crowdsecurity/crowdsec · error

querying range: %w

Error message

querying range: %w

What it means

doQueryRange polls VictoriaLogs on a ticker; when lc.Get fails it consults shouldRetry and, if retries are exhausted (or not allowed), returns the underlying HTTP error wrapped with "querying range". This means the acquisition client could not perform the query_range HTTP request at all.

Source

Thrown at pkg/acquisition/modules/victorialogs/internal/vlclient/vl_client.go:127

}

func (lc *VLClient) doQueryRange(ctx context.Context, uri string, c chan *Log, infinite bool) error {
	lc.currentTickerInterval = 100 * time.Millisecond
	ticker := time.NewTicker(lc.currentTickerInterval)

	defer ticker.Stop()

	for {
		select {
		case <-ctx.Done():
			return ctx.Err()
		case <-lc.t.Dying():
			return lc.t.Err()
		case <-ticker.C:
			resp, err := lc.Get(ctx, uri)
			if err != nil {
				if ok := lc.shouldRetry(); !ok {
					return fmt.Errorf("querying range: %w", err)
				}

				lc.increaseTicker(ticker)

				continue
			}

			if resp.StatusCode != http.StatusOK {
				lc.Logger.Warnf("bad HTTP response code for query range: %d", resp.StatusCode)
				body, _ := io.ReadAll(resp.Body)
				resp.Body.Close()

				if ok := lc.shouldRetry(); !ok {
					return fmt.Errorf("bad HTTP response code: %d: %s: %w", resp.StatusCode, string(body), err)
				}

				lc.increaseTicker(ticker)

View on GitHub (pinned to 909b515798)

Solutions

1. Verify VictoriaLogs is reachable: curl the configured URL from the crowdsec host
2. Check host/port in the DSN and any proxy/firewall rules
3. Inspect the wrapped inner error for the root cause (refused vs timeout vs TLS)
4. Increase max_failure_duration in the DSN if the outage window is legitimately long

// pre-check connectivity
const res = await fetch(baseURL + "/health").catch(() => null)
if (!res) throw new Error("VictoriaLogs unreachable before starting acquisition")

try {
  await runAcquisition()
} catch (e) {
  if (String(e).startsWith("querying range") && /connection refused|no such host/.test(e.cause ?? "")) {
    scheduleReconnectWithBackoff()
  } else {
    throw e
  }
}

When it happens

Trigger: lc.Get returns an error (connection refused, DNS failure, TLS error, request creation failure) and lc.shouldRetry() returns false — i.e. the retry budget for MaxFailureDuration is exhausted.

Common situations: VictoriaLogs is down or unreachable at the configured host:port, firewall blocks the port, service restarting during a long outage exceeding max_failure_duration, or bad TLS configuration.

Understand the failure class

Background: "API request failed": what wrapped HTTP errors from external APIs mean and how to find the real cause — this error's family across 29 libraries.

Related errors

• error tailing logs: %w
• error querying range: %w
• bad HTTP response code: %d: %s: %w
• cannot read line in response: %w
• error while reading tail response: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/bf30b57124b3f9ec. Report an issue: GitHub.