crowdsecurity/crowdsec · critical

failed to compile profiles: %w

Error message

failed to compile profiles: %w

What it means

Returned by the v1 alerts/profiles controller constructor when csprofiles.NewProfile fails to compile the profile configuration (invalid YAML structure, bad filter expressions, wrong profile keys). The constructor refuses to build a Controller without valid profiles, so the API server aborts startup with this wrapped error.

Source

Thrown at pkg/apiserver/controllers/v1/controller.go:47

type ControllerV1Config struct {
	DbClient    *database.Client
	ProfilesCfg []*csconfig.ProfileCfg

	AlertsAddChan      chan []*models.Alert
	DecisionDeleteChan chan []*models.Decision

	PluginChannel   chan models.ProfileAlert
	ConsoleConfig   csconfig.ConsoleConfig
	TrustedIPs      []net.IPNet
	AutoRegisterCfg *csconfig.LocalAPIAutoRegisterCfg
}

func New(cfg *ControllerV1Config) (*Controller, error) {
	var err error

	profiles, err := csprofiles.NewProfile(cfg.ProfilesCfg)
	if err != nil {
		return &Controller{}, fmt.Errorf("failed to compile profiles: %w", err)
	}

	v1 := &Controller{
		DBClient:           cfg.DbClient,
		APIKeyHeader:       middlewares.APIKeyHeader,
		Profiles:           profiles,
		AlertsAddChan:      cfg.AlertsAddChan,
		DecisionDeleteChan: cfg.DecisionDeleteChan,
		PluginChannel:      cfg.PluginChannel,
		ConsoleConfig:      cfg.ConsoleConfig,
		TrustedIPs:         cfg.TrustedIPs,
		AutoRegisterCfg:    cfg.AutoRegisterCfg,
	}

	v1.Middlewares, err = middlewares.NewMiddlewares(cfg.DbClient)
	if err != nil {
		return v1, err
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Run 'cscli capi check' or validate the profiles section with crowdsec in dry/debug mode to find the exact profile and expression failing
2. Fix the YAML syntax / filter expression in the profiles section of your config (usually /etc/crowdsec/config.yaml or profiles.yaml)
3. Restore a known-good default profiles file from the crowdsec distribution
4. If the error mentions an expression, test the filter with 'cscli explain' or the exprhelpers sandbox before restarting

Example fix

// before (config.yaml profiles)
profiles:
  - name: bad_filter
    filters:
      - Alert.Remediation == true && not_a_field
// after
profiles:
  - name: valid_filter
    filters:
      - Alert.Remediation == true && Alert.GetScope() == 'ip'

// before starting the API server, compile profiles the same way the controller does
profiles, err := csprofiles.NewProfile(cfg.ProfilesCfg)
if err != nil {
    return fmt.Errorf("startup aborted, fix profiles config: %w", err)
}

if err := server.Start(); err != nil {
    if strings.Contains(err.Error(), "failed to compile profiles") {
        log.Fatalf("profiles config invalid, check profiles section: %v", err)
    }
}

When it happens

Trigger: NewV1 -> New is called during API server startup with cfg.ProfilesCfg loaded from config.yaml's 'profiles' section; csprofiles.NewProfile returns an error (unparseable profile filter, invalid duration in 'decisions_since', bad expression syntax) and the constructor wraps it.

Common situations: Operator hand-edits profile.yaml/config.yaml and introduces a YAML type error or an invalid expr filter like 'not a valid expr'; upgrading crowdsec with an old config using removed profile fields; wrong file passed as profiles config.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• while loading profiles for LAPI: %w
• empty cti key
• cannot use TLS with a unix socket
• user/password authentication and TLS authentication are mutu
• no listen_uri or listen_socket specified

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/7814a8c5e9ffa737. Report an issue: GitHub.