crowdsecurity/crowdsec · warning

terminating crowdsec daemon: %w

Error message

terminating crowdsec daemon: %w

What it means

At the end of RunWithNucleiTemplate the crowdsec daemon child process is killed with crowdsecDaemon.Process.Kill(); if that fails the test returns this error. On Linux this is rare (typically ESRCH if the process already exited), but on Windows process-kill semantics differ and failures are more common.

Source

Thrown at pkg/hubtest/hubtest_item.go:444

			if err != nil {
				log.Errorf("unable to read crowdsec log file '%s': %s", crowdsecLogFile, err)
			}
		}
	} else {
		if err == nil {
			t.Success = true
		} else {
			log.Errorf("Appsec test %s failed:  %s", t.Name, err)

			err = t.ImprovedLogDisplay(crowdsecLogFile)
			if err != nil {
				log.Errorf("unable to read crowdsec log file '%s': %s", crowdsecLogFile, err)
			}
		}
	}

	if err := crowdsecDaemon.Process.Kill(); err != nil {
		return fmt.Errorf("terminating crowdsec daemon: %w", err)
	}

	return nil
}

func createDirs(dirs []string) error {
	for _, dir := range dirs {
		if err := os.MkdirAll(dir, os.ModePerm); err != nil {
			return fmt.Errorf("unable to create directory '%s': %w", dir, err)
		}
	}

	return nil
}

func (t *HubTestItem) RunWithLogFile(ctx context.Context) error {
	testPath := filepath.Join(t.HubTestPath, t.Name)
	if _, err := os.Stat(testPath); os.IsNotExist(err) {

View on GitHub (pinned to 909b515798)

Solutions

1. Ignore benign 'process already finished' kills — treat daemon exit during test as a separate startup failure to investigate
2. Check the crowdsec log output printed earlier for why the daemon exited early
3. Use CommandContext with a timeout so cleanup is handled by context cancellation as a fallback
4. On Windows-specific failures, run the test suite on linux or guard the kill with os.Process.Signal handling

Example fix

// before
if err := crowdsecDaemon.Process.Kill(); err != nil {
	return fmt.Errorf("terminating crowdsec daemon: %w", err)
}
// after
if err := crowdsecDaemon.Process.Kill(); err != nil && !errors.Is(err, os.ErrProcessDone) {
	return fmt.Errorf("terminating crowdsec daemon: %w", err)
}

if err := crowdsecDaemon.Process.Kill(); err != nil && !errors.Is(err, os.ErrProcessDone) {
	log.Printf("non-fatal daemon kill failure: %v", err)
}

When it happens

Trigger: crowdsecDaemon.Process.Kill() errors: the daemon already exited (process reaped/ESRCH-like condition), or OS-specific kill restrictions.

Common situations: Crowdsec daemon crashed during the test and already exited when teardown ran; running tests in environments with restrictive process controls; leaked daemons from earlier failed runs leaving PID state odd.

Related errors

• starting crowdsec daemon: %w
• fail to run '%s' for test '%s': %w
• appsec is down: %w
• path must start with /
• mtls is selected, but ca_cert is not provided

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/4777137fefaabfa4. Report an issue: GitHub.