What causes "timeout while waiting for consumer to be active: %w" in crowdsecurity/crowdsec?

Increase `max_retries` in the acquisition config to allow more activation time.

timeout while waiting for consumer to be active: %w

Error message

timeout while waiting for consumer to be active: %w

What it means

Returned by RegisterConsumer when registration succeeded but the subsequent WaitForConsumerRegistration poll failed (errors 425/426), wrapped with a timeout-flavored message. EnhancedRead aborts EFO setup at this point.

Source

Thrown at pkg/acquisition/modules/kinesis/run.go:152

	}

	return fmt.Errorf("consumer %s is not active after %d tries", consumerARN, maxTries)
}

func (s *Source) RegisterConsumer(ctx context.Context) (*kinesis.RegisterStreamConsumerOutput, error) {
	s.logger.Debugf("Registering consumer %s", s.Config.ConsumerName)

	streamConsumer, err := s.kClient.RegisterStreamConsumer(ctx, &kinesis.RegisterStreamConsumerInput{
			ConsumerName: aws.String(s.Config.ConsumerName),
			StreamARN:    aws.String(s.Config.StreamARN),
		})
	if err != nil {
		return nil, fmt.Errorf("cannot register stream consumer: %w", err)
	}

	err = s.WaitForConsumerRegistration(ctx, *streamConsumer.Consumer.ConsumerARN)
	if err != nil {
		return nil, fmt.Errorf("timeout while waiting for consumer to be active: %w", err)
	}

	return streamConsumer, nil
}

func (s *Source) ParseAndPushRecords(records []kinTypes.Record, out chan pipeline.Event, logger *log.Entry, shardID string) {
	for _, record := range records {
		if s.Config.StreamARN != "" {
			if s.metricsLevel != metrics.AcquisitionMetricsLevelNone {
				metrics.KinesisDataSourceLinesReadShards.With(prometheus.Labels{"stream": s.Config.StreamARN, "shard": shardID}).Inc()
				metrics.KinesisDataSourceLinesRead.With(prometheus.Labels{"stream": s.Config.StreamARN, "datasource_type": ModuleName, "acquis_type": s.Config.Labels["type"]}).Inc()
			}
		} else {
			if s.metricsLevel != metrics.AcquisitionMetricsLevelNone {
				metrics.KinesisDataSourceLinesReadShards.With(prometheus.Labels{"stream": s.Config.StreamName, "shard": shardID}).Inc()
				metrics.KinesisDataSourceLinesRead.With(prometheus.Labels{"stream": s.Config.StreamName, "datasource_type": ModuleName, "acquis_type": s.Config.Labels["type"]}).Inc()
			}
		}

View on GitHub (pinned to 909b515798)

Solutions

Increase `max_retries` in the acquisition config to allow more activation time.
Re-run the acquisition; the consumer already exists and RegisterStreamConsumer/describe will pick up its state.
Check IAM for kinesis:DescribeStreamConsumer and inspect the inner error to distinguish permission/throttle failures from a genuine timeout.
If activation is consistently slow, reduce concurrent consumer churn on the stream.

Example fix

// before
max_retries: 2
// after
max_retries: 20

Defensive patterns

Strategy: retry

Validate before calling

// Ensure describe permission and a large enough retry budget before registering
aws iam simulate-principal-policy --policy-source-arn <role> --action-names kinesis:DescribeStreamConsumer

Try / catch

consumer, err := registerConsumer(ctx)
if err != nil {
    var to *TimeoutError
    if errors.As(err, &to) {
        // registration succeeded; consumer may become ACTIVE shortly — safe to retry start
        return retryAfter(5 * time.Second)
    }
    return err
}

Prevention

Raise max_retries so the 200ms-growing backoff spans realistic activation times.
Reuse existing consumers across restarts to skip the activation wait entirely.
Investigate inner errors: permission/throttle failures need IAM or rate fixes, not retries.

When it happens

Trigger: RegisterStreamConsumer returns 200, then describe polls either error immediately (425) or never see the consumer ACTIVE before maxTries elapses (426).

Common situations: Slow consumer activation combined with low max_retries; describe-permission missing; throttling right after registration.

Understand the failure class

Background: Request timed out: what client-side request timeouts mean across libraries (Request timed out, TIMED_OUT, APITimeoutError) — this error's family across 39 libraries.

Timeouts: ETIMEDOUT, deadlines, and hung requests — what actually expires when a request times out.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/82f1eeb0f8de47b4. Report an issue: GitHub.