crowdsecurity/crowdsec · error

no filename or filenames configuration provided

Error message

no filename or filenames configuration provided

What it means

Validation guard in the file datasource's UnmarshalConfig: after strict YAML parsing, neither filename nor filenames yields any entry (a lone filename is folded into Filenames first). A file source with nothing to read is a configuration mistake, so it is rejected immediately.

Source

Thrown at pkg/acquisition/modules/file/config.go:52

func (s *Source) UnmarshalConfig(yamlConfig []byte) error {
	s.config = Configuration{}

	err := yaml.UnmarshalWithOptions(yamlConfig, &s.config, yaml.Strict())
	if err != nil {
		return fmt.Errorf("cannot parse FileAcquisition configuration: %s", yaml.FormatError(err, false, false))
	}

	if s.logger != nil {
		s.logger.Tracef("FileAcquisition configuration: %+v", s.config)
	}

	if s.config.Filename != "" {
		s.config.Filenames = append(s.config.Filenames, s.config.Filename)
	}

	if len(s.config.Filenames) == 0 {
		return errors.New("no filename or filenames configuration provided")
	}

	if s.config.Mode == "" {
		s.config.Mode = configuration.TAIL_MODE
	}

	if s.config.Mode != configuration.CAT_MODE && s.config.Mode != configuration.TAIL_MODE {
		return fmt.Errorf("unsupported mode %s for file source", s.config.Mode)
	}

	for _, exclude := range s.config.ExcludeRegexps {
		re, err := regexp.Compile(exclude)
		if err != nil {
			return fmt.Errorf("could not compile regexp %s: %w", exclude, err)
		}

		s.exclude_regexps = append(s.exclude_regexps, re)
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Add a filename: /var/log/foo.log entry or a filenames: [...] list to the datasource stanza
2. Use glob patterns in filenames for rotation-friendly matching
3. Remove the empty datasource stanza if it is leftover

When it happens

Trigger: Thrown at pkg/acquisition/modules/file/config.go:52 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/28466816d094330c. Report an issue: GitHub.