crowdsecurity/crowdsec · error

unknown error

Error message

unknown error

What it means

ErrUnknown is a catch-all sentinel for unexpected internal failures in CTI handling. In the expr helper it is returned when a successfully fetched CTI result fails to be stored in the local CTI cache (SetWithExpire error), aborting the lookup with an empty SmokeItem.

Source

Thrown at pkg/cticlient/client.go:27

	"net/http"
	"strings"

	"github.com/crowdsecurity/crowdsec/pkg/apiclient/useragent"
	log "github.com/sirupsen/logrus"
)

const (
	CTIBaseUrl    = "https://cti.api.crowdsec.net/v2"
	smokeEndpoint = "/smoke"
	fireEndpoint  = "/fire"
)

var (
	ErrUnauthorized  = errors.New("unauthorized")
	ErrLimit         = errors.New("request quota exceeded, please reduce your request rate")
	ErrNotFound      = errors.New("ip not found")
	ErrDisabled      = errors.New("cti is disabled")
	ErrUnknown       = errors.New("unknown error")
	defaultUserAgent = useragent.Default()
)

type CrowdsecCTIClient struct {
	httpClient *http.Client
	apiKey     string
	Logger     *log.Entry
	UserAgent  string
}

func (c *CrowdsecCTIClient) doRequest(ctx context.Context, method string, endpoint string, params map[string]string) ([]byte, error) {
	url := CTIBaseUrl + endpoint
	if len(params) > 0 {
		url += "?"
		for k, v := range params {
			url += fmt.Sprintf("%s=%s&", k, v)
		}
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Restart crowdsec to reinitialize the CTI cache
2. Check logs for the preceding 'error while caching CTI' warning to identify the cache backend failure
3. Inspect memory/disk usage if the cache is persistent; enlarge limits as needed

Example fix

null

null

null

resp, err := ctiClient.GetIPInfo(ip)
if errors.Is(err, cticlient.ErrUnknown) {
    log.Warning("CTI lookup failed internally; skipping enrichment")
    return &cticlient.SmokeItem{}, nil
}

When it happens

Trigger: CTICache.SetWithExpire fails (cache backend error) inside the IpCTI expr function after a successful API response.

Common situations: Cache backend (e.g. in-memory/bolt) corrupted, full, or closed; memory pressure on a long-running LAPI process.

Understand the failure class

Background: "This is a bug, please report it": internal invariant violations, unreachable panics, and SNH errors explained — this error's family across 47 libraries.

Related errors

• cti is disabled
• invalid type for ip : %T
• empty cti key
• unauthorized
• request quota exceeded, please reduce your request rate

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/6ed332a922de29ac. Report an issue: GitHub.