crowdsecurity/crowdsec · error

while decoding %s: %w

Error message

while decoding %s: %w

What it means

LoadProfiles streams the profiles yaml file through a yaml.Decoder, decoding one profile document per iteration until EOF. A decode error on any non-final document (bad YAML syntax, wrong field types, unknown fields under strict decoding) is wrapped with the profiles path. Profiles are required for notification workflows, so startup aborts.

Source

Thrown at pkg/csconfig/profiles.go:61

	if err != nil {
		return err
	}

	reader := bytes.NewReader(fcontent)

	dec := yaml.NewDecoder(reader)
	dec.KnownFields(true)

	for {
		t := ProfileCfg{}

		err = dec.Decode(&t)
		if err != nil {
			if errors.Is(err, io.EOF) {
				break
			}

			return fmt.Errorf("while decoding %s: %w", c.ProfilesPath, err)
		}

		c.Profiles = append(c.Profiles, &t)
	}

	if len(c.Profiles) == 0 {
		return errors.New("zero profiles loaded for LAPI")
	}

	return nil
}

View on GitHub (pinned to 909b515798)

Solutions

1. Run `yamllint /etc/crowdsec/profiles.yaml` and fix the syntax error it reports (the wrapped %w error names the line).
2. If you appended a custom profile, check the '---' separator placement and indentation of the added document.
3. Compare field names/types against the upstream profiles.yaml example (filters, notifications, name).
4. Restore the stock profiles.yaml from the crowdsec package and reapply customizations one at a time.

Example fix

// before (profiles.yaml, wrong type)
- name: foo
  notifications: email   # string, must be a list
// after
- name: foo
  notifications:
    - email_default

f, err := os.Open(profilesPath)
if err != nil { return err }
defer f.Close()
dec := yaml.NewDecoder(f)
for {
    var t map[string]any
    if err := dec.Decode(&t); err != nil {
        if errors.Is(err, io.EOF) { break }
        return fmt.Errorf("profiles.yaml invalid: %w", err)
    }
}

if err := cfg.LoadProfiles(); err != nil {
    if strings.Contains(err.Error(), "while decoding") {
        // point the operator at the profiles.yaml line named in the wrapped error
    }
    return err
}

When it happens

Trigger: profiles.yaml (default /etc/crowdsec/profiles.yaml) contains malformed YAML or a document after the first whose schema is wrong — e.g. filters/name/notifications fields with wrong types, or a second profile entry with invalid structure.

Common situations: Operators append custom profiles to the stock file with bad indentation or an extra document separator '---' followed by broken content; upgrades move fields around making old profiles invalid.

Related errors

• empty file
• empty profiles path
• zero profiles loaded for LAPI
• while parsing DockerAcquisition configuration: %s
• cannot parse FileAcquisition configuration: %s

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/a3f51a8f5b55795e. Report an issue: GitHub.