crowdsecurity/crowdsec · error

failed to load postoverflow config: %w

Error message

failed to load postoverflow config: %w

What it means

LoadStages fails while compiling the postoverflow parser YAML files, and LoadParsers wraps it in "failed to load postoverflow config". Postoverflow parsers (whitelisting/rewrites that run after the main stages) live in config/postoverflow/s*/ and are compiled with the PovfwCtx patterns. A single invalid file aborts startup. Only raised when PovfwStageFiles is non-empty.

Source

Thrown at pkg/parser/unix_parser.go:153

	}

	/*
	 Load the actual parsers
	*/

	log.Infof("Loading parsers from %d files", len(parsers.StageFiles))

	parsers.Nodes, err = LoadStages(parsers.StageFiles, parsers.Ctx, parsers.EnricherCtx)
	if err != nil {
		return nil, fmt.Errorf("failed to load parser config: %w", err)
	}

	if len(parsers.PovfwStageFiles) > 0 {
		log.Info("Loading postoverflow parsers")

		parsers.Povfwnodes, err = LoadStages(parsers.PovfwStageFiles, parsers.PovfwCtx, parsers.EnricherCtx)
		if err != nil {
			return nil, fmt.Errorf("failed to load postoverflow config: %w", err)
		}
	} else {
		log.Info("No postoverflow parsers to load")

		parsers.Povfwnodes = []Node{}
	}

	if cConfig.Prometheus != nil && cConfig.Prometheus.Enabled {
		parsers.Ctx.Profiling = true
		parsers.PovfwCtx.Profiling = true
	}
	/*
		Reset CTX grok to reduce memory footprint after we compile all the patterns
	*/
	parsers.Ctx.Grok = grokky.Host{}
	parsers.PovfwCtx.Grok = grokky.Host{}
	parsers.StageFiles = []Stagefile{}
	parsers.PovfwStageFiles = []Stagefile{}

View on GitHub (pinned to 909b515798)

Solutions

1. Read the wrapped error to find the offending file, fix or delete it under /etc/crowdsec/postoverflow/
2. Validate the YAML with a linter and re-run crowdsec
3. Run `cscli hub upgrade` to restore pristine hub postoverflow files
4. Move custom postoverflow files aside and add them back one by one to isolate the bad one

Example fix

// before (postoverflow/s00-whitelist/my.yaml)
whitelist:
 reason: test
  expression: evt.Parsed.x == 'y'   # bad indent
// after
whitelist:
  reason: test
  expression: evt.Parsed.x == 'y'

import "gopkg.in/yaml.v3"
func checkPostoverflowDir(dir string) error {
  return filepath.Walk(dir, func(p string, _ os.FileInfo, err error) error {
    if err != nil || !strings.HasSuffix(p, ".yaml") { return err }
    b, _ := os.ReadFile(p)
    var m map[string]any
    return yaml.Unmarshal(b, &m)
  })
}

parsers, err := parser.LoadParsers(cfg)
if err != nil {
  if strings.Contains(err.Error(), "postoverflow config") {
    log.Fatalf("bad postoverflow yaml: %v", err)
  }
  return err
}

When it happens

Trigger: LoadStages(parsers.PovfwStageFiles, parsers.PovfwCtx, ...) returning an error — a YAML file under /etc/crowdsec/postoverflow/ has bad syntax or a node that fails compilation.

Common situations: Hand-edited postoverflow whitelist file with indentation errors; custom postoverflow parser referencing a missing pattern; stale file left after uninstalling a hub collection.

Related errors

• failed to load parser config: %w
• cannot parse: %s
• failed to parse api client credential configuration file '%s
• failed to parse %s: %w
• unable to find grok %q: %v

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/c5369268bd66785b. Report an issue: GitHub.