What causes "invalid polling method %s" in crowdsecurity/crowdsec?

Set polling_method to exactly `list` (poll bucket_name directly) or `sqs` (consume sqs_name)

invalid polling method %s

Error message

invalid polling method %s

What it means

The polling_method config key is validated against the module's enum: only the values matching PollMethodList ('list') and PollMethodSQS ('sqs') are accepted. Any other string fails this check at the end of UnmarshalConfig.

Source

Thrown at pkg/acquisition/modules/s3/config.go:131

	if s.Config.Mode == "" {
		s.Config.Mode = configuration.TAIL_MODE
	}

	if s.Config.PollingMethod == "" {
		s.Config.PollingMethod = PollMethodList
	}

	if s.Config.PollingInterval == 0 {
		s.Config.PollingInterval = 60
	}

	if s.Config.MaxBufferSize == 0 {
		s.Config.MaxBufferSize = bufio.MaxScanTokenSize
	}

	if s.Config.PollingMethod != PollMethodList && s.Config.PollingMethod != PollMethodSQS {
		return fmt.Errorf("invalid polling method %s", s.Config.PollingMethod)
	}

	if s.Config.BucketName != "" && s.Config.SQSName != "" {
		return errors.New("bucket_name and sqs_name are mutually exclusive")
	}

	if s.Config.PollingMethod == PollMethodSQS && s.Config.SQSName == "" {
		return errors.New("sqs_name is required when using sqs polling method")
	}

	if s.Config.BucketName == "" && s.Config.PollingMethod == PollMethodList {
		return errors.New("bucket_name is required")
	}

	if s.Config.SQSFormat != "" && s.Config.SQSFormat != SQSFormatEventBridge && s.Config.SQSFormat != SQSFormatS3Notification && s.Config.SQSFormat != SQSFormatSNS {
		return fmt.Errorf("invalid sqs_format %s, must be empty, %s, %s or %s", s.Config.SQSFormat, SQSFormatEventBridge, SQSFormatS3Notification, SQSFormatSNS)
	}

View on GitHub (pinned to 909b515798)

Solutions

Set polling_method to exactly `list` (poll bucket_name directly) or `sqs` (consume sqs_name)
Fix the value's spelling and case to match the enum exactly
If unsure, consult the module's Configuration struct or docs for the accepted strings

Example fix

// before
polling_method: sqs_polling
// after
polling_method: sqs

Defensive patterns

Strategy: validation

Validate before calling

allowed := map[string]bool{"list": true, "sqs": true}
if pm != "" && !allowed[pm] {
    return fmt.Errorf("polling_method must be list or sqs, got %q", pm)
}

Prevention

Only use the documented enum values, exact case
Choose `list` with bucket_name, `sqs` with sqs_name
Review the module's Configuration struct when in doubt

When it happens

Trigger: Setting polling_method in the S3 acquisition yaml to a misspelled, wrongly-cased, or invented value such as 'sqs_polling', 'LIST', or 'scan'.

Common situations: Copy-pasting config from other tools' documentation; assuming case-insensitivity; guessing values instead of using the two documented ones.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/d1fead38d2cea3b1. Report an issue: GitHub.