crowdsecurity/crowdsec · error

while getting decisions from blocklist %s: %w

Error message

while getting decisions from blocklist %s: %w

What it means

Wraps the error from client.Decisions.GetDecisionsFromBlocklist, the CAPI HTTP call that downloads decisions changed since lastPullTimestamp. Failures are network/HTTP-level: unreachable CAPI, non-2xx response, TLS error, or response decode failure.

Source

Thrown at pkg/apiserver/apic.go:973

	}

	blocklistConfigItemName := fmt.Sprintf("blocklist:%s:last_pull", *blocklist.Name)

	var (
		lastPullTimestamp string
		err               error
	)

	if !forcePull {
		lastPullTimestamp, err = a.dbClient.GetConfigItem(ctx, blocklistConfigItemName)
		if err != nil {
			return fmt.Errorf("while getting last pull timestamp for blocklist %s: %w", *blocklist.Name, err)
		}
	}

	decisions, hasChanged, err := client.Decisions.GetDecisionsFromBlocklist(ctx, blocklist, lastPullTimestamp)
	if err != nil {
		return fmt.Errorf("while getting decisions from blocklist %s: %w", *blocklist.Name, err)
	}

	if !hasChanged {
		if lastPullTimestamp == "" {
			log.Infof("blocklist %s hasn't been modified or there was an error reading it, skipping", *blocklist.Name)
		} else {
			log.Infof("blocklist %s hasn't been modified since %s, skipping", *blocklist.Name, lastPullTimestamp)
		}

		return nil
	}

	err = a.dbClient.SetConfigItem(ctx, blocklistConfigItemName, time.Now().UTC().Format(http.TimeFormat))
	if err != nil {
		return fmt.Errorf("while setting last pull timestamp for blocklist %s: %w", *blocklist.Name, err)
	}

	if len(decisions) == 0 {

View on GitHub (pinned to 909b515798)

Solutions

1. Test connectivity: `cscli capi status` or curl the CAPI URL from the host.
2. Check proxy/firewall settings and DNS resolution.
3. Re-register with CAPI if auth fails: `cscli machines` / `cscli capi status`.
4. Retry later if CAPI is having an outage (status.crowdsec.net).

resp, err := http.Head(capiURL)
if err != nil || resp.StatusCode >= 500 {
    // postpone pull; CAPI unreachable
}

decisions, hasChanged, err := client.Decisions.GetDecisionsFromBlocklist(ctx, blocklist, lastPullTimestamp)
if err != nil {
    log.Warnf("blocklist pull failed, keeping existing decisions: %v", err)
    return nil // decisions from last successful pull remain active
}

When it happens

Trigger: updateBlocklist calls GetDecisionsFromBlocklist and the request to the blocklist URL fails: DNS failure, connection refused/timeout, HTTP 5xx from CAPI, invalid response body.

Common situations: Firewall blocking api.crowdsec.net, no internet access, proxy misconfiguration, CAPI outage or rate limiting, expired/invalid machine credentials.

Related errors

• while checking if we should force pull blocklist %s: %w
• blocklist URL is nil
• pull already in progress
• error querying range: %w
• querying range: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/cb44b707d58ecca6. Report an issue: GitHub.