crowdsecurity/crowdsec · error

while pulling allowlist: %s

Error message

while pulling allowlist: %s

What it means

While fetching or processing an allowlist entry's remote content (HTTP GET of link.URL, or scanning the response body), the request/scanner failed. Both the request-build failure and the Do() failure are wrapped with this same message. Note the error is attached with %s, not %w, so it does not unwrap.

Source

Thrown at pkg/apiserver/apic.go:736

	}

	if link.URL == nil {
		log.Warnf("allowlist %s has no URL", *link.Name)
		return nil
	}

	if link.ID == nil {
		return fmt.Errorf("allowlist %s has no ID", *link.Name)
	}

	description := ""
	if link.Description != nil {
		description = *link.Description
	}

	req, err := http.NewRequestWithContext(ctx, http.MethodGet, *link.URL, http.NoBody)
	if err != nil {
		return fmt.Errorf("while pulling allowlist: %s", err)
	}

	resp, err := client.GetClient().Do(req)
	if err != nil {
		return fmt.Errorf("while pulling allowlist: %s", err)
	}
	defer resp.Body.Close()

	scanner := bufio.NewScanner(resp.Body)
	items := make([]*models.AllowlistItem, 0)

	for scanner.Scan() {
		item := scanner.Text()
		j := &models.AllowlistItem{}

		if err := json.Unmarshal([]byte(item), j); err != nil {
			return fmt.Errorf("while unmarshalling allowlist item: %s", err)
		}

View on GitHub (pinned to 909b515798)

Solutions

1. Check that the allowlist URL is reachable from the crowdsec host
2. Inspect the logged error string: connection errors point to the upstream host; scanner errors point to oversized or malformed content
3. Retry the pull; transient upstream failures resolve on the next cycle

When it happens

Trigger: Thrown at pkg/apiserver/apic.go:736 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/6ac00174fe66e837. Report an issue: GitHub.