What causes "while checking acquisition_path: %w" in crowdsecurity/crowdsec?

Fix permissions on every path component so the crowdsec user can stat the file (`chmod a+rx` on parent dirs)

while checking acquisition_path: %w

Error message

while checking acquisition_path: %w

What it means

CollectAcquisitionFiles stats the configured acquisition_path. A missing file is tolerated (skipped with a debug log), but any other os.Stat error — permission denied on a parent directory, path too long, I/O error — aborts with this wrapped error.

Source

Thrown at pkg/csconfig/crowdsec_service.go:63

func (c *CrowdsecServiceCfg) CollectAcquisitionFiles() ([]string, error) {
	ret := []string{}

	// agent section missing in the configuration file.
	// likely a lapi-only setup, not much we can do here
	if c == nil {
		return nil, nil
	}

	if c.AcquisitionFilePath != "" {
		log.Debugf("non-empty acquisition_path %s", c.AcquisitionFilePath)

		_, err := os.Stat(c.AcquisitionFilePath)

		switch {
		case errors.Is(err, fs.ErrNotExist):
			log.Debugf("acquisition_path: %s does not exist, skipping", c.AcquisitionFilePath)
		case err != nil:
			return nil, fmt.Errorf("while checking acquisition_path: %w", err)
		default:
			ret = append(ret, c.AcquisitionFilePath)
		}
	}

	// XXX: TODO: set default AcquisitionDirPath

	if c.AcquisitionDirPath != "" {
		dirFiles, err := filepath.Glob(c.AcquisitionDirPath + "/*.yaml")
		if err != nil {
			return nil, fmt.Errorf("while globbing acquis_dir: %w", err)
		}

		ret = append(ret, dirFiles...)

		dirFiles, err = filepath.Glob(c.AcquisitionDirPath + "/*.yml")
		if err != nil {
			return nil, fmt.Errorf("while globbing acquis_dir: %w", err)

View on GitHub (pinned to 909b515798)

Solutions

Fix permissions on every path component so the crowdsec user can stat the file (`chmod a+rx` on parent dirs)
Check each path component exists and is a directory (`namei -l <path>`)
Point acquisition_path to the standard /etc/crowdsec/acquis.yaml
Check dmesg/audit logs if the filesystem is degraded

Example fix

// before (config.yaml)
crowdsec_service:
  acquisition_path: /root/acquis.yaml  # not traversable by crowdsec user
// after
crowdsec_service:
  acquisition_path: /etc/crowdsec/acquis.yaml

Defensive patterns

Strategy: validation

Validate before calling

if acquisPath != "" {
	if _, err := os.Stat(acquisPath); err != nil && !errors.Is(err, fs.ErrNotExist) {
		log.Fatalf("acquisition_path %s not statable: %v", acquisPath, err)
	}
}

Try / catch

files, err := svcCfg.CollectAcquisitionFiles()
if err != nil {
	if strings.Contains(err.Error(), "while checking acquisition_path") {
		log.Fatalf("fix acquisition_path permissions: %v", err)
	}
	return err
}

Prevention

Keep acquis.yaml under /etc/crowdsec, world-traversable directories
Verify with `sudo -u crowdsec stat /etc/crowdsec/acquis.yaml` after permission changes
Avoid placing acquisition files under home directories of other users

When it happens

Trigger: crowdsec agent startup (LoadCrowdsec) with acquisitons.acquisition_path set and os.Stat failing with something other than ErrNotExist — typically a permission-denied traversal of a parent directory.

Common situations: acquisition_path under a directory the crowdsec user cannot traverse (e.g. /root/...); restrictive ACLs; mount point offline; path component is a file, not a directory.

Understand the failure class

Background: "failed to read file", EACCES, ENOENT and "could not read <path>" errors: when a program can't read a file from disk — this error's family across 49 libraries.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/af9c9b6c298d20f3. Report an issue: GitHub.