What causes "while generating decision from profile %s: %w" in crowdsecurity/crowdsec?

Inspect the wrapped inner error for the concrete cause (often duration parse or expr evaluation).

while generating decision from profile %s: %w

Error message

while generating decision from profile %s: %w

What it means

When a profile filter evaluates to true, EvaluateProfile calls GenerateDecisionFromProfile to build the matching decisions. Any failure there (e.g. malformed decision duration, error evaluating decision scope/value expressions) is wrapped as 'while generating decision from profile <name>' and the whole evaluation returns an error with no decisions.

Source

Thrown at pkg/csprofiles/csprofiles.go:191

		debugProfile := false
		if profile.Cfg.Debug != nil && *profile.Cfg.Debug {
			debugProfile = true
		}

		output, err := exprhelpers.Run(expression, map[string]interface{}{"Alert": alert}, profile.Logger, debugProfile)
		if err != nil {
			profile.Logger.Warningf("failed to run profile expr for %s: %v", profile.Cfg.Name, err)
			return nil, matched, fmt.Errorf("while running expression %s: %w", profile.Cfg.Filters[eIdx], err)
		}

		switch out := output.(type) {
		case bool:
			if out {
				matched = true
				/*the expression matched, create the associated decision*/
				subdecisions, err := profile.GenerateDecisionFromProfile(alert)
				if err != nil {
					return nil, matched, fmt.Errorf("while generating decision from profile %s: %w", profile.Cfg.Name, err)
				}

				decisions = append(decisions, subdecisions...)
			} else {
				profile.Logger.Debugf("Profile %s filter is unsuccessful", profile.Cfg.Name)

				if profile.Cfg.OnFailure == "break" {
					break
				}
			}

		default:
			return nil, matched, fmt.Errorf("unexpected type %t (%v) while running '%s'", output, output, profile.Cfg.Filters[eIdx])
		}
	}

	return decisions, matched, nil
}

View on GitHub (pinned to 909b515798)

Solutions

Inspect the wrapped inner error for the concrete cause (often duration parse or expr evaluation).
Validate the profile's decisions block: required fields present, duration parseable, expressions valid.
Compare your custom profile against the stock /etc/crowdsec/profiles.yaml.
Enable debug logging and re-trigger an alert to see which decision field fails.

Example fix

// before (profiles.yaml decision)
decisions:
  - type: ban
    duration: 4hrs
// after
decisions:
  - type: ban
    duration: 4h

Defensive patterns

Strategy: try-catch

Validate before calling

// validate decisions config before use
for _, d := range profile.Decisions {
    if d.Duration != "" {
        if _, err := cstime.ParseDurationWithDays(d.Duration); err != nil {
            return fmt.Errorf("invalid decision duration %q: %w", d.Duration, err)
        }
    }
}

Try / catch

decisions, matched, err := profile.EvaluateProfile(alert)
if err != nil {
    log.Warnf("decision generation failed for profile %s: %v", profile.Cfg.Name, err)
    return
}

Prevention

Mirror the stock profiles.yaml structure when writing custom profiles
Keep decision fields (type, duration, scope) to known-good values
Test profile end-to-end with a simulated alert before production

When it happens

Trigger: A profile filter matched (true) and the associated decision template failed to generate: invalid decision fields in the profile (bad duration string, invalid scope/value expr), or an internal error producing decisions from the alert.

Common situations: Profile YAML defining a decision with unsupported keys or malformed nested expressions; custom scenarios/profiles written for older CrowdSec versions whose decision schema changed; alerts lacking data the decision expr expects.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/ecfc8d0274ad4c86. Report an issue: GitHub.