What causes "while generating decision from profile %s: %w" in crowdsecurity/crowdsec?

Inspect the wrapped inner error for the concrete cause (often duration parse or expr evaluation).

while generating decision from profile

Error message

while generating decision from profile %s: %w

What it means

When a profile filter evaluates to true, EvaluateProfile calls GenerateDecisionFromProfile to build the matching decisions. Any failure there (e.g. malformed decision duration, error evaluating decision scope/value expressions) is wrapped as 'while generating decision from profile <name>' and the whole evaluation returns an error with no decisions.

Solutions

Inspect the wrapped inner error for the concrete cause (often duration parse or expr evaluation).
Validate the profile's decisions block: required fields present, duration parseable, expressions valid.
Compare your custom profile against the stock /etc/crowdsec/profiles.yaml.
Enable debug logging and re-trigger an alert to see which decision field fails.

Example fix

// before (profiles.yaml decision)
decisions:
  - type: ban
    duration: 4hrs
// after
decisions:
  - type: ban
    duration: 4h

Defensive patterns

Strategy: try-catch

Validate before calling

// validate decisions config before use
for _, d := range profile.Decisions {
    if d.Duration != "" {
        if _, err := cstime.ParseDurationWithDays(d.Duration); err != nil {
            return fmt.Errorf("invalid decision duration %q: %w", d.Duration, err)
        }
    }
}

Try / catch

decisions, matched, err := profile.EvaluateProfile(alert)
if err != nil {
    log.Warnf("decision generation failed for profile %s: %v", profile.Cfg.Name, err)
    return
}

Prevention

Mirror the stock profiles.yaml structure when writing custom profiles
Keep decision fields (type, duration, scope) to known-good values
Test profile end-to-end with a simulated alert before production

When it happens

Trigger: A profile filter matched (true) and the associated decision template failed to generate: invalid decision fields in the profile (bad duration string, invalid scope/value expr), or an internal error producing decisions from the alert.

Common situations: Profile YAML defining a decision with unsupported keys or malformed nested expressions; custom scenarios/profiles written for older CrowdSec versions whose decision schema changed; alerts lacking data the decision expr expects.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/ecfc8d0274ad4c86. Report an issue: GitHub.

Appendix: source

Thrown at pkg/csprofiles/csprofiles.go:191

		debugProfile := false
		if profile.Cfg.Debug != nil && *profile.Cfg.Debug {
			debugProfile = true
		}

		output, err := exprhelpers.Run(expression, map[string]interface{}{"Alert": alert}, profile.Logger, debugProfile)
		if err != nil {
			profile.Logger.Warningf("failed to run profile expr for %s: %v", profile.Cfg.Name, err)
			return nil, matched, fmt.Errorf("while running expression %s: %w", profile.Cfg.Filters[eIdx], err)
		}

		switch out := output.(type) {
		case bool:
			if out {
				matched = true
				/*the expression matched, create the associated decision*/
				subdecisions, err := profile.GenerateDecisionFromProfile(alert)
				if err != nil {
					return nil, matched, fmt.Errorf("while generating decision from profile %s: %w", profile.Cfg.Name, err)
				}

				decisions = append(decisions, subdecisions...)
			} else {
				profile.Logger.Debugf("Profile %s filter is unsuccessful", profile.Cfg.Name)

				if profile.Cfg.OnFailure == "break" {
					break
				}
			}

		default:
			return nil, matched, fmt.Errorf("unexpected type %t (%v) while running '%s'", output, output, profile.Cfg.Filters[eIdx])
		}
	}

	return decisions, matched, nil
}

View on GitHub (pinned to 909b515798)