crowdsecurity/crowdsec · error

file '%s' is not from hub '%s' nor from the configuration di

Error message

file '%s' is not from hub '%s' nor from the configuration directory '%s'

What it means

newItemSpec only builds an itemSpec when the file path is recognized as belonging either to the hub directory or to the local configuration (install) directory. When the path matches neither prefix (and the file cannot be attributed to any known root), there is no way to classify the item as downloaded, installed, or local, so this error is returned to the caller (itemVisit during sync).

Source

Thrown at pkg/cwhub/sync.go:126

	var (
		spec *itemSpec
		err  error
	)

	if subs, ok := relativePathComponents(path, hubDir); ok {
		spec, err = newHubItemSpec(path, subs)
		if err != nil {
			return nil, err
		}
	} else if subs, ok := relativePathComponents(path, installDir); ok {
		spec, err = newInstallItemSpec(path, subs)
		if err != nil {
			return nil, err
		}
	}

	if spec == nil {
		return nil, fmt.Errorf("file '%s' is not from hub '%s' nor from the configuration directory '%s'", path, hubDir, installDir)
	}

	// follow the link to see if it falls in the hub directory
	// if it's not a link, target == path
	spec.target, err = resolveSymlink(spec.path)
	if err != nil {
		// target does not exist, the user might have removed the file
		// or switched to a hub branch without it; or symlink loop
		return nil, err
	}

	targetInHub, err := isPathInside(spec.target, hubDir)
	if err != nil {
		return nil, ErrSkipPath
	}

	spec.local = !targetInHub

View on GitHub (pinned to 909b515798)

Solutions

1. Check HubDir and InstallDir in your config cover the directory being scanned; fix the paths in config.yaml
2. Remove or fix dangling/misplaced symlinks so targets resolve under the hub or config directory
3. Reinstall the affected item with 'cscli hub item install' so the hub/config layout is rebuilt correctly

Example fix

// before: symlink in hub dir -> /home/user/foo.yaml (outside both roots)
readlink -f /etc/crowdsec/hub/scenarios/crowdsecurity/foo.yaml  # /home/user/foo.yaml
rm /etc/crowdsec/hub/scenarios/crowdsecurity/foo.yaml
cscli hub item install crowdsecurity/foo -t scenarios
// after: item is a proper symlink (or copy) under hub/ or config/

func underOneOf(file string, roots ...string) bool {
	for _, r := range roots {
		rel, err := filepath.Rel(r, file)
		if err == nil && !strings.HasPrefix(rel, "..") {
			return true
		}
	}
	return false
}
// before Load: verify hubDir and installDir are set and cover scanned trees
if hubDir == "" || installDir == "" {
	return fmt.Errorf("hub_dir and config dirs must be set")
}

err := hub.Load(ctx)
if err != nil {
	if strings.Contains(err.Error(), "is not from hub") {
		// unclassifiable file: resolve the symlink target and repair or remove it
		log.Warnf("repairing misplaced item: %v", err)
	} else {
		return err
	}
}

When it happens

Trigger: Hub.Load/localSync visits a file whose absolute path is neither under h.local.HubDir nor under h.local.InstallDir, e.g. through a symlink or an unusual syncDir root.

Common situations: A symlink in a scanned directory pointing to a file on another filesystem/parent directory outside both roots; a Hub configured with HubDir and InstallDir that don't cover the scanned tree; moving directories after install without re-running cscli.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

• path is too short: %s (%d)
• unable to symlink scenario '%s' to '%s': %w
• too many levels of symbolic links
• no parser found. Please install the appropriate parser and r
• %s is already installed at %s

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/204768ecfb5fe13b. Report an issue: GitHub.