What causes "unable to get allowlist items: %w" in crowdsecurity/crowdsec?

Check the wrapped error; 'database is locked' means serialize writers or raise the SQLite busy timeout

unable to get allowlist items: %w

Error message

unable to get allowlist items: %w

What it means

ApplyAllowlistsToExistingDecisions fetches all non-expired allowlist items so their entries can be applied to existing ban decisions. If the ent query over allowlist items fails, this error wraps the DB failure and no decisions are modified.

Source

Thrown at pkg/database/allowlists.go:417

	}

	return ips, nets, nil
}

func (c *Client) ApplyAllowlistsToExistingDecisions(ctx context.Context) (int, error) {
	// Soft delete (set expiration to now) all decisions that matches any allowlist
	totalCount := 0

	// Get all non-expired allowlist items
	allowlistItems, err := c.Ent.AllowListItem.Query().
		Where(
			allowlistitem.Or(
				allowlistitem.ExpiresAtGTE(time.Now().UTC()),
				allowlistitem.ExpiresAtIsNil(),
			),
		).All(ctx)
	if err != nil {
		return 0, fmt.Errorf("unable to get allowlist items: %w", err)
	}

	if len(allowlistItems) == 0 {
		return 0, nil
	}

	ipv4Items := make([]*ent.AllowListItem, 0)
	ipv6Items := make([]*ent.AllowListItem, 0)

	for _, item := range allowlistItems {
		switch item.IPSize {
		case 4:
			ipv4Items = append(ipv4Items, item)
		case 16:
			ipv6Items = append(ipv6Items, item)
		default:
			c.Log.Errorf("unexpected IP size %d for allowlist item %s", item.IPSize, item.Value)
		}

View on GitHub (pinned to 909b515798)

Solutions

Check the wrapped error; 'database is locked' means serialize writers or raise the SQLite busy timeout
Verify DB integrity ('cscli db check' if available) and disk space
Re-run the operation; the function is read-only with respect to allowlist items

Defensive patterns

Strategy: try-catch

Try / catch

n, err := c.ApplyAllowlistsToExistingDecisions(ctx, ip, existingDecisions)
if err != nil {
    if strings.Contains(err.Error(), "database is locked") {
        return retryAfterBackoff(ctx, func() error { _, err := c.ApplyAllowlistsToExistingDecisions(ctx, ip, existingDecisions); return err })
    }
    return err
}

Prevention

Schedule decision imports/pulls to avoid overlapping heavy DB write windows
Increase SQLite busy_timeout for CLI/daemon contention
Run migrations after upgrades before starting the management loop

When it happens

Trigger: Calling ApplyAllowlistsToExistingDecisions (startup management loop, 'cscli decisions import', PullTop) when the query filtering on expires_at fails: DB locked, IO error, or missing schema.

Common situations: Crowdsec startup racing another process writing to SQLite; 'cscli decisions import' while the daemon bulk-writes decisions.

Understand the failure class

Background: Database query failed: Internal Server Error 500s wrapping SQL, Prisma, and connection failures — what to check first — this error's family across 16 libraries.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/16873f25680306a9. Report an issue: GitHub.