crowdsecurity/crowdsec · error

no appsec-config found for %s

Error message

no appsec-config found for %s

What it means

Thrown by AppsecConfigs collection loading in pkg/appsec/appsec.go when a requested appsec-config name does not match any config loaded into the collection. The loader iterates its loaded AppsecConfigs and, if no entry's Name matches the requested configName, returns this error instead of a runtime config. It indicates a name mismatch between what an acquisition/source config references and what exists in the hub/config directory.

Source

Thrown at pkg/appsec/appsec.go:889

	return out, nil
}

func (wc *AppsecConfig) Load(configName string, hub *cwhub.Hub) error {
	item := hub.GetItem(cwhub.APPSEC_CONFIGS, configName)

	if item != nil && item.State.IsInstalled() {
		wc.Logger.Infof("loading %s", item.State.LocalPath)

		err := wc.LoadByPath(item.State.LocalPath)
		if err != nil {
			return fmt.Errorf("unable to load appsec-config %s : %s", item.State.LocalPath, err)
		}

		return nil
	}

	return fmt.Errorf("no appsec-config found for %s", configName)
}

func (wc *AppsecConfig) Build(ctx context.Context, hub *cwhub.Hub) (*AppsecRuntimeConfig, error) {
	ret := &AppsecRuntimeConfig{Logger: wc.Logger.WithField("component", "appsec_runtime_config")}

	ret.RequestValidator = apivalidation.NewRequestValidator(wc.Logger.WithField("component", "api_validator"))

	if wc.BouncerBlockedHTTPCode == 0 {
		wc.BouncerBlockedHTTPCode = http.StatusForbidden
	}

	if wc.BouncerPassedHTTPCode == 0 {
		wc.BouncerPassedHTTPCode = http.StatusOK
	}

	if wc.UserBlockedHTTPCode == 0 {
		wc.UserBlockedHTTPCode = http.StatusForbidden
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Check the acquisition config `appsec_config:` name and fix typos against names in /etc/crowdsec/appsec-configs/ (or your config dir)
2. Run `cscli hub update && cscli hub upgrade` and install the appsec-config collection (e.g. `cscli collections install crowdsecurity/appsec-virtual-patching`)
3. Verify the appsec-config YAML loads by checking crowdsec startup logs for earlier load errors
4. Confirm appsec_configs_dir is correctly set so the config directory is actually scanned

Example fix

// before (acquis.yaml)
appsec_config: crowdsec/virtual-patching
// after
appsec_config: crowdsecurity/virtual-patching

name := "crowdsecurity/virtual-patching"
loaded, _ := cscliListAppsecConfigs() // cscli appsec-configs list -o json
if !slices.Contains(loaded, name) {
    return fmt.Errorf("appsec config %q not installed", name)
}

if err := loadAppsecConfig(name); err != nil {
    log.Fatalf("appsec config %q missing: %v — run: cscli collections install %s", name, err, name)
}

When it happens

Trigger: Calling the loader's GetBuild/Load function with a configName that was never registered; an appsec_config file failed to load earlier (e.g. YAML parse error) so the name is absent; a typo in the `appsec_config` directive of an appsec acquisition source.

Common situations: User references `appsec_config: crowdsecurity/virtual-patching` but only installed the rules collection, not the appsec-config; hub not updated so the config file is missing; case/spelling mismatch in config name; the appsec-config YAML failed validation and was silently skipped.

Understand the failure class

Background: "Not found" and "does not exist" errors: why "Task not found", "No such folder", and "Can't find" fire when a lookup comes back empty — this error's family across 14 libraries.

Related errors

• on_challenge hooks are only valid in-band, not under outofba
• path must start with /
• ref cannot be empty
• on_challenge_submit hooks are only valid in-band, not under
• max_body_size must be a positive integer

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/a6e00ca5667eac8c. Report an issue: GitHub.