What causes "unable to get allowlists: %w" in crowdsecurity/crowdsec?

Inspect the wrapped error from ListAllowLists for lock/IO issues

unable to get allowlists: %w

Error message

unable to get allowlists: %w

What it means

GetAllowlistsContentForAPIC aggregates all console-managed allowlists into IPs and prefixes to push to APIC. It starts by calling ListAllowLists(ctx, true); if listing fails, this error wraps the failure and no addresses are returned.

Source

Thrown at pkg/database/allowlists.go:369

func (c *Client) IsAllowlisted(ctx context.Context, value string) (bool, string, error) {
	reasons, err := c.IsAllowlistedBy(ctx, value)
	if err != nil {
		return false, "", err
	}

	if len(reasons) == 0 {
		return false, "", nil
	}

	reason := strings.Join(reasons, ", ")

	return true, reason, nil
}

func (c *Client) GetAllowlistsContentForAPIC(ctx context.Context) ([]netip.Addr, []netip.Prefix, error) {
	allowlists, err := c.ListAllowLists(ctx, true)
	if err != nil {
		return nil, nil, fmt.Errorf("unable to get allowlists: %w", err)
	}

	var (
		ips  []netip.Addr
		nets []netip.Prefix
	)

	for _, allowlist := range allowlists {
		for _, item := range allowlist.Edges.AllowlistItems {
			if item.ExpiresAt.IsZero() || item.ExpiresAt.After(time.Now().UTC()) {
				if strings.Contains(item.Value, "/") {
					ipNet, err := netip.ParsePrefix(item.Value)
					if err != nil {
						c.Log.Errorf("unable to parse CIDR %s: %s", item.Value, err)
						continue
					}

					nets = append(nets, ipNet)

View on GitHub (pinned to 909b515798)

Solutions

Inspect the wrapped error from ListAllowLists for lock/IO issues
Ensure only one process writes to the SQLite DB at a time
Verify the allowlist schema exists with 'cscli allowlists list'; run migrations if needed
Retry the APIC push - it is a periodic sync and safe to repeat

Defensive patterns

Strategy: try-catch

Validate before calling

if err := dbHealthy(ctx, c); err != nil {
    return fmt.Errorf("skip APIC push, DB unavailable: %w", err)
}

Try / catch

ips, nets, err := c.GetAllowlistsContentForAPIC(ctx)
if err != nil {
    log.Warnf("APIC allowlist push skipped: %v", err)
    return // next sync cycle retries automatically
}

Prevention

Treat the APIC push as periodic: log and skip on failure rather than crashing
Avoid running competing writers against the SQLite DB during sync
Ensure migrations have run so the allowlist tables exist

When it happens

Trigger: Calling GetAllowlistsContentForAPIC (from ApplyApicWhitelists) when ListAllowLists fails: DB unavailable, locked, or the allowlist table missing.

Common situations: APIC whitelist push during SQLite contention with the crowdsec daemon; DB not yet migrated after an upgrade.

Understand the failure class

Background: Database query failed: Internal Server Error 500s wrapping SQL, Prisma, and connection failures — what to check first — this error's family across 16 libraries.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/9725bbc202570f01. Report an issue: GitHub.