crowdsecurity/crowdsec · error · QueryFail

select config item: %w: %w

Error message

select config item: %w: %w

What it means

GetConfigItem wraps a failed query for a config_items row by name. Not-found is treated as an empty value ("", nil); any other query error is wrapped as `select config item: <err>: <QueryFail>`. Called by Pull, QueryPAPIInfo, updateBlocklist, LoadAPICToken.

Source

Thrown at pkg/database/config.go:18

package database

import (
	"context"
	"fmt"

	"github.com/crowdsecurity/crowdsec/pkg/database/ent"
	"github.com/crowdsecurity/crowdsec/pkg/database/ent/configitem"
)

func (c *Client) GetConfigItem(ctx context.Context, key string) (string, error) {
	result, err := c.Ent.ConfigItem.Query().Where(configitem.NameEQ(key)).First(ctx)

	switch {
	case ent.IsNotFound(err):
		return "", nil
	case err != nil:
		return "", fmt.Errorf("select config item: %w: %w", err, QueryFail)
	default:
		return result.Value, nil
	}
}

func (c *Client) SetConfigItem(ctx context.Context, key string, value string) error {
	err := c.Ent.ConfigItem.
		Create().
		SetName(key).
		SetValue(value).
		OnConflictColumns(configitem.FieldName).
		UpdateNewValues().
		Exec(ctx)
	if err != nil {
		return fmt.Errorf("insert/update config item: %w", err)
	}

	return nil

View on GitHub (pinned to 909b515798)

Solutions

1. Inspect the double-wrapped error: the first %w is the driver cause, QueryFail is the sentinel
2. Verify DB connectivity and that the schema is up to date (cscli may need `crowdsec` restart to run migrations)
3. Check file permissions on the SQLite database
4. Retry transient network errors if using MySQL/Postgres

// treat empty value as legitimate missing key — this API already does
val, err := c.GetConfigItem(ctx, key)
if err != nil && val == "" { /* err is a real query failure */ }

val, err := c.GetConfigItem(ctx, "ca_path")
switch {
case err == nil && val == "": // key absent, use default
case err != nil: return fmt.Errorf("cannot read config item: %w", err)
}

When it happens

Trigger: Database unreachable/corrupted, malformed schema (config_items table missing after a failed migration), or context cancellation while querying a known key like ca_path, blocklist, or api credentials.

Common situations: Partially migrated/corrupted SQLite file where the ent query itself errors; MySQL outage during crowdsec Pull; permissions making the DB unreadable.

Understand the failure class

Background: Database query failed: Internal Server Error 500s wrapping SQL, Prisma, and connection failures — what to check first — this error's family across 16 libraries.

Related errors

• while getting alert: %w
• while getting decision: %w
• unable to query alerts for uuid %s: %w
• insert/update config item: %w
• expired decisions: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/abf0e62573b72774. Report an issue: GitHub.