solutions

1. Check file ownership/permissions: `ls -l <file>` and ensure the crowdsec user can read it
2. Restore proper SELinux context (`restorecon -Rv /etc/crowdsec`) if SELinux denied the open
3. Re-copy the parser file with correct ownership from the hub
4. Reinstall the parser via cscli to replace a corrupted local file

Example fix

// before
-rw------- root root /etc/crowdsec/parsers/s01-parse/custom.yaml
// after
chown crowdsec:crowdsec /etc/crowdsec/parsers/s01-parse/custom.yaml
chmod 640 /etc/crowdsec/parsers/s01-parse/custom.yaml

f, err := os.Open(path)
if err != nil { return fmt.Errorf("cannot read parser file %s: %w", path, err) }
f.Close()

func readableBy(path string, uid uint32) bool { info, err := os.Stat(path); return err == nil && info.Mode().Perm()&0400 != 0 }

if _, err := processStageFile(sf, pctx, ectx); err != nil {
    log.Errorf("stage load failed: %v", err) // check perms/SELinux
}

When it happens

Trigger: Calling processStageFile (via LoadStages) when os.Open(stageFile.Filename) returns an error: file not readable by the crowdsec user, SELinux/AppArmor denial, or file removed between Stat and Open.

Common situations: Config files owned by root with 0600 while crowdsec runs as the crowdsec user, hardened SELinux contexts after manual copy of parser files, read-only or FUSE mounts denying open.

Understand the failure class

Background: "open() failed", "failed to open file", "cannot create file" — what a file open error means and how to fix it — this error's family across 42 libraries.

Related errors

• while opening %s: %w
• failed to open feature flags file: %w
• failed to stat %s : %v
• while getting process attributes: both plugin user and group
• could not access CRL file: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/99051bdbf8ac3929. Report an issue: GitHub.