crowdsecurity/crowdsec · error

empty profiles path

Error message

empty profiles path

What it means

LocalApiServerCfg.LoadProfiles needs ProfilesPath (from 'profiles_path' in the API server section) to locate the profiles YAML that defines alert remediation behavior. An empty path means the profiles file was never configured, so loading cannot even start.

Source

Thrown at pkg/csconfig/profiles.go:37

// var OnErrorApply = "apply"
// var OnErrorIgnore = "ignore"

// Profile structure(s) are used by the local API to "decide" what kind of decision should be applied when a scenario with an active remediation has been triggered
type ProfileCfg struct {
	Name          string            `yaml:"name,omitempty"`
	Debug         *bool             `yaml:"debug,omitempty"`
	Filters       []string          `yaml:"filters,omitempty"` // A list of OR'ed expressions. the models.Alert object
	Decisions     []models.Decision `yaml:"decisions,omitempty"`
	DurationExpr  string            `yaml:"duration_expr,omitempty"`
	OnSuccess     string            `yaml:"on_success,omitempty"` // continue or break
	OnFailure     string            `yaml:"on_failure,omitempty"` // continue or break
	OnError       string            `yaml:"on_error,omitempty"`   // continue, break, error, report, apply, ignore
	Notifications []string          `yaml:"notifications,omitempty"`
}

func (c *LocalApiServerCfg) LoadProfiles() error {
	if c.ProfilesPath == "" {
		return errors.New("empty profiles path")
	}

	patcher := csyaml.NewPatcher(c.ProfilesPath, ".local")

	fcontent, err := patcher.PrependedPatchContent()
	if err != nil {
		return err
	}

	reader := bytes.NewReader(fcontent)

	dec := yaml.NewDecoder(reader)
	dec.KnownFields(true)

	for {
		t := ProfileCfg{}

		err = dec.Decode(&t)

View on GitHub (pinned to 909b515798)

Solutions

1. Add 'profiles_path: /etc/crowdsec/profiles.yaml' under api.server in the config file
2. Create the profiles.yaml file if it does not exist (copy config/profiles.yaml from the repo as a starting point)
3. Ensure the path points to an existing readable file, since the next step is patching/reading it

Example fix

// before
api:
  server:
    enabled: true

// after
api:
  server:
    enabled: true
    profiles_path: /etc/crowdsec/profiles.yaml

if cfg.API.Server != nil && cfg.API.Server.ProfilesPath == "" {
    return fmt.Errorf("api.server.profiles_path must be set for LAPI")
}

if err := cfg.API.Server.LoadProfiles(); err != nil {
    if strings.Contains(err.Error(), "empty profiles path") {
        log.Fatal("set api.server.profiles_path in the LAPI config")
    }
    return err
}

When it happens

Trigger: api.server section without 'profiles_path:'; calling LoadProfiles on a manually constructed LocalApiServerCfg; a config where the profiles_path key was deleted or never present.

Common situations: Hand-rolled LAPI configs; container images assembled from partial config snippets; users upgrading and dropping the profiles_path line.

Understand the failure class

Background: "missing required config value" errors: why libraries refuse to start when a configuration key is empty, unset, or blank — this error's family across 48 libraries.

Related errors

• zero profiles loaded for LAPI
• while loading profiles for LAPI: %w
• no listen_uri or listen_socket specified
• no API client section in configuration
• missing token value for api.server.auto_register

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/e699eafac2a174ce. Report an issue: GitHub.