crowdsecurity/crowdsec · error

could not remove all inotify watches: %w

Error message

could not remove all inotify watches: %w

What it means

monitorNewFiles, on shutdown (tomb dying), closes the inotify watcher; if watcher.Close fails (watches cannot be removed) the streaming loop returns this error instead of exiting cleanly. Rare OS-level cleanup failure during acquisition stop.

Source

Thrown at pkg/acquisition/modules/file/run.go:183

					continue
				}

				for _, file := range files {
					_ = s.checkAndTailFile(file, logger, out, t)
				}
			}

		case err, ok := <-s.watcher.Errors:
			if !ok {
				return nil
			}

			logger.Errorf("Error while monitoring folder: %s", err)

		case <-t.Dying():
			err := s.watcher.Close()
			if err != nil {
				return fmt.Errorf("could not remove all inotify watches: %w", err)
			}

			return nil
		}
	}
}

func (s *Source) setupTailForFile(file string, out chan pipeline.Event, seekEnd bool, t *tomb.Tomb) error {
	logger := s.logger.WithField("file", file)

	if s.isExcluded(file) {
		return nil
	}

	// Check if we're already tailing
	s.tailMapMutex.RLock()

	if s.tails[file] {

View on GitHub (pinned to 909b515798)

Solutions

1. Usually transient; restart crowdsec
2. Check system logs for inotify/kernel issues if it recurs

When it happens

Trigger: Thrown at pkg/acquisition/modules/file/run.go:183 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/e52146f97336d721. Report an issue: GitHub.