crowdsecurity/crowdsec · error · QueryFail

expired decisions: %w

Error message

expired decisions: %w

What it means

Returned by QueryExpiredDecisionsWithFilters when the final .All(ctx) SELECT of expired decisions fails. Wraps QueryFail ("unable to query"); the raw DB error is logged as 'QueryExpiredDecisionsWithFilters : <err>' right before return.

Source

Thrown at pkg/database/decisions.go:97

			decision.UntilLT(now),
		)
	// Allow a bouncer to ask for non-deduplicated results
	if v, ok := filter["dedup"]; !ok || v[0] != "false" {
		query = query.Where(longestDecisionForScopeTypeValue)
	}

	query, err := applyDecisionFilter(query, filter)
	if err != nil {
		c.Log.Warningf("QueryExpiredDecisionsWithFilters : %s", err)
		return []*ent.Decision{}, fmt.Errorf("get expired decisions with filters: %w", QueryFail)
	}

	query = query.Order(ent.Asc(decision.FieldID))

	data, err := query.All(ctx)
	if err != nil {
		c.Log.Warningf("QueryExpiredDecisionsWithFilters : %s", err)
		return []*ent.Decision{}, fmt.Errorf("expired decisions: %w", QueryFail)
	}

	return data, nil
}

func (c *Client) QueryDecisionCountByScenario(ctx context.Context) ([]*DecisionsByScenario, error) {
	query := c.Ent.Decision.Query().Where(
		decision.UntilGT(time.Now().UTC()),
	)

	query, err := applyDecisionFilter(query, make(map[string][]string))
	if err != nil {
		c.Log.Warningf("QueryDecisionCountByScenario : %s", err)
		return nil, fmt.Errorf("count all decisions with filters: %w", QueryFail)
	}

	var r []*DecisionsByScenario

View on GitHub (pinned to 909b515798)

Solutions

1. Inspect CrowdSec logs for the driver error above the warning line
2. Verify schema is up to date after upgrades (`cscli db migrate` or fresh container start performs migrations)
3. Free disk space / check the DB server health if MySQL/Postgres reports I/O errors
4. For SQLite contention, move to a MySQL/Postgres backend or stagger backups

data, err := client.QueryExpiredDecisionsWithFilters(ctx, now, filter)
if err != nil {
    // transient DB failure likely; retry with backoff
    return backoff.Retry(func() error { _, err = client.QueryExpiredDecisionsWithFilters(ctx, now, filter); return err }, expBackoff)
}

When it happens

Trigger: Database-level failure while reading expired decisions: connection lost, SQLite lock/corruption, schema mismatch after upgrade, or storage backend outage.

Common situations: CrowdSec upgraded but the decisions table lacks a column expected by the new ent schema; DB disk full; concurrent vacuum/backup holds the SQLite write lock.

Understand the failure class

Background: Database query failed: Internal Server Error 500s wrapping SQL, Prisma, and connection failures — what to check first — this error's family across 16 libraries.

Related errors

• unable to query alerts for uuid %s: %w
• while getting alert: %w
• while getting decision: %w
• select config item: %w: %w
• count all decisions with filters: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/0cbdcd059f305c82. Report an issue: GitHub.