crowdsecurity/crowdsec · warning

no acquisition_path or acquisition_dir specified

Error message

no acquisition_path or acquisition_dir specified

What it means

ErrNoAcquisitionDefined is the sentinel returned when a CrowdsecServiceCfg has neither acquisition_path nor acquisition_dir configured. CollectAcquisitionFiles and LoadCrowdsec use it to distinguish 'agent has nothing to read' from real errors; LoadCrowdsec treats it as a warning (empty acquisition list) rather than a hard failure.

Source

Thrown at pkg/csconfig/crowdsec_service.go:43

	OutputRoutinesCount       int              `yaml:"output_routines"`
	SimulationConfig          SimulationConfig `yaml:"-"`
	BucketStateFile           string           `yaml:"state_input_file,omitempty"` // if we need to unserialize buckets at start
	BucketStateDumpDir        string           `yaml:"state_output_dir,omitempty"` // if we need to unserialize buckets on shutdown
	BucketsGCEnabled          bool             `yaml:"-"`                          // we need to garbage collect buckets when in forensic mode
	DNSCache                  *DNSCacheCfg     `yaml:"dns_cache,omitempty"`

	SimulationFilePath string              `yaml:"-"`
	ContextToSend      map[string][]string `yaml:"-"`
}

// Cache config for DNS lookups (legit bots, rdns PO)
type DNSCacheCfg struct {
	TTL         *time.Duration `yaml:"ttl,omitempty"`
	NegativeTTL *time.Duration `yaml:"negative_ttl,omitempty"`
	Size        *int           `yaml:"size,omitempty"`
}

var ErrNoAcquisitionDefined = errors.New("no acquisition_path or acquisition_dir specified")

func (c *CrowdsecServiceCfg) CollectAcquisitionFiles() ([]string, error) {
	ret := []string{}

	// agent section missing in the configuration file.
	// likely a lapi-only setup, not much we can do here
	if c == nil {
		return nil, nil
	}

	if c.AcquisitionFilePath != "" {
		log.Debugf("non-empty acquisition_path %s", c.AcquisitionFilePath)

		_, err := os.Stat(c.AcquisitionFilePath)

		switch {
		case errors.Is(err, fs.ErrNotExist):
			log.Debugf("acquisition_path: %s does not exist, skipping", c.AcquisitionFilePath)

View on GitHub (pinned to 909b515798)

Solutions

1. Add 'acquisition_dir: /etc/crowdsec/acquis.d' (or acquisition_path pointing at acquis.yaml) under the crowdsec config section
2. Check key spelling — only acquisition_path and acquisition_dir are recognized
3. If intentionally LAPI-only, ignore the warning; it is not fatal when handled through LoadCrowdsec

Example fix

// before (crowdsec section)
crowdsec:
  service: true

// after
crowdsec:
  service: true
  acquisition_path: /etc/crowdsec/acquis.yaml

if cfg.Crowdsec != nil && cfg.Crowdsec.AcquisitionDirPath == "" && cfg.Crowdsec.AcquisitionFilePath == "" {
    log.Warn("no acquisition configured; agent will collect nothing")
}

files, err := cfg.Crowdsec.CollectAcquisitionFiles()
if err != nil {
    if errors.Is(err, csconfig.ErrNoAcquisitionDefined) {
        log.Warning("LAPI-only setup, skipping acquisition")
        return nil
    }
    return err
}

When it happens

Trigger: config.yaml with no 'acquisition_path:'/'acquisition_dir:' keys in the crowdsec agent section; running crowdsec in LAPI-only mode; calling LoadCrowdsec on a Config parsed from a server-only config.

Common situations: LAPI-only setups (expected, logged as warning); users converting an agent to LAPI and leaving no acquisition section; typos like acquire_dir or acquisiton_path so neither key is recognized.

Understand the failure class

Background: "missing required config value" errors: why libraries refuse to start when a configuration key is empty, unset, or blank — this error's family across 48 libraries.

Related errors

• path must start with /
• max_body_size must be positive
• loki query is mandatory
• event_channel or xpath_query must be set
• data source type is empty

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/1361586f47a21bfc. Report an issue: GitHub.