crowdsecurity/crowdsec · error

could not stat file %s : %w

Error message

could not stat file %s : %w

What it means

OneShot of the file source calls os.Stat on each file to read before tailing; the file does not exist or is not statable (permissions, broken symlink), so one-shot read mode cannot proceed and returns the wrapped error.

Source

Thrown at pkg/acquisition/modules/file/run.go:37

	"gopkg.in/tomb.v2"

	"github.com/crowdsecurity/go-cs-lib/trace"

	"github.com/crowdsecurity/crowdsec/pkg/acquisition/configuration"
	"github.com/crowdsecurity/crowdsec/pkg/fsutil"
	"github.com/crowdsecurity/crowdsec/pkg/metrics"
	"github.com/crowdsecurity/crowdsec/pkg/pipeline"
)

const defaultPollInterval = 30 * time.Second

func (s *Source) OneShot(ctx context.Context, out chan pipeline.Event) error {
	s.logger.Debug("In oneshot")

	for _, file := range s.files {
		fi, err := os.Stat(file)
		if err != nil {
			return fmt.Errorf("could not stat file %s : %w", file, err)
		}

		if fi.IsDir() {
			s.logger.Warnf("%s is a directory, ignoring it.", file)
			continue
		}

		s.logger.Infof("reading %s at once", file)

		err = s.readFile(ctx, file, out)
		if err != nil {
			return err
		}
	}

	return nil
}

View on GitHub (pinned to 909b515798)

Solutions

1. Check the file exists and the path is correct
2. Fix read permissions so the crowdsec user can access the file
3. Remove stale entries from the acquisition configuration

When it happens

Trigger: Thrown at pkg/acquisition/modules/file/run.go:37 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/cb3e3f294710713c. Report an issue: GitHub.