crowdsecurity/crowdsec · error

failed creating schema resources: %w

Error message

failed creating schema resources: %w

What it means

NewClient wraps the error from client.Schema.Create (ent auto-migration) when the database schema tables/indexes could not be created or updated. The connection succeeded but DDL against the database failed — typically permissions or a corrupt/incompatible existing schema.

Source

Thrown at pkg/database/database.go:117

	if err != nil {
		return nil, fmt.Errorf("failed to generate DB connection string: %w", err)
	}

	drv, err := getEntDriver(typ, dia, dbConnectionString, config)
	if err != nil {
		return nil, fmt.Errorf("failed opening connection to %s: %w", config.Type, err)
	}

	client = ent.NewClient(ent.Driver(drv), entOpt)

	if config.LogLevel >= log.DebugLevel {
		logger.Debugf("Enabling request debug")

		client = client.Debug()
	}

	if err = client.Schema.Create(ctx, dropLegacyIndex("decisions", "decision_value")); err != nil {
		return nil, fmt.Errorf("failed creating schema resources: %w", err)
	}

	return &Client{
		Ent:              client,
		Log:              logger,
		Type:             config.Type,
		WalMode:          config.UseWal,
		decisionBulkSize: config.DecisionBulkSize,
	}, nil
}

func (c *Client) Close() error {
	return c.Ent.Close()
}

View on GitHub (pinned to 909b515798)

Solutions

1. Grant the DB user CREATE/ALTER privileges on the crowdsec database.
2. Check the wrapped inner error for the failing statement and the conflicting table/index.
3. For sqlite, run integrity checks (PRAGMA integrity_check) or restore from backup.
4. Back up, then manually drop the conflicting legacy index/table before restarting.

Example fix

// before (restricted user)
GRANT SELECT, INSERT, UPDATE, DELETE ON crowdsec.* TO 'crowdsec'@'%';
// after
GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, ALTER, INDEX, DROP ON crowdsec.* TO 'crowdsec'@'%';

// verify privileges before startup, e.g. for mysql:
// SHOW GRANTS FOR 'crowdsec'@'%';  must include CREATE, ALTER, INDEX, DROP

client, err := database.NewClient(ctx, cfg)
if err != nil {
    var schemaErr error
    if strings.Contains(err.Error(), "failed creating schema resources") {
        return fmt.Errorf("db user lacks DDL rights or schema conflict: %w", err)
    }
    return err
}

When it happens

Trigger: First startup against a fresh DB where the user lacks CREATE privileges; startup against an existing DB whose schema conflicts (e.g. legacy index drop like dropLegacyIndex("decisions","decision_value") fails); read-only DB user; disk full on sqlite.

Common situations: Running crowdsec with a DB user that can connect but not ALTER/CREATE; a sqlite file corrupted after a crash; schema created by a much older crowdsec version that auto-migration can't reconcile; an old leftover index blocking migration.

Related errors

• invalid schema name
• no database configuration provided
• unable to update
• unable to delete
• object not found

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/7accd988574b4b97. Report an issue: GitHub.