crowdsecurity/crowdsec · error

unknown fstype %d

Error message

unknown fstype %d

What it means

On Linux, GetFSType statfs's a path and looks the returned filesystem magic number up in fsTypeMapping. If buf.Type isn't a known magic constant, the filesystem (or the platform variation of it) isn't in the table and this error is returned.

Source

Thrown at pkg/fsutil/getfstype.go:110

	0xa501fcf5: "vxfs",
	0xabba1974: "xenfs",
	0x012ff7b4: "xenix",
	0x58465342: "xfs",
	0x2fc12fc1: "zfs",
}

func GetFSType(path string) (string, error) {
	var buf unix.Statfs_t

	err := unix.Statfs(path, &buf)
	if err != nil {
		return "", err
	}

	fsType, ok := fsTypeMapping[int64(buf.Type)] //nolint:unconvert

	if !ok {
		return "", fmt.Errorf("unknown fstype %d", buf.Type)
	}

	return fsType, nil
}

View on GitHub (pinned to 909b515798)

Solutions

1. Identify the filesystem via `stat -f <path>` and add its magic number to fsTypeMapping in pkg/fsutil/getfstype.go
2. As a workaround, call unix.Statfs directly and map the type yourself
3. Handle the error and treat the filesystem as unknown instead of failing the caller
4. Upgrade to a version whose fsTypeMapping includes your filesystem

Example fix

// in fsTypeMapping, add the missing fs magic
const NFS_SUPER_MAGIC = 0x6969
fsTypeMapping = map[int64]string{
    ...
    NFS_SUPER_MAGIC: "nfs",
}

fsType, err := fsutil.GetFSType(path)
if err != nil {
    log.Debugf("fs type unknown for %s: %v", path, err)
    fsType = "unknown" // degrade gracefully
}

When it happens

Trigger: Calling GetFSType(path) on Linux where the underlying filesystem's statfs magic number is absent from fsTypeMapping — exotic FUSE filesystems, newer kernels with filesystems unknown to this table, or unusual virtual filesystems.

Common situations: Monitoring or acquisition code inspecting mounts on unusual setups: NFS variants, overlayfs on newer kernels, zfs, btrfs modules, or container-specific filesystems not yet mapped.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• failed to get filesystem type: %w
• unable to close %s : %s
• could not access CRL file: %w
• could not read CRL file: %w
• plugin at %s does not exist: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/fba64d809e6856f9. Report an issue: GitHub.