crowdsecurity/crowdsec · error

unknown log_mode %q

Error message

unknown log_mode %q

What it means

SetupStandardLogger configures logrus from the logging config. The log_mode setting selects the output media (file, syslog, stdout); any value outside the recognized set hits the default branch and returns 'unknown log_mode %q'. It is raised from LoadConfig time, meaning crowdsec aborts startup on an invalid logging configuration.

Source

Thrown at pkg/logging/standard.go:33

// SetupStandardLogger configures the global logger according to the
// provided configuration. It applies the output destination, log format,
// rotation policy, and log level used by all components that rely on the
// default logrus instance (`logrus.StandardLogger()`).
func SetupStandardLogger(cfg LogConfig, level logrus.Level, forceColors bool) error {
	var logFormatter logrus.Formatter

	switch cfg.GetMedia() {
	case "file":
		logrus.SetOutput(cfg.NewRotatingLogger(defLogFilename))
	case "syslog":
		if err := setupSyslogDefault(); err != nil {
			return err
		}
	case "stdout":
		// noop
	default:
		return fmt.Errorf("unknown log_mode %q", cfg.GetMedia())
	}

	logrus.SetLevel(cmp.Or(level, defLogLevel))

	switch cfg.GetFormat() {
	case "text", "":
		logFormatter = &logrus.TextFormatter{
			TimestampFormat: time.RFC3339,
			FullTimestamp:   true,
			ForceColors:     forceColors,
		}
	case "json":
		logFormatter = &logrus.JSONFormatter{TimestampFormat: time.RFC3339}
	default:
		return fmt.Errorf("unknown log_format %q", cfg.GetFormat())
	}

	logrus.SetFormatter(logFormatter)

View on GitHub (pinned to 909b515798)

Solutions

1. Set log_mode to one of: file, syslog, stdout
2. Check the exact quoted value in the error to spot the typo
3. Validate the whole logging section against current crowdsec docs after upgrades
4. Restart crowdsec to confirm startup succeeds

Example fix

// before (config.yaml)
common:
  log_mode: stoud
// after
common:
  log_mode: stdout

# Pre-flight check of the config value:
# shell: grep -A2 'log_mode' /etc/crowdsec/config.yaml
# valid values: file | syslog | stdout

// If configuring programmatically via csconfig:
if err := logging.SetupStandardLogger(cfg); err != nil {
    return fmt.Errorf("logging config invalid: %w", err)
}

When it happens

Trigger: api.console/sapi or common logging config (csconfig) contains log_mode set to anything other than 'file', 'syslog', or 'stdout' — e.g. a typo like 'stout', a copied config from another product, or a hand-edited config.yaml.

Common situations: Hand-editing /etc/crowdsec/config.yaml or local dev.yaml; config templating writing a bad default; upgrading and an old non-standard value is no longer accepted.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• unknown log_format %q
• path must start with /
• on_challenge hooks are only valid in-band, not under outofba
• empty cti key
• no listen_uri or listen_socket specified

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/3a03774b20523048. Report an issue: GitHub.