crowdsecurity/crowdsec · error

machine %q: %w

Error message

machine %q: %w

What it means

During bulk alert creation, CreateAlert wraps any error from createAlertBatch (via slicetools.Batch) with the machine ID. It indicates one or more alert rows in the batch failed to insert in the database.

Source

Thrown at pkg/database/alerts.go:749

		owner, err = c.QueryMachineByID(ctx, machineID)
		if err != nil {
			if !errors.Is(err, UserNotExists) {
				return nil, fmt.Errorf("machine '%s': %w", machineID, err)
			}

			c.Log.Debugf("creating alert: machine %s doesn't exist", machineID)

			owner = nil
		}
	}

	c.Log.Debugf("writing %d items", len(alertList))

	alertIDs := []string{}
	if err := slicetools.Batch(ctx, alertList, alertCreateBulkSize, func(ctx context.Context, part []*models.Alert) error {
		ids, err := c.createAlertBatch(ctx, machineID, owner, part)
		if err != nil {
			return fmt.Errorf("machine %q: %w", machineID, err)
		}
		alertIDs = append(alertIDs, ids...)
		return nil
	}); err != nil {
		return nil, err
	}

	if owner != nil {
		err = owner.Update().SetLastPush(time.Now().UTC()).Exec(ctx)
		if err != nil {
			return nil, fmt.Errorf("machine '%s': %w", machineID, err)
		}
	}

	return alertIDs, nil
}

func (c *Client) AlertsCountPerScenario(ctx context.Context, filter map[string][]string) (map[string]int, error) {

View on GitHub (pinned to 909b515798)

Solutions

1. Inspect the wrapped error for the real cause (lock timeout, packet size, constraint)
2. Reduce alert burst volume or batch size (alertCreateBulkSize) if hitting driver limits
3. Check DB health: for SQLite ensure no other process holds the lock; for MySQL tune max_allowed_packet
4. Retry the push — batches are not partially committed from the caller's perspective

if len(alerts) == 0 {
    return nil // nothing to push, skip batch path
}

err := retry.Do(func() error {
    _, err := client.CreateAlert(ctx, alert)
    return err
}, retry.Attempts(3), retry.Delay(time.Second))

When it happens

Trigger: createAlertBatch returns an insert error — DB unavailable, constraint violation on an alert row, context cancelled mid-batch, or a batch size limit hit.

Common situations: Bouncer/parser pushing many alerts at once during DB contention; SQLite 'database is locked'; oversized batch failing on MySQL max_allowed_packet.

Related errors

• creating alert decisions: %w
• event meta '%v': %w: %w
• bulk creating alert: %w: %w
• machine '%s': %w
• alert graph delete batch events: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/6d3db3a4201f9c17. Report an issue: GitHub.