crowdsecurity/crowdsec · error

invalid 'on_failure' for '%s' : %s

Error message

invalid 'on_failure' for '%s' : %s

What it means

A profile in profiles.yaml declares an on_failure value that is neither "continue" nor "break" (nor empty). This is the on_failure sibling of the on_success check just above it in NewProfile; the offending profile name and value are echoed.

Source

Thrown at pkg/csprofiles/csprofiles.go:53

		runtime := &Runtime{}

		xlog := logging.SubLogger(log.StandardLogger(), "profile", log.InfoLevel)

		runtime.Logger = xlog.WithFields(log.Fields{
			"type": "profile",
			"name": profile.Name,
		})

		runtime.RuntimeFilters = make([]*vm.Program, len(profile.Filters))
		runtime.Cfg = profile

		if runtime.Cfg.OnSuccess != "" && runtime.Cfg.OnSuccess != "continue" && runtime.Cfg.OnSuccess != "break" {
			return nil, fmt.Errorf("invalid 'on_success' for '%s': %s", profile.Name, runtime.Cfg.OnSuccess)
		}

		if runtime.Cfg.OnFailure != "" && runtime.Cfg.OnFailure != "continue" && runtime.Cfg.OnFailure != "break" && runtime.Cfg.OnFailure != "apply" {
			return nil, fmt.Errorf("invalid 'on_failure' for '%s' : %s", profile.Name, runtime.Cfg.OnFailure)
		}

		for fIdx, filter := range profile.Filters {
			if runtimeFilter, err = expr.Compile(filter, exprhelpers.GetExprOptions(map[string]interface{}{"Alert": &models.Alert{}})...); err != nil {
				return nil, fmt.Errorf("error compiling filter of '%s': %w", profile.Name, err)
			}

			runtime.RuntimeFilters[fIdx] = runtimeFilter
			if profile.Debug != nil && *profile.Debug {
				runtime.Logger.Logger.SetLevel(log.DebugLevel)
			}
		}

		if profile.DurationExpr != "" {
			if runtimeDurationExpr, err = expr.Compile(profile.DurationExpr, exprhelpers.GetExprOptions(map[string]interface{}{"Alert": &models.Alert{}})...); err != nil {
				return nil, fmt.Errorf("error compiling duration_expr of %s: %w", profile.Name, err)
			}

View on GitHub (pinned to 909b515798)

Solutions

1. Set on_failure to one of "continue", "break", or "apply".
2. Remove the on_failure key to fall back to the default (continue).
3. Upgrade CrowdSec if you intended "apply" but run a version where it is not accepted (it is valid in current code).

Example fix

// before
name: my-profile
on_failure: stop
// after
name: my-profile
on_failure: apply

var validOnFailure = map[string]bool{"": true, "continue": true, "break": true, "apply": true}
func onFailureValid(v string) bool { return validOnFailure[v] }

if _, err := csprofiles.NewProfile(cfgs, ...); err != nil {
	if strings.Contains(err.Error(), "invalid 'on_failure'") { /* correct the on_failure value */ }
}

When it happens

Trigger: Calling NewProfile with a profile config whose OnFailure field is a non-empty string other than "continue", "break", or "apply", e.g. "stop", "abort", "apply_filters".

Common situations: Typo in profiles.yaml on_failure; inventing values not in the accepted set; copy-paste from docs of an older CrowdSec version that did not support "apply".

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• invalid 'on_success' for '%s': %s
• group_name is mandatory for CloudwatchSource
• zero profiles loaded for LAPI
• filter is not allowed for IP scope
• filter is mandatory for non-IP, non-Range scope

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/709060e3a35b6d76. Report an issue: GitHub.