crowdsecurity/crowdsec · error

unable to load inband rule %s : %s

Error message

unable to load inband rule %s : %s

What it means

Same as the outofband variant but for in-band rules: Build() calls LoadCollection for each entry in wc.InBandRules and wraps any failure. In-band rules run synchronously during request evaluation, so the appsec runtime cannot be built without them.

Source

Thrown at pkg/appsec/appsec.go:958

	for _, rule := range wc.OutOfBandRules {
		wc.Logger.Infof("loading outofband rule %s", rule)

		collections, err := LoadCollection(rule, wc.Logger.WithField("component", "appsec_collection_loader"), hub)
		if err != nil {
			return nil, fmt.Errorf("unable to load outofband rule %s : %s", rule, err)
		}

		ret.OutOfBandRules = append(ret.OutOfBandRules, collections...)
	}

	wc.Logger.Infof("Loaded %d outofband rules", len(ret.OutOfBandRules))

	for _, rule := range wc.InBandRules {
		wc.Logger.Infof("loading inband rule %s", rule)

		collections, err := LoadCollection(rule, wc.Logger.WithField("component", "appsec_collection_loader"), hub)
		if err != nil {
			return nil, fmt.Errorf("unable to load inband rule %s : %s", rule, err)
		}

		ret.InBandRules = append(ret.InBandRules, collections...)
	}

	wc.Logger.Infof("Loaded %d inband rules", len(ret.InBandRules))

	// Load datafiles declared directly on the appsec-config (e.g. bot lists for
	// MatchKnownBot) into the expr datafile registry. cwhub has already
	// downloaded them; this mirrors initRuleData for appsec-rules.
	for _, d := range wc.Data {
		if d.DestPath == "" {
			wc.Logger.Errorf("missing dest_file for data in appsec-config %s: %+v", wc.Name, d)
			continue
		}

		if err := exprhelpers.FileInit(hub.GetDataDir(), d.DestPath, d.Type); err != nil {
			wc.Logger.Errorf("unable to initialize data file %s: %s", d.DestPath, err)

View on GitHub (pinned to 909b515798)

Solutions

1. Correct the inband_rules entry name against `cscli collections list -a`
2. Install missing collections: `cscli collections install crowdsecurity/appsec-virtual-patching`
3. Run `cscli hub update && cscli hub upgrade` to repair stale hub files
4. Read the wrapped error to distinguish YAML parse issues from missing-name issues

Example fix

// before
inband_rules:
  - crowdsecurity/virtual-patching
// after
inband_rules:
  - crowdsecurity/appsec-virtual-patching

for _, rule := range cfg.InBandRules {
    if !cscliCollectionExists(rule) {
        return fmt.Errorf("inband rule %q not installed", rule)
    }
}

if err := buildAppsecRuntime(cfg); err != nil {
    log.Fatalf("appsec build failed: %v", err) // wrapped LoadCollection cause is in %v
}

When it happens

Trigger: Build() hitting a LoadCollection error for a name in inband_rules: collection not installed, YAML parse failure, missing dependency collection referenced by includes.

Common situations: Typo in `inband_rules:` entry; crowdsecurity/appsec-virtual-patching not installed; hub in a broken state after failed upgrade; hand-edited rule file with invalid indentation.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

• unable to load outofband rule %s : %s
• no appsec_config provided
• no zones defined
• no match type defined
• no match value defined

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/663518c69c2f74de. Report an issue: GitHub.