crowdsecurity/crowdsec · error

cannot read line in response: %w

Error message

cannot read line in response: %w

What it means

readResponse reads the streaming newline-delimited JSON body line by line with a JSON decoder/reader. When a read fails for a reason other than EOF or context cancellation (connection reset, unexpected short read, I/O error), the error is wrapped with "cannot read line in response" and returned to doQueryRange.

Source

Thrown at pkg/acquisition/modules/victorialogs/internal/vlclient/vl_client.go:210

		case <-ctx.Done():
			return n, latestTS, nil
		default:
		}

		b, err := br.ReadBytes('\n')
		if err != nil {
			if errors.Is(err, bufio.ErrBufferFull) {
				lc.Logger.Infof("skipping line number #%d: line too long", n)
				continue
			}

			if errors.Is(err, io.EOF) {
				// b can be != nil when EOF is returned, so we need to process it
				finishedReading = true
			} else if errors.Is(err, context.Canceled) {
				return n, latestTS, nil
			} else {
				return n, latestTS, fmt.Errorf("cannot read line in response: %w", err)
			}
		}

		if len(b) == 0 {
			continue
		}

		b = bytes.Trim(b, "\n")

		var logLine Log

		if err := json.Unmarshal(b, &logLine); err != nil {
			lc.Logger.Warnf("cannot unmarshal line in response: %s", string(b))
			continue
		}

		n++

View on GitHub (pinned to 909b515798)

Solutions

1. Check the wrapped inner error for the root cause (connection reset, unexpected EOF, timeout)
2. Reduce the `limit` in the DSN so responses complete faster and are less likely to be dropped
3. Check intermediate proxies/load balancers idle timeouts for long streaming responses
4. Ensure VictoriaLogs is stable and not restarting during queries

try {
  await runAcquisition()
} catch (e) {
  if (String(e).includes("cannot read line in response")) {
    log.warn("Stream dropped, restarting acquisition", e.message)
    scheduleRestart()
  } else { throw e }
}

When it happens

Trigger: The response body reader returns a non-EOF, non-canceled error mid-stream — e.g. the HTTP connection is reset by VictoriaLogs or a proxy while the acquisition is still reading.

Common situations: Large result sets taking long enough for an idle timeout/load balancer to kill the connection, VictoriaLogs restarting mid-query, proxy or keep-alive misconfiguration dropping long-lived streaming responses.

Related errors

• error while reading tail response: %w
• querying range: %w
• error tailing logs: %w
• unable to read body: %w
• error connecting to websocket

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/474e714e8b601809. Report an issue: GitHub.