crowdsecurity/crowdsec · error

while creating allowlist %s: %s

Error message

while creating allowlist %s: %s

What it means

When GetAllowListByID returns NotFound (list == nil), updateOneAllowlist creates the allowlist locally via CreateAllowList(name, description, ID, fromConsole=true). This error wraps a failure of that INSERT, meaning the local allowlist record could not be created with the console-provided ID.

Source

Thrown at pkg/apiserver/apic.go:769

		if err := json.Unmarshal([]byte(item), j); err != nil {
			return fmt.Errorf("while unmarshalling allowlist item: %s", err)
		}

		items = append(items, j)
	}

	list, err := a.dbClient.GetAllowListByID(ctx, *link.ID, false)
	if err != nil {
		if !ent.IsNotFound(err) {
			return fmt.Errorf("while getting allowlist %s: %s", *link.Name, err)
		}
	}

	if list == nil {
		list, err = a.dbClient.CreateAllowList(ctx, *link.Name, description, *link.ID, true)
		if err != nil {
			return fmt.Errorf("while creating allowlist %s: %s", *link.Name, err)
		}
	}

	added, err := a.dbClient.ReplaceAllowlist(ctx, list, items, true)
	if err != nil {
		return fmt.Errorf("while replacing allowlist %s: %s", *link.Name, err)
	}

	log.Infof("added %d values to allowlist %s", added, list.Name)

	if list.Name != *link.Name || list.Description != description {
		err = a.dbClient.UpdateAllowlistMeta(ctx, *link.ID, *link.Name, description)
		if err != nil {
			return fmt.Errorf("while updating allowlist meta %s: %s", *link.Name, err)
		}
	}

	log.Infof("Allowlist %s updated", *link.Name)

View on GitHub (pinned to 909b515798)

Solutions

1. Check cscli allowlists list for an existing allowlist with the same name or ID and remove/rename it
2. Inspect the wrapped %s message for a UNIQUE/duplicate-key constraint vs connection error
3. Verify DB is writable and not locked (disk space, sqlite lock, other processes)
4. If the stale entry was console-created, delete it and let the sync recreate it
5. Restart crowdsec to reset the DB connection and re-trigger the sync

// check for an existing allowlist with the same name before first sync
existing := cscli_allowlists_list() // e.g. cscli allowlists list -o json
for _, al := range existing {
    if al.Name == linkName || al.ID == linkID {
        log.Warnf("allowlist %s (%s) already exists locally", al.Name, al.ID)
    }
}

if err := a.updateOneAllowlist(ctx, client, link); err != nil {
    if strings.Contains(err.Error(), "while creating allowlist") {
        log.Errorf("could not create allowlist %s locally (duplicate name/ID or DB error): %s", *link.Name, err)
    } else {
        log.Errorf("updating allowlists from CAPI: %s", err)
    }
}

When it happens

Trigger: CreateAllowList fails on first sync of a console-managed allowlist: DB write error, UNIQUE constraint conflict (an allowlist with the same name or ID already exists but the earlier lookup didn't find it), or DB connection loss.

Common situations: Stale local allowlist row with the same name created before console enrollment; SQLite lock or full disk during enrollment; duplicated allowlist entries in console config; DB in read-only mode.

Related errors

• while getting allowlist %s: %s
• unable to add values to allowlist: %w
• unable to check if value is allowlisted: %w
• unable to get allowlist items: %w
• unable to expire decisions for batch: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/33418293b44a1f31. Report an issue: GitHub.