What causes "failed opening %s: %w" in crowdsecurity/crowdsec?

Verify the path: run `ls -l ` exactly as passed on the command line.

failed opening %s: %w

Error message

failed opening %s: %w

What it means

readFile is the one-shot (-reader / cscli replay) path: it opens the given log file to replay its lines. If os.Open fails, it returns "failed opening %s: %w". The named file simply could not be opened for reading.

Source

Thrown at pkg/acquisition/modules/file/run.go:376

			// we're tailing, it must be real time logs
			logger.Debugf("pushing %+v", l)

			evt := pipeline.MakeEvent(s.config.UseTimeMachine, pipeline.LOG, true)
			evt.Line = l

			out <- evt
		}
	}
}

func (s *Source) readFile(ctx context.Context, filename string, out chan pipeline.Event) error {
	var scanner *bufio.Scanner

	logger := s.logger.WithField("oneshot", filename)

	fd, err := os.Open(filename)
	if err != nil {
		return fmt.Errorf("failed opening %s: %w", filename, err)
	}

	defer fd.Close()

	if strings.HasSuffix(filename, ".gz") {
		gz, err := gzip.NewReader(fd)
		if err != nil {
			logger.Errorf("Failed to read gz file: %s", err)
			return fmt.Errorf("failed to read gz %s: %w", filename, err)
		}

		defer gz.Close()

		scanner = bufio.NewScanner(gz)
	} else {
		scanner = bufio.NewScanner(fd)
	}

View on GitHub (pinned to 909b515798)

Solutions

Verify the path: run `ls -l <path>` exactly as passed on the command line.
Check read permission on the file and traverse permission on parent directories.
Use an absolute path to avoid cwd confusion.
Check the wrapped OS error: ENOENT = missing file, EACCES = permission.

Example fix

// before
crowdsec -file ./logs/applog.log -type syslog
// after
crowdsec -file /var/log/auth.log -type syslog

Defensive patterns

Strategy: validation

Validate before calling

const fs = require('fs');
if (!fs.existsSync(path) || !fs.statSync(path).isFile()) {
  throw new Error(`replay file not found: ${path}`);
}

Prevention

Always pass absolute paths to -file / cscli replay commands.
Verify with `ls -l` before running one-shot replay.
Check the wrapped OS error to distinguish ENOENT from EACCES.

When it happens

Trigger: os.Open(filename) errors in readFile, invoked by OneShot mode when a user replays a file into crowdsec.

Common situations: Typo in the file path passed to cscli/crowdsec -reader; file not readable by the current user; expecting relative path but running from a different directory.

Understand the failure class

Background: "open() failed", "failed to open file", "cannot create file" — what a file open error means and how to fix it — this error's family across 42 libraries.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/d3357f78b384b1c8. Report an issue: GitHub.