crowdsecurity/crowdsec · error

while loading console options: %w

Error message

while loading console options: %w

What it means

LoadAPIServer calls LocalApiServerCfg.LoadConsoleConfig() after resolving the console config path. This wraps any error other than 'file does not exist' (which is tolerated with defaults) — i.e. the console.yaml file exists but cannot be read or parsed.

Source

Thrown at pkg/csconfig/api.go:434

	if c.API.Server.UseForwardedForHeaders && c.API.Server.TrustedProxies == nil {
		c.API.Server.TrustedProxies = &[]string{"0.0.0.0/0"}
	}

	if c.API.Server.TrustedProxies != nil {
		c.API.Server.UseForwardedForHeaders = true
	}

	if err := c.API.Server.LoadProfiles(); err != nil {
		return fmt.Errorf("while loading profiles for LAPI: %w", err)
	}

	if c.API.Server.ConsoleConfigPath == "" {
		c.API.Server.ConsoleConfigPath = DefaultConsoleConfigFilePath
	}

	if err := c.API.Server.LoadConsoleConfig(); err != nil {
		return fmt.Errorf("while loading console options: %w", err)
	}

	if c.API.CTI != nil {
		if err := c.API.CTI.Load(); err != nil {
			return fmt.Errorf("loading CTI configuration: %w", err)
		}
	}

	return nil
}

// we cannot unmarshal to type net.IPNet, so we need to do it manually
type capiWhitelists struct {
	Ips   []string `yaml:"ips"`
	Cidrs []string `yaml:"cidrs"`
}

func parseCapiWhitelists(fd io.Reader) (*CapiWhitelist, error) {

View on GitHub (pinned to 909b515798)

Solutions

1. Check permissions on the console config file (readable by the crowdsec user)
2. Validate the YAML (e.g. `yamllint /etc/crowdsec/config/console.yaml`)
3. Remove or rename the file — a missing file is accepted and defaults are used
4. Point api.server.console_config_path to a valid file

Example fix

// before
sudo chown root:root /etc/crowdsec/console.yaml && sudo chmod 600 /etc/crowdsec/console.yaml
// after
sudo chown crowdsec:crowdsec /etc/crowdsec/console.yaml && sudo chmod 640 /etc/crowdsec/console.yaml

if _, err := os.Stat(consolePath); err == nil {
	f, e := os.Open(consolePath); if e != nil { log.Warn("console.yaml unreadable: "+e.Error()) } else { f.Close() }
}

if err := cfg.LoadAPIServer(); err != nil {
	var pe *os.PathError
	if errors.As(err, &pe) && strings.Contains(err.Error(), "console options") {
		log.Warnf("console config unreadable (%v), continuing with defaults", pe)
		return nil
	}
	return err
}

When it happens

Trigger: crowdsec startup with api.server.console_config_path (default config/console.yaml) present on disk but unreadable (permissions) or invalid YAML.

Common situations: console.yaml owned by root with restrictive mode while crowdsec runs as the crowdsec user; hand-edited console.yaml with bad YAML indentation; a directory exists at the console_config_path location.

Understand the failure class

Background: "failed to read file", EACCES, ENOENT and "could not read <path>" errors: when a program can't read a file from disk — this error's family across 49 libraries.

Related errors

• parsing console config file '%s': %w
• no listen_uri or listen_socket specified
• empty file
• no API client section in configuration
• missing token value for api.server.auto_register

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/ea1c0b12ce22345e. Report an issue: GitHub.