crowdsecurity/crowdsec · error

invalid generated alert: %w: %s

Error message

invalid generated alert: %w: %s

What it means

After constructing the generated API alert(s) (models.Alert), NewAlert validates each against the go-swagger generated schema using newApiAlert.Validate(strfmt.Default). If validation fails, the alert is rejected and the full dumped alert (spew.Sdump) is included in the error. This guards against producing alerts that the Local API / database layer would reject, usually due to missing or out-of-spec fields.

Source

Thrown at pkg/leakybucket/overflows.go:388

	apiAlert.Meta, warnings = alertcontext.EventToContext(leaky.Queue.GetQueue())
	for _, w := range warnings {
		log.Warningf("while extracting context from bucket %s : %s", leaky.Factory.Spec.Name, w)
	}

	// Loop over the Sources and generate appropriate number of ApiAlerts
	for _, srcValue := range sources {
		newApiAlert := apiAlert
		srcCopy := srcValue
		newApiAlert.Source = &srcCopy

		//revive:disable-next-line:bool-literal-in-expr
		if v, ok := leaky.Factory.Spec.Labels["remediation"]; ok && v == true {
			newApiAlert.Remediation = true
		}

		if err := newApiAlert.Validate(strfmt.Default); err != nil {
			return runtimeAlert, fmt.Errorf("invalid generated alert: %w: %s", err, spew.Sdump(newApiAlert))
		}

		runtimeAlert.APIAlerts = append(runtimeAlert.APIAlerts, newApiAlert)
	}

	if len(runtimeAlert.APIAlerts) > 0 {
		runtimeAlert.Alert = &runtimeAlert.APIAlerts[0]
	}

	if leaky.Factory.Spec.Reprocess {
		runtimeAlert.Reprocess = true
	}

	return runtimeAlert, nil
}

View on GitHub (pinned to 909b515798)

Solutions

1. Read the validation error and the spew dump to see which field failed which constraint
2. Check the scenario definition: name, labels, capacity, leakspeed, and that events are non-empty
3. Fix the offending scenario field or bucket configuration and reload the hub
4. If caused by a crowdsec bug (spec-conformant config still failing), report with the dumped alert

Example fix

// before (scenario labels)
labels:
  remediation: "true"
// after
labels:
  remediation: true

// Validate a generated alert the same way before returning it:
if err := alert.Validate(strfmt.Default); err != nil {
    return fmt.Errorf("pre-check failed: %w", err)
}

// Ensure required fields are non-nil before building:
if leaky == nil || len(queue.GetQueue()) == 0 { return nil, errors.New("empty overflow") }

alert, err := leakybucket.NewAlert(leaky, queue)
var valErr error
if err != nil && errors.As(err, &valErr) && strings.Contains(err.Error(), "invalid generated alert") {
    log.Errorf("generated alert rejected: %v", err) // spew dump included
}

When it happens

Trigger: overflow → NewAlert; the constructed models.Alert fails Validate — e.g. empty required fields (machine ID, scenario, events, sources), timestamps in wrong format, or a field violating the swagger spec constraints after unusual bucket/label configuration.

Common situations: Scenarios with empty or malformed labels (e.g. remediation label set as a string), missing capacity/leakspeed settings producing out-of-range values, or corrupted/empty event queues yielding alerts without required references.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

• path must start with /
• invalid filter
• leakspeed is required
• duration is required
• a condition is required

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/6407fe43a442c1d8. Report an issue: GitHub.