What causes "'%s %s failed: %w" in crowdsecurity/crowdsec?

Read the innermost wrapped error after the operation name — it pinpoints the failing step.

'%s %s failed: %w

Error message

'%s %s failed: %w

What it means

The operation handler dispatched for a PAPI message (DecisionCmd, AlertCmd or ManagementCmd via operationFunc) returned an error; handleEvent wraps it identifying which operation type and command failed. The order itself was received and matched to a handler, but executing it — applying a decision, persisting an alert, or a management action — failed against the local database or subsystems.

Source

Thrown at pkg/apiserver/papi.go:157

		return errors.New("no header in message, skipping")
	}

	if message.Header.Source == nil {
		return errors.New("no source user in header message, skipping")
	}

	operationFunc, ok := operationMap[message.Header.OperationType]
	if !ok {
		return fmt.Errorf("operation '%s' unknown, continue", message.Header.OperationType)
	}

	metrics.PapiOrdersReceived.WithLabelValues(message.Header.OperationType, message.Header.OperationCmd).Inc()

	logger.Debugf("Calling operation '%s'", message.Header.OperationType)

	err := operationFunc(ctx, message, p, sync)
	if err != nil {
		return fmt.Errorf("'%s %s failed: %w", message.Header.OperationType, message.Header.OperationCmd, err)
	}

	return nil
}

func (p *Papi) GetPermissions(ctx context.Context) (PapiPermCheckSuccess, error) {
	httpClient := p.apiClient.GetClient()
	papiCheckURL := fmt.Sprintf("%s%s%s", p.URL, PAPIVersion, PAPIPermissionsURL)

	req, err := http.NewRequestWithContext(ctx, http.MethodGet, papiCheckURL, http.NoBody)
	if err != nil {
		return PapiPermCheckSuccess{}, fmt.Errorf("failed to create request: %w", err)
	}

	resp, err := httpClient.Do(req)
	if err != nil {
		return PapiPermCheckSuccess{}, fmt.Errorf("failed to get response: %w", err)
	}

View on GitHub (pinned to 909b515798)

Solutions

Read the innermost wrapped error after the operation name — it pinpoints the failing step.
Check local database health: disk space, `cscli db status`-style checks, and crowdsec logs around the same time.
Retry/restart crowdsec; PAPI re-polls orders so transient DB failures usually self-heal on the next pull (sync interval 10s).
If a specific console operation always fails, check its prerequisites (e.g. console management toggles enabled with `cscli console status`) and report with the full chained error.

Defensive patterns

Strategy: try-catch

Try / catch

if err := p.handleEvent(ctx, event, sync); err != nil {
    logger.WithError(err).Errorf("PAPI operation failed")
    // rely on next pull cycle (SyncInterval 10s) to retry the order
    if errors.Is(err, database.ErrDeadlockDetected) { /* backoff */ }
}

Prevention

Monitor disk space and DB health on the crowdsec host; most handler failures are storage-related.
Keep SQLite file permissions owned by the crowdsec user.
Watch logs for repeated operation failures — persistent failure means an order never gets applied.
Upgrade rather than disabling console management features that your version can't execute.

When it happens

Trigger: operationFunc(ctx, message, p, sync) returns non-nil inside handleEvent; the wrapped error is commonly a database failure while inserting/deleting decisions or alerts, or a failure in the management command triggered by the console order.

Common situations: Local DB locked/corrupted or full disk while applying decisions; console management operations (e.g. disable a parser, alert commands) failing because the corresponding feature or resources are missing; permission problems on the SQLite/DB backend.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/6481937d8c61928f. Report an issue: GitHub.