What causes "can't enable %s: not downloaded" in crowdsecurity/crowdsec?

Download the item first: `cscli hub update` then `cscli install ` (install downloads then enables).

can't enable %s: not downloaded

Error message

can't enable %s: not downloaded

What it means

The enable operation requires the item to already be downloaded (present in the hub's data/tarmac directory, checked via i.State.IsDownloaded()). Enabling only links an existing download into the install dir; this error means that prerequisite is missing. The code itself flags with XXX that this might warrant warning severity.

Source

Thrown at pkg/hubops/enable.go:87

	src := i.State.DownloadPath

	if err = os.Symlink(src, dest); err != nil {
		return fmt.Errorf("while creating symlink from %s to %s: %w", src, dest, err)
	}

	i.State.LocalPath = dest

	return nil
}

func (c *EnableCommand) Run(_ context.Context, plan *ActionPlan) error {
	i := c.Item

	fmt.Fprintln(os.Stdout, "enabling " + colorizeItemName(i.FQName()))

	if !i.State.IsDownloaded() {
		// XXX: this a warning?
		return fmt.Errorf("can't enable %s: not downloaded", i.FQName())
	}

	if err := CreateInstallLink(i); err != nil {
		return fmt.Errorf("while enabling %s: %w", i.FQName(), err)
	}

	plan.ReloadNeeded = true

	i.State.Tainted = false

	return nil
}

func (*EnableCommand) OperationType() string {
	return "enable"
}

func (c *EnableCommand) ItemType() string {

View on GitHub (pinned to 909b515798)

Solutions

Download the item first: `cscli hub update` then `cscli <type> install <item>` (install downloads then enables).
Verify the item state with `cscli <type> inspect <item>` (check DownloadPath/IsDownloaded fields).
If the file was manually deleted, reinstall the item to restore it.
Check for prior download failures in the logs (network/permissions) and fix the root cause.

Example fix

// before
cscli parsers enable crowdsecurity/http-logs   # can't enable: not downloaded
// after
cscli hub update
cscli parsers install crowdsecurity/http-logs   # downloads, then enables

Defensive patterns

Strategy: validation

Validate before calling

st, err := cscliInspect(itemType, itemName)
if err != nil || !st.Downloaded {
    return fmt.Errorf("item %s not downloaded; run install first", itemName)
}

Try / catch

if err := enableItem(name); err != nil {
    if strings.Contains(err.Error(), "not downloaded") {
        return installItem(name) // install downloads then enables
    }
    return err
}

Prevention

Use `cscli <type> install` (download + enable) instead of bare enable for fresh items.
Always run `cscli hub update` before managing items on a fresh host.
Verify item state with `cscli <type> inspect <item>` before enabling.
Don't manually delete files under the hub data directory; use cscli remove instead.

When it happens

Trigger: Running `cscli <type> enable <item>` on an item that was listed (via `hub list`/`install`) but never downloaded — e.g. `taint`-free list entry with no matching file in the hub data dir, or the download step was skipped/failed earlier.

Common situations: Fresh install where the user enables before any `hub update`/download completed; the item's download previously failed (see errors 1092/1094); manual deletion of files under /var/lib/crowdsec/data; hub index and data dir out of sync.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/80c2c8a152b2669c. Report an issue: GitHub.