crowdsecurity/crowdsec · error

while decoding

Error message

while decoding %s: %w

What it means

LoadProfiles streams the profiles yaml file through a yaml.Decoder, decoding one profile document per iteration until EOF. A decode error on any non-final document (bad YAML syntax, wrong field types, unknown fields under strict decoding) is wrapped with the profiles path. Profiles are required for notification workflows, so startup aborts.

Solutions

1. Run `yamllint /etc/crowdsec/profiles.yaml` and fix the syntax error it reports (the wrapped %w error names the line).
2. If you appended a custom profile, check the '---' separator placement and indentation of the added document.
3. Compare field names/types against the upstream profiles.yaml example (filters, notifications, name).
4. Restore the stock profiles.yaml from the crowdsec package and reapply customizations one at a time.

Example fix

// before (profiles.yaml, wrong type)
- name: foo
  notifications: email   # string, must be a list
// after
- name: foo
  notifications:
    - email_default

f, err := os.Open(profilesPath)
if err != nil { return err }
defer f.Close()
dec := yaml.NewDecoder(f)
for {
    var t map[string]any
    if err := dec.Decode(&t); err != nil {
        if errors.Is(err, io.EOF) { break }
        return fmt.Errorf("profiles.yaml invalid: %w", err)
    }
}

if err := cfg.LoadProfiles(); err != nil {
    if strings.Contains(err.Error(), "while decoding") {
        // point the operator at the profiles.yaml line named in the wrapped error
    }
    return err
}

When it happens

Trigger: profiles.yaml (default /etc/crowdsec/profiles.yaml) contains malformed YAML or a document after the first whose schema is wrong — e.g. filters/name/notifications fields with wrong types, or a second profile entry with invalid structure.

Common situations: Operators append custom profiles to the stock file with bad indentation or an extra document separator '---' followed by broken content; upgrades move fields around making old profiles invalid.

Related errors

• cannot parse FileAcquisition configuration
• cannot parse
• cannot parse S3Acquisition configuration
• cannot parse VictoriaLogs acquisition configuration
• cannot parse wineventlog configuration

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/a3f51a8f5b55795e. Report an issue: GitHub.

Appendix: source

Thrown at pkg/csconfig/profiles.go:61

	if err != nil {
		return err
	}

	reader := bytes.NewReader(fcontent)

	dec := yaml.NewDecoder(reader)
	dec.KnownFields(true)

	for {
		t := ProfileCfg{}

		err = dec.Decode(&t)
		if err != nil {
			if errors.Is(err, io.EOF) {
				break
			}

			return fmt.Errorf("while decoding %s: %w", c.ProfilesPath, err)
		}

		c.Profiles = append(c.Profiles, &t)
	}

	if len(c.Profiles) == 0 {
		return errors.New("zero profiles loaded for LAPI")
	}

	return nil
}

View on GitHub (pinned to 909b515798)