What causes "unsupported mode %s for file source" in crowdsecurity/crowdsec?

Set mode to exactly `tail` or `cat` (or omit it to get the tail default).

unsupported mode %s for file source

Error message

unsupported mode %s for file source

What it means

After parsing, UnmarshalConfig validates config.Mode: only "cat" and "tail" are supported (empty defaults to tail). Any other value returns "unsupported mode %s for file source". It is an enum-validation error on the file datasource's mode key.

Source

Thrown at pkg/acquisition/modules/file/config.go:60

	if s.logger != nil {
		s.logger.Tracef("FileAcquisition configuration: %+v", s.config)
	}

	if s.config.Filename != "" {
		s.config.Filenames = append(s.config.Filenames, s.config.Filename)
	}

	if len(s.config.Filenames) == 0 {
		return errors.New("no filename or filenames configuration provided")
	}

	if s.config.Mode == "" {
		s.config.Mode = configuration.TAIL_MODE
	}

	if s.config.Mode != configuration.CAT_MODE && s.config.Mode != configuration.TAIL_MODE {
		return fmt.Errorf("unsupported mode %s for file source", s.config.Mode)
	}

	for _, exclude := range s.config.ExcludeRegexps {
		re, err := regexp.Compile(exclude)
		if err != nil {
			return fmt.Errorf("could not compile regexp %s: %w", exclude, err)
		}

		s.exclude_regexps = append(s.exclude_regexps, re)
	}

	return nil
}

func (s *Source) Configure(_ context.Context, yamlConfig []byte, logger *log.Entry, metricsLevel metrics.AcquisitionMetricsLevel) error {
	s.logger = logger
	s.metricsLevel = metricsLevel

View on GitHub (pinned to 909b515798)

Solutions

Set mode to exactly `tail` or `cat` (or omit it to get the tail default).
If you wanted one-pass reading of existing content, use mode: cat; for live following, use mode: tail.
Check casing — the comparison is against the exact constants, so use lowercase.

Example fix

// before
source: file
mode: read
filename: /var/log/syslog
// after
source: file
mode: cat
filename: /var/log/syslog

Defensive patterns

Strategy: validation

Validate before calling

// Go: pre-validate mode against the allowed set
mode := cfg.Mode
if mode == "" {
	mode = "tail"
}
if mode != "cat" && mode != "tail" {
	return fmt.Errorf("mode must be 'cat' or 'tail', got %q", mode)
}

Try / catch

if err := src.UnmarshalConfig(cfgYAML); err != nil {
	if strings.Contains(err.Error(), "unsupported mode") {
		// fix mode in the YAML block, then retry parse
	}
}

Prevention

Omit `mode` entirely unless you specifically need `cat`.
Remember the only two values: `cat` (read from start, stop at EOF) and `tail` (follow).
Keep values lowercase; the comparison is exact.
Lint acquis.yaml against the datasource schema in CI.

When it happens

Trigger: Setting `mode: read`, `mode: follow`, or any value other than cat/tail in a file acquisition block (ConfigureByDSN hard-codes cat; this error only comes from the YAML config path).

Common situations: Users porting configs from other log shippers (e.g. `mode: read` from filebeat habits); copy-pasting journalctl/docker datasource fields into a file source; typos like `mode: Tail` case variants that don't equal the constants.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/969ba27d8f6adadd. Report an issue: GitHub.