crowdsecurity/crowdsec · error

invalid 'on_success' for '%s': %s

Error message

invalid 'on_success' for '%s': %s

What it means

NewProfile validates each profile's on_success directive; it only accepts "continue" or "break" (or empty, meaning default continue). Any other string in the profile config causes profile loading to abort.

Source

Thrown at pkg/csprofiles/csprofiles.go:49

	profilesRuntime := make([]*Runtime, 0)

	for _, profile := range profilesCfg {
		var runtimeFilter, runtimeDurationExpr *vm.Program

		runtime := &Runtime{}

		xlog := logging.SubLogger(log.StandardLogger(), "profile", log.InfoLevel)

		runtime.Logger = xlog.WithFields(log.Fields{
			"type": "profile",
			"name": profile.Name,
		})

		runtime.RuntimeFilters = make([]*vm.Program, len(profile.Filters))
		runtime.Cfg = profile

		if runtime.Cfg.OnSuccess != "" && runtime.Cfg.OnSuccess != "continue" && runtime.Cfg.OnSuccess != "break" {
			return nil, fmt.Errorf("invalid 'on_success' for '%s': %s", profile.Name, runtime.Cfg.OnSuccess)
		}

		if runtime.Cfg.OnFailure != "" && runtime.Cfg.OnFailure != "continue" && runtime.Cfg.OnFailure != "break" && runtime.Cfg.OnFailure != "apply" {
			return nil, fmt.Errorf("invalid 'on_failure' for '%s' : %s", profile.Name, runtime.Cfg.OnFailure)
		}

		for fIdx, filter := range profile.Filters {
			if runtimeFilter, err = expr.Compile(filter, exprhelpers.GetExprOptions(map[string]interface{}{"Alert": &models.Alert{}})...); err != nil {
				return nil, fmt.Errorf("error compiling filter of '%s': %w", profile.Name, err)
			}

			runtime.RuntimeFilters[fIdx] = runtimeFilter
			if profile.Debug != nil && *profile.Debug {
				runtime.Logger.Logger.SetLevel(log.DebugLevel)
			}
		}

		if profile.DurationExpr != "" {

View on GitHub (pinned to 909b515798)

Solutions

1. Set on_success to "continue" or "break" (or remove the key to use the default).
2. If the intent was to apply the profile regardless, note "apply" is only valid for on_failure, not on_success; use "continue" for on_success.
3. Check casing: values are lowercase and case-sensitive.

Example fix

// before
name: crowdsecurity/http-bf
on_success: stop
// after
name: crowdsecurity/http-bf
on_success: break

var validOnSuccess = map[string]bool{"": true, "continue": true, "break": true}
func onSuccessValid(v string) bool { return validOnSuccess[v] }

if _, err := csprofiles.NewProfile(cfgs, ...); err != nil {
	if strings.Contains(err.Error(), "invalid 'on_success'") { /* fix the profile config value */ }
}

When it happens

Trigger: Calling NewProfile (via getProfilesConfigs, New, or NewProfile directly) with a profile config whose OnSuccess field is a non-empty string other than "continue" or "break", e.g. "stop", "Continue", "apply".

Common situations: Typo in profiles.yaml on_success; copying on_failure's valid value "apply" into on_success (apply is only valid for on_failure); case-sensitive value like "Break".

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• invalid 'on_failure' for '%s' : %s
• group_name is mandatory for CloudwatchSource
• zero profiles loaded for LAPI
• filter is not allowed for IP scope
• filter is mandatory for non-IP, non-Range scope

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/378e9172ff7cc096. Report an issue: GitHub.