crowdsecurity/crowdsec · error

error tailing logs: %w

Error message

error tailing logs: %w

What it means

The VictoriaLogs datasource client failed to issue the HTTP GET for the `/select/logsql/tail` live-tailing endpoint. After exhausting its retry allowance (`shouldRetry()` returned false), `Tail` wraps the underlying transport error (DNS failure, connection refused, TLS error, canceled/deadline context other than plain cancel) and gives up. CrowdSec surfaces this wrapped chain to the caller `getResponseChan`.

Source

Thrown at pkg/acquisition/modules/victorialogs/internal/vlclient/vl_client.go:325

	lc.Logger.Debugf("Since: %s (%s)", lc.config.Since, t)
	lc.Logger.Infof("Connecting to %s", u)

	var (
		resp *http.Response
		err  error
	)

	for {
		resp, err = lc.Get(ctx, u)
		lc.Logger.Tracef("Tail request done: %v | %s", resp, err)

		if err != nil {
			if errors.Is(err, context.Canceled) {
				return nil, nil
			}

			if ok := lc.shouldRetry(); !ok {
				return nil, fmt.Errorf("error tailing logs: %w", err)
			}

			continue
		}

		break
	}

	if resp.StatusCode != http.StatusOK {
		lc.Logger.Warnf("bad HTTP response code for tail request: %d", resp.StatusCode)
		body, _ := io.ReadAll(resp.Body)
		resp.Body.Close()

		if ok := lc.shouldRetry(); !ok {
			return nil, fmt.Errorf("bad HTTP response code: %d: %s: %w", resp.StatusCode, string(body), err)
		}
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Verify VictoriaLogs is reachable: `curl '<url>/health'` from the crowdsec host.
2. Check the `url` and `prefix` fields in the victorialogs acquisition config for typos or wrong scheme/port.
3. Inspect the wrapped inner error in the log to distinguish DNS vs connection-refused vs TLS and fix accordingly.
4. If using TLS, confirm the CA/cert chain is trusted by the crowdsec process.
5. Restart crowdsec once the endpoint is up; the error occurs only at tail startup.

Example fix

// before (crowdsec acquis.yaml)
url: http://victorialogs:9428
// after
curl -v http://victorialogs:9428/health  # confirm reachability first
# then fix host/port or start VictoriaLogs:
# ./victoria-logs -storageDataPath=/vlstore

// before starting acquisition
resp, err := http.Get(cfg.URL + "/health")
if err != nil || resp.StatusCode != 200 {
    return fmt.Errorf("VictoriaLogs %s unreachable: %v", cfg.URL, err)
}

if err != nil {
    var ctxErr bool = errors.Is(err, context.Canceled) || errors.Is(err, context.DeadlineExceeded)
    if !ctxErr {
        // log wrapped cause and back off / retry with limiter
    }
}

When it happens

Trigger: `lc.Get(ctx, tailURL)` returns a non-`context.Canceled` error and `shouldRetry()` is false: VictoriaLogs host unreachable, wrong URL/port in the acquisition config, TLS handshake failure, DNS resolution failure, or the tomb/goroutine group already dying so retries are disabled.

Common situations: VictoriaLogs is not running or listening on the configured URL; a proxy/firewall blocks the tail endpoint; typos in `url:` or `prefix:` in the acquis yaml; the machine loses network connectivity during startup; the tail request deadline expires because the server is slow.

Understand the failure class

Background: 'Something went wrong' / 'Request failed (500)' / 'HTTP error! status: 404' — what failed HTTP requests actually mean and how to find the real cause — this error's family across 28 libraries.

Related errors

• querying range: %w
• error querying range: %w
• bad HTTP response code: %d: %s: %w
• cannot read line in response: %w
• error while reading tail response: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/54f4abcd45b40434. Report an issue: GitHub.