crowdsecurity/crowdsec · error

failed to load enrich plugin

Error message

failed to load enrich plugin: %w

What it means

LoadParsers calls Loadplugin() to load enrichment plugins (geoip, goICE, etc.) and wraps any failure in "failed to load enrich plugin". Enrichers are external Go plugins registered to enrich parsed events; if they cannot be loaded, the enricher stage cannot be built and startup fails. The wrapped error names the specific plugin that failed.

Solutions

1. Read the wrapped error to identify the failing plugin and run `cscli hub upgrade` to reinstall its assets
2. If using geoip, download the GeoLite2-City.mmdb / GeoLite2-ASN.mmdb into DataDir as documented
3. Check plugin file permissions and that plugins were built for the running crowdsec version
4. Temporarily remove the failing enricher from the config to isolate the issue

Example fix

// before
$ cscli hub list | grep geoip   # installed but db missing
// after
$ cd /etc/crowdsec && ./cscli hub update && ./cscli hub upgrade
$ ls /var/lib/crowdsec/data/GeoLite2-City.mmdb   # confirm present

// before startup
info, err := os.Stat(filepath.Join(dataDir, "GeoLite2-City.mmdb"))
if err != nil { log.Fatal("geoip database missing; install geoip collection") }

parsers, err := parser.LoadParsers(cfg)
if err != nil {
  var perr *pluginError
  if errors.As(err, &perr) { log.Fatalf("enrich plugin failed: %v", err) }
  return err
}

When it happens

Trigger: Loadplugin() returning an error during LoadParsers — plugin shared object cannot be opened, plugin init fails, or a plugin dependency (e.g. GeoLite2 database file) is missing.

Common situations: Installing the geoip-enrich collection but not downloading the mmdb database; a plugin .so built against an incompatible Go version; read permissions on the plugin/data files; hub installed plugins missing after an upgrade.

Related errors

• failed to load parser config
• failed to load postovflw parser patterns
• appsec is down
• declared range of can't be parsed
• empty grok

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/7b956f6cdcd55b8f. Report an issue: GitHub.

Appendix: source

Thrown at pkg/parser/unix_parser.go:134

	/* load base regexps for two grok parsers */
	parsers.Ctx, err = NewUnixParserCtx(patternDir, cConfig.ConfigPaths.DataDir)
	if err != nil {
		return nil, fmt.Errorf("failed to load parser patterns: %w", err)
	}

	parsers.PovfwCtx, err = NewUnixParserCtx(patternDir, cConfig.ConfigPaths.DataDir)
	if err != nil {
		return nil, fmt.Errorf("failed to load postovflw parser patterns: %w", err)
	}

	/*
		Load enrichers
	*/
	log.Info("Loading enrich plugins")

	parsers.EnricherCtx, err = Loadplugin()
	if err != nil {
		return nil, fmt.Errorf("failed to load enrich plugin: %w", err)
	}

	/*
	 Load the actual parsers
	*/

	log.Infof("Loading parsers from %d files", len(parsers.StageFiles))

	parsers.Nodes, err = LoadStages(parsers.StageFiles, parsers.Ctx, parsers.EnricherCtx)
	if err != nil {
		return nil, fmt.Errorf("failed to load parser config: %w", err)
	}

	if len(parsers.PovfwStageFiles) > 0 {
		log.Info("Loading postoverflow parsers")

		parsers.Povfwnodes, err = LoadStages(parsers.PovfwStageFiles, parsers.PovfwCtx, parsers.EnricherCtx)
		if err != nil {

View on GitHub (pinned to 909b515798)