What causes "error when starting acquisition: %w" in crowdsecurity/crowdsec?

Look at the wrapped cause beneath this message — fix that root error first (connectivity, query, auth).

error when starting acquisition: %w

Error message

error when starting acquisition: %w

What it means

One-shot acquisition failed to obtain its log channel: the wrapped error comes from `getResponseChan`, i.e. from `Client.Tail` (in TAIL_MODE) when starting the tail request, or the query machinery in range mode. It is a wrapper around the lower-level transport/HTTP failure.

Source

Thrown at pkg/acquisition/modules/victorialogs/run.go:34

// OneShotAcquisition reads a set of file and returns when done
func (s *Source) OneShotAcquisition(ctx context.Context, out chan pipeline.Event, t *tomb.Tomb) error {
	s.logger.Debug("VictoriaLogs one shot acquisition")
	s.Client.SetTomb(t)

	readyCtx, cancel := context.WithTimeout(ctx, s.Config.WaitForReady)
	defer cancel()

	err := s.Client.Ready(readyCtx)
	if err != nil {
		return fmt.Errorf("VictoriaLogs is not ready: %w", err)
	}

	ctx, cancel = context.WithCancel(ctx)
	defer cancel()

	respChan, err := s.getResponseChan(ctx, false)
	if err != nil {
		return fmt.Errorf("error when starting acquisition: %w", err)
	}

	for {
		select {
		case <-t.Dying():
			s.logger.Debug("VictoriaLogs one shot acquisition stopped")
			return nil
		case resp, ok := <-respChan:
			if !ok {
				s.logger.Info("VictoriaLogs acquisition completed")
				return nil
			}

			s.readOneEntry(resp, s.Config.Labels, out)
		}
	}
}

View on GitHub (pinned to 909b515798)

Solutions

Look at the wrapped cause beneath this message — fix that root error first (connectivity, query, auth).
If one-shot mode should be a fixed historical read, don't use `mode: tail`; use the default query mode so `QueryRange` is used.
Confirm VictoriaLogs health and URL before running one-shot acquisition.
Retry after transient network issues; the error occurs at startup, not mid-stream.
Validate the LogsQL `query` against the server directly.

Example fix

// before (acquis.yaml)
mode: tail
// after
# omit 'mode' (default query range) for one-shot backfills:
# mode: query

Defensive patterns

Strategy: try-catch

Validate before calling

// pre-flight: health + reachability
if err := probe(cfg.URL); err != nil { return err }

Try / catch

if err := oneShot(ctx); err != nil {
    var tailErr *vlclient.TailError
    if errors.As(err, &tailErr) { /* fix connectivity/query per wrapped cause */ }
    return err
}

Prevention

Run one-shot acquisition only after confirming server health
Avoid tail mode for historical backfills
Log and inspect the wrapped root error, not the wrapper
Validate query syntax before the run

When it happens

Trigger: `s.getResponseChan(ctx, false)` returns an error — in tail mode a transport failure or exhausted-retry HTTP error from `Client.Tail`; anything the tail client surfaces, such as connection refused or a 4xx/5xx after retries.

Common situations: `cscli` one-shot read configured with `mode: tail` against an unreachable or rejecting VictoriaLogs; transient network outage during a backfill run; bad query rejected by the server.

Understand the failure class

Background: "API request failed": what wrapped HTTP errors from external APIs mean and how to find the real cause — this error's family across 29 libraries.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/f488e93075bef04b. Report an issue: GitHub.