crowdsecurity/crowdsec · error

while creating temp file: %w

Error message

while creating temp file: %w

What it means

Creating the temporary file for a request-dump JSON write (os.CreateTemp with prefix crowdsec_req_dump_*.json) failed in ReqDumpFilter.ToJSON. Typical causes: full /tmp, no permission, or exhausted file descriptors; the dump of the filtered request cannot be written.

Source

Thrown at pkg/appsec/request.go:272

		len(r.HeadersNameFilters) == 0 &&
		len(r.ArgsContentFilters) == 0 &&
		len(r.ArgsNameFilters) == 0 &&
		!r.BodyDrop && !r.HeadersDrop && !r.ArgsDrop {
		log.Warningf("no filters, returning original request")
		return r.req
	}

	r2 := ParsedRequest{}
	r.FilterHeaders(&r2)
	r.FilterBody(&r2)
	r.FilterArgs(&r2)
	return &r2
}

func (r *ReqDumpFilter) ToJSON() error {
	fd, err := os.CreateTemp("", "crowdsec_req_dump_*.json")
	if err != nil {
		return fmt.Errorf("while creating temp file: %w", err)
	}
	defer fd.Close()
	enc := json.NewEncoder(fd)
	enc.SetIndent("", "  ")

	req := r.GetFilteredRequest()

	log.Tracef("dumping : %+v", req)

	if err := enc.Encode(req); err != nil {
		//Don't clobber the temp directory with empty files
		err2 := os.Remove(fd.Name())
		if err2 != nil {
			log.Errorf("while removing temp file %s: %s", fd.Name(), err)
		}
		return fmt.Errorf("while encoding request: %w", err)
	}
	log.Infof("request dumped to %s", fd.Name())

View on GitHub (pinned to 909b515798)

Solutions

1. Check TMPDIR is set to an existing writable directory, or fix it
2. Ensure the temp filesystem is writable and has free space (df -h /tmp)
3. Run the container with a writable tmpfs mount (e.g. --tmpfs /tmp)
4. Inspect process permissions / SELinux or AppArmor denials for the temp dir

Example fix

// before
TMPDIR=/nonexistent crowdsec ...
// after
TMPDIR=/var/tmp crowdsec ...   # /var/tmp writable

// check temp dir is writable before dumping
if f, err := os.CreateTemp("", "probe_*"); err == nil { f.Close(); os.Remove(f.Name()) } else { return err }

if err := dump.ToJSON(); err != nil {
    log.Errorf("request dump failed: %v", err)
    // continue serving, dump is best-effort
}

When it happens

Trigger: Calling ToJSON when os.CreateTemp("", "crowdsec_req_dump_*.json") fails — read-only or full temp filesystem, wrong TMPDIR, or permission problems on the temp directory.

Common situations: Containers running with a read-only root filesystem or no writable /tmp, TMPDIR pointing to a non-existent path, disk full, or hardened runtimes blocking file creation.

Understand the failure class

Background: "open() failed", "failed to open file", "cannot create file" — what a file open error means and how to fix it — this error's family across 42 libraries.

Related errors

• could not read CRL file: %w
• unable to read file %s : %w
• too many levels of symbolic links
• cannot copy a folder onto itself
• can't read aws_config_dir %s got err %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/bd8f654dec9070fb. Report an issue: GitHub.