crowdsecurity/crowdsec · error

glob failure: %w

Error message

glob failure: %w

What it means

In the file source's Configure, filepath.Glob failed on one of the configured 'filenames' patterns; this means the pattern itself is malformed (e.g. unclosed '[' or bad syntax), not that no files matched, so startup aborts.

Source

Thrown at pkg/acquisition/modules/file/config.go:113

	for _, pattern := range s.config.Filenames {
		if s.config.ForceInotify {
			directory := filepath.Dir(pattern)
			s.logger.Infof("Force add watch on %s", directory)

			if !s.watchedDirectories[directory] {
				err = s.watcher.Add(directory)
				if err != nil {
					s.logger.Errorf("Could not create watch on directory %s : %s", directory, err)
					continue
				}

				s.watchedDirectories[directory] = true
			}
		}

		files, err := filepath.Glob(pattern)
		if err != nil {
			return fmt.Errorf("glob failure: %w", err)
		}

		if len(files) == 0 {
			s.logger.Warnf("No matching files for pattern %s", pattern)
			continue
		}

		for _, file := range files {
			if s.isExcluded(file) {
				continue
			}

			if files[0] != pattern && s.config.Mode == configuration.TAIL_MODE { // we have a glob pattern
				directory := filepath.Dir(file)
				s.logger.Debugf("Will add watch to directory: %s", directory)

				if !s.watchedDirectories[directory] {
					err = s.watcher.Add(directory)

View on GitHub (pinned to 909b515798)

Solutions

1. Fix the glob pattern in the acquisition filenames config (escape literal '[' as '[[]')
2. Simplify the pattern or use a literal path if no globbing is needed

When it happens

Trigger: Thrown at pkg/acquisition/modules/file/config.go:113 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/ad49e5fe7e53be35. Report an issue: GitHub.