crowdsecurity/crowdsec · error

while looking for CAPI alert: %w

Error message

while looking for CAPI alert: %w

What it means

The database query counting CAPI-originated alerts created in the last 1h30m failed while determining whether the community blocklist pull is stale (CAPIPullIsOld). This is a DB-level failure (connection, schema, ent query error), not a blocklist problem; the freshness check cannot run so the caller cannot decide whether a pull is due.

Source

Thrown at pkg/apiserver/apic.go:438

		end := min(start+batchSize, len(cache))

		if err := a.sendBatch(ctx, cache[start:end]); err != nil {
			log.Errorf("sending signal to central API: %s", err)
			return
		}
	}
}

func (a *apic) CAPIPullIsOld(ctx context.Context) (bool, error) {
	/*only pull community blocklist if it's older than 1h30 */
	alerts := a.dbClient.Ent.Alert.Query()

	alerts = alerts.Where(alert.HasDecisionsWith(decision.OriginEQ(database.CapiMachineID)))
	alerts = alerts.Where(alert.CreatedAtGTE(time.Now().UTC().Add(-time.Duration(1*time.Hour + 30*time.Minute)))) //nolint:unconvert

	count, err := alerts.Count(ctx)
	if err != nil {
		return false, fmt.Errorf("while looking for CAPI alert: %w", err)
	}

	if count > 0 {
		log.Info("last CAPI pull is newer than 1h30, skip.")
		return false, nil
	}

	return true, nil
}

func (a *apic) HandleDeletedDecisionsV3(ctx context.Context, deletedDecisions []*modelscapi.GetDecisionsStreamResponseDeletedItem, deleteCounters map[string]map[string]int) (int, error) {
	var nbDeleted int

	for _, decisions := range deletedDecisions {
		scope := decisions.Scope

		for _, decision := range decisions.Decisions {
			filter := map[string][]string{

View on GitHub (pinned to 909b515798)

Solutions

1. Check database connectivity and credentials for the LAPI database
2. Inspect the wrapped error for the SQL/ent failure — it may reveal schema drift requiring a migration check
3. Verify the alert and decision tables exist and migrations completed

When it happens

Trigger: Thrown at pkg/apiserver/apic.go:438 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/69071985d85b3bac. Report an issue: GitHub.