crowdsecurity/crowdsec · error

while parsing agents cert auto-delete duration: %w

Error message

while parsing agents cert auto-delete duration: %w

What it means

StartFlushScheduler parses the agents_gc.cert duration from config using cstime.ParseDurationWithDays, which accepts both Go durations and day-suffixed values (e.g. '30d'). This error wraps the parse failure and aborts scheduler startup.

Source

Thrown at pkg/database/flush.go:72

	if err != nil {
		return nil, err
	}

	_, err = scheduler.NewJob(
		gocron.DurationJob(1*time.Minute),
		gocron.NewTask(c.FlushAlerts, ctx, time.Duration(config.MaxAge), maxItems),
		gocron.WithSingletonMode(gocron.LimitModeReschedule),
	)
	if err != nil {
		return nil, fmt.Errorf("while starting FlushAlerts scheduler: %w", err)
	}

	// Init & Start cronjob every hour for bouncers/agents
	if config.AgentsGC != nil {
		if config.AgentsGC.Cert != nil {
			duration, err := cstime.ParseDurationWithDays(*config.AgentsGC.Cert)
			if err != nil {
				return nil, fmt.Errorf("while parsing agents cert auto-delete duration: %w", err)
			}

			config.AgentsGC.CertDuration = &duration
		}

		if config.AgentsGC.LoginPassword != nil {
			duration, err := cstime.ParseDurationWithDays(*config.AgentsGC.LoginPassword)
			if err != nil {
				return nil, fmt.Errorf("while parsing agents login/password auto-delete duration: %w", err)
			}

			config.AgentsGC.LoginPasswordDuration = &duration
		}

		if config.AgentsGC.Api != nil {
			c.Log.Warning("agents auto-delete for API auth is not supported (use cert or login_password)")
		}
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Fix the value in config.yaml: use Go duration units (h, m, s) or 'd' for days, e.g. cert: 30d or cert: 720h.
2. Remember 'd' (days) is supported via ParseDurationWithDays but units like 'w', 'mo', 'y' are not — convert them to days or hours.
3. Validate the config with cscli before restarting: cscli config check (or start crowdsec and read the wrapped error).
4. Remove the key entirely to disable agent cert GC if no value is desired.

Example fix

// config.yaml
// before
api:
  server:
    gc:
      agents_gc:
        cert: 3months

// after
api:
  server:
    gc:
      agents_gc:
        cert: 90d

func validDurationWithDays(s string) error {
    _, err := cstime.ParseDurationWithDays(s)
    return err
}
// before startup:
if err := validDurationWithDays(cfg.AgentsGC.Cert); err != nil {
    return fmt.Errorf("agents_gc.cert: %w", err)
}

if _, err := c.StartFlushScheduler(ctx, flushCfg); err != nil {
    var pe *time.ParseError
    if errors.As(err, &pe) || strings.Contains(err.Error(), "parsing agents cert") {
        // fix or reject the config value
    }
    return err
}

When it happens

Trigger: config.AgentsGC.Cert is set to a string that ParseDurationWithDays cannot parse — missing unit (e.g. '30'), unknown suffix, negative value, or malformed syntax like '1.5d' if unsupported.

Common situations: Typo in config/config.yaml under api.server.gc.agents_gc.cert, e.g. cert: 3months (month unit not supported) or cert: 3600 without a unit.

Understand the failure class

Background: "invalid duration" / "failed to parse duration": why your timeout, interval, or TTL string is rejected and which formats each library accepts — this error's family across 32 libraries.

Related errors

• while parsing agents login/password auto-delete duration: %w
• while parsing bouncers cert auto-delete duration: %w
• while parsing bouncers api auto-delete duration: %w
• empty cti key
• no listen_uri or listen_socket specified

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/5c0f61e176e488ee. Report an issue: GitHub.