crowdsecurity/crowdsec · error

while getting allowlist %s: %s

Error message

while getting allowlist %s: %s

What it means

After parsing the items, updateOneAllowlist looks up the existing allowlist in the local database with GetAllowListByID(link.ID). This error wraps any DB error other than ent's NotFound (NotFound is tolerated because the list may legitimately not exist yet). It signals a real database-level failure, not a missing record.

Source

Thrown at pkg/apiserver/apic.go:762

	scanner := bufio.NewScanner(resp.Body)
	items := make([]*models.AllowlistItem, 0)

	for scanner.Scan() {
		item := scanner.Text()
		j := &models.AllowlistItem{}

		if err := json.Unmarshal([]byte(item), j); err != nil {
			return fmt.Errorf("while unmarshalling allowlist item: %s", err)
		}

		items = append(items, j)
	}

	list, err := a.dbClient.GetAllowListByID(ctx, *link.ID, false)
	if err != nil {
		if !ent.IsNotFound(err) {
			return fmt.Errorf("while getting allowlist %s: %s", *link.Name, err)
		}
	}

	if list == nil {
		list, err = a.dbClient.CreateAllowList(ctx, *link.Name, description, *link.ID, true)
		if err != nil {
			return fmt.Errorf("while creating allowlist %s: %s", *link.Name, err)
		}
	}

	added, err := a.dbClient.ReplaceAllowlist(ctx, list, items, true)
	if err != nil {
		return fmt.Errorf("while replacing allowlist %s: %s", *link.Name, err)
	}

	log.Infof("added %d values to allowlist %s", added, list.Name)

	if list.Name != *link.Name || list.Description != description {

View on GitHub (pinned to 909b515798)

Solutions

1. Inspect the wrapped %s message to identify the underlying DB error
2. Verify DB connectivity: check crowdsec can open its DB (cscli dbstatus or logs)
3. If SQLite: ensure no stale lock and sufficient disk space; restart crowdsec to reconnect
4. Run cscli db migrate / upgrade properly if versions are mismatched
5. If persistent, restore or recreate the database from backups

// before sync, verify the DB is reachable and writable
if err := dbClient.Client().Debug().Ping(ctx); err != nil {
    return fmt.Errorf("database unreachable before allowlist sync: %w", err)
}

err := a.updateOneAllowlist(ctx, client, link)
if err != nil && strings.Contains(err.Error(), "while getting allowlist") {
    if ent.IsNotFoundError(err) {
        // tolerated: list will be created
        return nil
    }
    log.Errorf("allowlist DB lookup failed, will retry on next cycle: %s", err)
}

When it happens

Trigger: GetAllowListByID fails with a non-NotFound error: database unreachable/closed connection, SQL error, transaction/timeout, or corruption when querying the allowlists table by ID.

Common situations: SQLite file locked or on a full disk; stale DB connection after a long outage; DB schema migration mismatch after upgrading crowdsec; running crowdsec while the DB is being backed up or another process holds a write lock.

Understand the failure class

Background: Database query failed: Internal Server Error 500s wrapping SQL, Prisma, and connection failures — what to check first — this error's family across 16 libraries.

Related errors

• while creating allowlist %s: %s
• unable to add values to allowlist: %w
• unable to check if value is allowlisted: %w
• unable to get allowlist items: %w
• unable to expire decisions for batch: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/f8260729cc55f27d. Report an issue: GitHub.