crowdsecurity/crowdsec · error

while parsing agents login/password auto-delete duration: %w

Error message

while parsing agents login/password auto-delete duration: %w

What it means

StartFlushScheduler parses the agents_gc.login_password duration with cstime.ParseDurationWithDays. When the configured string cannot be parsed as a duration-with-days, this wrapped error is returned and startup fails.

Source

Thrown at pkg/database/flush.go:81

	if err != nil {
		return nil, fmt.Errorf("while starting FlushAlerts scheduler: %w", err)
	}

	// Init & Start cronjob every hour for bouncers/agents
	if config.AgentsGC != nil {
		if config.AgentsGC.Cert != nil {
			duration, err := cstime.ParseDurationWithDays(*config.AgentsGC.Cert)
			if err != nil {
				return nil, fmt.Errorf("while parsing agents cert auto-delete duration: %w", err)
			}

			config.AgentsGC.CertDuration = &duration
		}

		if config.AgentsGC.LoginPassword != nil {
			duration, err := cstime.ParseDurationWithDays(*config.AgentsGC.LoginPassword)
			if err != nil {
				return nil, fmt.Errorf("while parsing agents login/password auto-delete duration: %w", err)
			}

			config.AgentsGC.LoginPasswordDuration = &duration
		}

		if config.AgentsGC.Api != nil {
			c.Log.Warning("agents auto-delete for API auth is not supported (use cert or login_password)")
		}
	}

	if config.BouncersGC != nil {
		if config.BouncersGC.Cert != nil {
			duration, err := cstime.ParseDurationWithDays(*config.BouncersGC.Cert)
			if err != nil {
				return nil, fmt.Errorf("while parsing bouncers cert auto-delete duration: %w", err)
			}

			config.BouncersGC.CertDuration = &duration

View on GitHub (pinned to 909b515798)

Solutions

1. Correct the value in config.yaml to a valid Go duration or day form, e.g. login_password: 30d or login_password: 720h.
2. Avoid unsupported units; only Go duration units plus 'd' are accepted.
3. Remove the key to disable login/password GC for agents.
4. Test the duration string with cstime.ParseDurationWithDays semantics before deploying (days count 24h each).

Example fix

// before
agents_gc:
  login_password: 1 year

// after
agents_gc:
  login_password: 365d

if cfg.AgentsGC != nil && cfg.AgentsGC.LoginPassword != "" {
    if _, err := cstime.ParseDurationWithDays(cfg.AgentsGC.LoginPassword); err != nil {
        return fmt.Errorf("agents_gc.login_password: %w", err)
    }
}

if err != nil {
    if strings.Contains(err.Error(), "agents login/password") {
        // surface the offending config key to the operator
    }
    return err
}

When it happens

Trigger: config.AgentsGC.LoginPassword contains an unparseable value — unitless number, unsupported unit ('mo', 'y'), or malformed string.

Common situations: Operator writes login_password: 1 year or login_password: 2w in api.server.gc.agents_gc; values copied from older docs that used different syntax.

Understand the failure class

Background: "invalid duration" / "failed to parse duration": why your timeout, interval, or TTL string is rejected and which formats each library accepts — this error's family across 32 libraries.

Related errors

• while parsing agents cert auto-delete duration: %w
• while parsing bouncers cert auto-delete duration: %w
• while parsing bouncers api auto-delete duration: %w
• empty cti key
• no listen_uri or listen_socket specified

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/6e1218ff9e3dc875. Report an issue: GitHub.