What causes "unable to check if value is allowlisted: %w" in crowdsecurity/crowdsec?

Read the wrapped error: 'database is locked' means reduce concurrent writers or switch to a client-server DB

unable to check if value is allowlisted: %w

Error message

unable to check if value is allowlisted: %w

What it means

IsAllowlistedBy queries allowlist items matching a value (IP or CIDR) together with their parent allowlist edge, to produce human-readable matching reasons. If the ent query (WithAllowlist().All) fails, this error wraps the DB failure. Note the sort afterwards assumes every item has a non-empty Edges.Allowlist.

Source

Thrown at pkg/database/allowlists.go:327

						allowlistitem.And(
							allowlistitem.StartIPEQ(rng.Start.Addr),
							allowlistitem.StartSuffixGTE(rng.Start.Sfx),
						)),
					allowlistitem.Or(
						allowlistitem.EndIPLT(rng.End.Addr),
						allowlistitem.And(
							allowlistitem.EndIPEQ(rng.End.Addr),
							allowlistitem.EndSuffixLTE(rng.End.Sfx),
						),
					),
				),
			),
		)
	}

	items, err := query.WithAllowlist().All(ctx)
	if err != nil {
		return nil, fmt.Errorf("unable to check if value is allowlisted: %w", err)
	}

	// doing this in ent is not worth the complexity
	sort.SliceStable(items, func(i, j int) bool {
		return items[i].Edges.Allowlist[0].Name < items[j].Edges.Allowlist[0].Name
	})

	for _, item := range items {
		if len(item.Edges.Allowlist) == 0 {
			continue
		}

		reason := item.Value + " from " + item.Edges.Allowlist[0].Name
		if item.Comment != "" {
			reason += " (" + item.Comment + ")"
		}

		reasons = append(reasons, reason)

View on GitHub (pinned to 909b515798)

Solutions

Read the wrapped error: 'database is locked' means reduce concurrent writers or switch to a client-server DB
Run 'cscli db migrate' / upgrade flow if the schema is older than the binary
Verify DB file integrity and disk space; restore from backup if corrupted
Retry the lookup - it is read-only and safe to repeat

Defensive patterns

Strategy: try-catch

Validate before calling

if _, err := csnet.NewRange(value); err != nil {
    return fmt.Errorf("invalid allowlist lookup value %q", value)
}

Try / catch

reasons, err := c.IsAllowlistedBy(ctx, value)
if err != nil {
    if strings.Contains(err.Error(), "database is locked") {
        return c.IsAllowlistedBy(ctx, value) // read-only, safe to retry
    }
    return fmt.Errorf("allowlist lookup failed: %w", err)
}

Prevention

Run DB migrations when upgrading crowdsec before serving lookups
Keep SQLite writers serialized or move to a client-server DB at scale
Validate the value parses as an IP/CIDR before the DB call

When it happens

Trigger: Calling IsAllowlistedBy / CheckInAllowlistBulk / TestIsAllowListedBy_* when the underlying allowlist_item query fails: SQLite 'database is locked', disk I/O error, or schema mismatch (e.g. upgrading crowdsec without running the DB migration).

Common situations: Bouncer or LAPI lookups during heavy write load locking the SQLite DB; running a newer binary against an older schema that lacks the allowlist tables.

Understand the failure class

Background: Database query failed: Internal Server Error 500s wrapping SQL, Prisma, and connection failures — what to check first — this error's family across 16 libraries.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/9ccd4837378e96e1. Report an issue: GitHub.