crowdsecurity/crowdsec · error

expected zero or one value for 'max_buffer_size'

Error message

expected zero or one value for 'max_buffer_size'

What it means

DSN validation in S3 ConfigureByDSN: the max_buffer_size query parameter is repeated in the s3:// DSN. Exactly one integer is accepted since it sets the scanner buffer size for reading object contents.

Source

Thrown at pkg/acquisition/modules/s3/config.go:236

			return fmt.Errorf("could not parse s3 args: %w", err)
		}

		for key, value := range params {
			switch key {
			case "log_level":
				if len(value) != 1 {
					return errors.New("expected zero or one value for 'log_level'")
				}

				lvl, err := log.ParseLevel(value[0])
				if err != nil {
					return fmt.Errorf("unknown level %s: %w", value[0], err)
				}

				s.logger.Logger.SetLevel(lvl)
			case "max_buffer_size":
				if len(value) != 1 {
					return errors.New("expected zero or one value for 'max_buffer_size'")
				}

				maxBufferSize, err := strconv.Atoi(value[0])
				if err != nil {
					return fmt.Errorf("invalid value for 'max_buffer_size': %w", err)
				}

				s.logger.Debugf("Setting max buffer size to %d", maxBufferSize)
				s.Config.MaxBufferSize = maxBufferSize
			default:
				return fmt.Errorf("unknown parameter %s", key)
			}
		}
	}

	s.Config.Labels = labels
	s.Config.Mode = configuration.CAT_MODE
	s.Config.UniqueId = uuid

View on GitHub (pinned to 909b515798)

Solutions

1. Pass max_buffer_size once with one integer value, e.g. ?max_buffer_size=131072
2. Increase it when S3 objects contain very long lines that overflow the default bufio.MaxScanTokenSize

When it happens

Trigger: Thrown at pkg/acquisition/modules/s3/config.go:236 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/c692e7feb578e085. Report an issue: GitHub.