crowdsecurity/crowdsec · error

plugin at %s does not exist: %w

Error message

plugin at %s does not exist: %w

What it means

pluginIsValid performs os.Stat on the plugin path before any security checks; if the stat fails the error is wrapped as 'plugin at %s does not exist'. The wrapped cause distinguishes ENOENT (missing) from other stat failures such as permission on a parent directory.

Source

Thrown at pkg/csplugin/utils.go:101

	if err != nil {
		return nil, err
	}

	return &unix.SysProcAttr{
		Credential: &syscall.Credential{
			Uid: uid,
			Gid: gid,
		},
	}, nil
}

func pluginIsValid(path string) error {
	var details fs.FileInfo
	var err error

	// check if it exists
	if details, err = os.Stat(path); err != nil {
		return fmt.Errorf("plugin at %s does not exist: %w", path, err)
	}

	// check if it is owned by current user
	currentUser, err := user.Current()
	if err != nil {
		return fmt.Errorf("while getting current user: %w", err)
	}
	currentUID, err := getUID(currentUser.Username)
	if err != nil {
		return fmt.Errorf("while looking up the current uid: %w", err)
	}
	stat := details.Sys().(*syscall.Stat_t)
	if stat.Uid != currentUID {
		return fmt.Errorf("plugin at %s is not owned by user '%s'", path, currentUser.Username)
	}

	mode := details.Mode()
	perm := uint32(mode)

View on GitHub (pinned to 909b515798)

Solutions

1. Verify the path exists on the host: ls -l <path from the error message>
2. Check the plugin directory setting in config and correct it (commonly /usr/lib/crowdsec/plugins/)
3. Reinstall the notification plugin binary; if running in a container, mount the plugins directory

Example fix

# before
cscli -c /etc/crowdsec/config.yaml ... plugin_dir: /opt/plugins
# after
plugin_dir: /usr/lib/crowdsec/plugins

if _, err := os.Stat(pluginPath); os.IsNotExist(err) {
    return fmt.Errorf("plugin binary not installed at %s", pluginPath)
}

if err := pluginIsValid(path); err != nil {
    if errors.Is(err, fs.ErrNotExist) {
        log.Fatalf("install the plugin binary: %v", err)
    }
    return err
}

When it happens

Trigger: loadNotificationPlugin iterates the configured plugin directory and calls pluginIsValid on a path that does not exist, has been deleted between enumeration and validation, or whose parent directory is not traversable.

Common situations: Configured plugin_path points to a directory or binary that was never installed; plugin binary removed after an upgrade; typo in the path; running crowdsec in a container without the plugins mounted.

Understand the failure class

Background: "File not found" and ENOENT errors: why libraries can't find a file that should exist — this error's family across 50 libraries.

Related errors

• out of bound gid
• unable to close %s : %s
• could not access CRL file: %w
• could not read CRL file: %w
• while getting process attributes: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/d86df54fa33ee21a. Report an issue: GitHub.