crowdsecurity/crowdsec · error

unable to collect sources from bucket: %w

Error message

unable to collect sources from bucket: %w

What it means

NewAlert builds a runtime Alert when a bucket overflows. As part of that it calls alertFormatSource to gather the sources from the overflow queue; any failure there is wrapped with this message. Like error 1192 it is a propagation wrapper — the actionable cause is deeper (scope filter evaluation error or mixed source types), here bound to the public NewAlert entry point used by bucket overflow processing.

Source

Thrown at pkg/leakybucket/overflows.go:350

		Leakspeed:       &leakSpeed,
		Message:         new(string),
		StartAt:         &startAt,
		StopAt:          &stopAt,
		Simulated:       &simulated,
		Kind:            types.CrowdsecAlertKind.String(),
	}

	if leaky.Factory == nil {
		return runtimeAlert, errors.New("leaky.BucketConfig is nil")
	}

	// give information about the bucket
	runtimeAlert.Mapkey = leaky.Mapkey

	// Get the sources from Leaky/Queue
	sources, source_scope, err := alertFormatSource(leaky, queue)
	if err != nil {
		return runtimeAlert, fmt.Errorf("unable to collect sources from bucket: %w", err)
	}

	runtimeAlert.Sources = sources
	// Include source info in format string
	sourceStr := "UNKNOWN"
	if len(sources) > 1 {
		sourceStr = fmt.Sprintf("%d sources", len(sources))
	} else if len(sources) == 1 {
		for k := range sources {
			sourceStr = k
			break
		}
	}

	*apiAlert.Message = fmt.Sprintf("%s %s performed '%s' (%d events over %s) at %s", source_scope, sourceStr, leaky.Factory.Spec.Name, leaky.Total_count, leaky.Ovflw_ts.Sub(leaky.First_ts), leaky.Last_ts)
	// Get the events from Leaky/Queue
	apiAlert.Events = EventsFromQueue(queue)

View on GitHub (pinned to 909b515798)

Solutions

1. Read the chained inner error after this message for the real cause (filter evaluation vs. multiple source types)
2. Reproduce with the offending log line using cscli/crowdsec in debug mode
3. Fix the scenario's scope filter or parser output as indicated by the inner error
4. Validate the fixed scenario by replaying the logs before reloading the hub

// Sanity-check scenario + parser before deploy by replaying real logs:
// cscli hub item reload scenario-x && cscli metrics (alert count > 0 on expected traffic)

alert, err := leakybucket.NewAlert(leaky, queue)
if err != nil {
    // err chain: "unable to collect sources from bucket" -> inner cause
    return fmt.Errorf("NewAlert failed: %w", err)
}

When it happens

Trigger: overflow() → NewAlert(leaky, queue) when alertFormatSource returns an error: a scope filter expression fails at runtime, RunTimeFilter is nil with a non-Range scope, or queued events have multiple source scope types.

Common situations: Production overflow that should have generated an alert but didn't, with this line in logs — almost always after a scenario/parser edit changed event shape or the scope filter expression.

Related errors

• leaky.BucketConfig is nil
• while extracting scope from bucket %s: %w
• event has multiple source types : %s != %s
• invalid generated alert: %w: %s
• path must start with /

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/ad6ba437898ccec6. Report an issue: GitHub.