crowdsecurity/crowdsec · error

while getting alert: %w

Error message

while getting alert: %w

What it means

ShouldForcePullBlocklist wraps the error from fetching the last alert for a blocklist via the ent ORM. NotFound is handled as a 'force refresh' signal; only other query errors (DB down, context cancelled, schema issue) reach this wrapper.

Source

Thrown at pkg/apiserver/apic.go:913

	}

	return nil
}

func (a *apic) ShouldForcePullBlocklist(ctx context.Context, blocklist *modelscapi.BlocklistLink) (bool, error) {
	// we should force pull if the blocklist decisions are about to expire or there's no decision in the db
	alertQuery := a.dbClient.Ent.Alert.Query()
	alertQuery.Where(alert.SourceScopeEQ(fmt.Sprintf("%s:%s", types.ListOrigin, *blocklist.Name)))
	alertQuery.Order(ent.Desc(alert.FieldCreatedAt))

	alertInstance, err := alertQuery.First(ctx)
	if err != nil {
		if ent.IsNotFound(err) {
			log.Debugf("no alert found for %s, force refresh", *blocklist.Name)
			return true, nil
		}

		return false, fmt.Errorf("while getting alert: %w", err)
	}

	decisionQuery := a.dbClient.Ent.Decision.Query()
	decisionQuery.Where(decision.HasOwnerWith(alert.IDEQ(alertInstance.ID)))

	firstDecision, err := decisionQuery.First(ctx)
	if err != nil {
		if ent.IsNotFound(err) {
			log.Debugf("no decision found for %s, force refresh", *blocklist.Name)
			return true, nil
		}

		return false, fmt.Errorf("while getting decision: %w", err)
	}

	if firstDecision == nil || firstDecision.Until == nil || firstDecision.Until.Sub(time.Now().UTC()) < (a.pullInterval+15*time.Minute) {
		log.Debugf("at least one decision found for %s, expire soon, force refresh", *blocklist.Name)
		return true, nil

View on GitHub (pinned to 909b515798)

Solutions

1. Read the wrapped DB error; test DB connectivity (`cscli db doctor`).
2. For SQLite, enable WAL and check for stale locks.
3. Ensure migrations ran after upgrade (`cscli db migrate`).
4. Retry the pull; transient DB errors typically resolve on next tick.

// check DB health first: cscli db doctor

ok, err := a.ShouldForcePullBlocklist(ctx, blocklist)
if err != nil {
    if ent.IsNotFound(err) { /* treat as force-pull */ }
    log.Warnf("transient db error, will retry next pull: %v", err)
    return
}

When it happens

Trigger: updateBlocklist calls ShouldForcePullBlocklist for a subscribed blocklist; the alert query fails for reasons other than not-found, e.g. DB connection lost, context cancelled, or ent query error.

Common situations: PostgreSQL unreachable mid-cycle, SQLite file locked by another process, context timeout on slow DB, corrupted DB after failed migration.

Understand the failure class

Background: Database query failed: Internal Server Error 500s wrapping SQL, Prisma, and connection failures — what to check first — this error's family across 16 libraries.

Related errors

• while getting decision: %w
• unable to query alerts for uuid %s: %w
• select config item: %w: %w
• expired decisions: %w
• expire decisions with provided filter: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/022453acbbaac3c4. Report an issue: GitHub.