What causes "invalid max_failure_duration in dsn: %w" in crowdsecurity/crowdsec?

Use a valid Go duration string, e.g. `max_failure_duration=30s`

invalid max_failure_duration in dsn: %w

Error message

invalid max_failure_duration in dsn: %w

What it means

ConfigureByDSN validates the optional `max_failure_duration` DSN parameter with time.ParseDuration. If the value cannot be parsed as a Go duration, the error is wrapped with "invalid max_failure_duration in dsn" and the source fails to configure.

Source

Thrown at pkg/acquisition/modules/victorialogs/config.go:168

		s.Config.WaitForReady, err = time.ParseDuration(w)
		if err != nil {
			return err
		}
	} else {
		s.Config.WaitForReady = 10 * time.Second
	}

	if since := params.Get("since"); since != "" {
		s.Config.Since, err = time.ParseDuration(since)
		if err != nil {
			return fmt.Errorf("invalid since in dsn: %w", err)
		}
	}

	if maxFailureDuration := params.Get("max_failure_duration"); maxFailureDuration != "" {
		duration, err := time.ParseDuration(maxFailureDuration)
		if err != nil {
			return fmt.Errorf("invalid max_failure_duration in dsn: %w", err)
		}

		s.Config.MaxFailureDuration = duration
	} else {
		s.Config.MaxFailureDuration = 5 * time.Second // for OneShot mode it doesn't make sense to have longer duration
	}

	if limit := params.Get("limit"); limit != "" {
		limit, err := strconv.Atoi(limit)
		if err != nil {
			return fmt.Errorf("invalid limit in dsn: %w", err)
		}

		s.Config.Limit = limit
	}

	if logLevel := params.Get("log_level"); logLevel != "" {
		level, err := log.ParseLevel(logLevel)

View on GitHub (pinned to 909b515798)

Solutions

Use a valid Go duration string, e.g. `max_failure_duration=30s`
Convert unsupported units (days/weeks) to hours manually, e.g. 2d -> 48h
Remove the parameter to fall back to the built-in default of 5s
Check the wrapped error text for the exact character that failed parsing

Example fix

// before
url: victorialogs+http://127.0.0.1:8428?max_failure_duration=5m30
// after
url: victorialogs+http://127.0.0.1:8428?max_failure_duration=5m30s

Defensive patterns

Strategy: validation

Validate before calling

const v = p.searchParams.get("max_failure_duration")
if (v && !/^\d+(ns|us|ms|s|m|h)([\d.]+(ns|us|ms|s|m|h))*$/.test(v)) {
  throw new Error(`invalid max_failure_duration: ${v}`)
}

Prevention

Use complete duration strings like 30s or 5m, never bare numbers
Remember the default is 5s if you omit the parameter
Validate all DSN params in a linter or CI check before deploy

When it happens

Trigger: Providing `max_failure_duration=` in the DSN with a non-parseable duration string such as `max_failure_duration=infinite`, `max_failure_duration=30`, or `max_failure_duration=2d`.

Common situations: Users assuming days are a supported unit, omitting the unit entirely, or pasting a number when a duration string is expected; the default is 5s when the parameter is omitted.

Understand the failure class

Background: "invalid duration" / "failed to parse duration": why your timeout, interval, or TTL string is rejected and which formats each library accepts — this error's family across 32 libraries.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/4dadd08260f3ea57. Report an issue: GitHub.