What causes "while reading %s/%s: %w" in crowdsecurity/crowdsec?

Verify the log group and stream still exist in the AWS console or with `aws logs describe-log-streams`

while reading %s/%s: %w

Error message

while reading %s/%s: %w

What it means

TailLogStream paginates GetLogEvents with StartFromHead to follow a stream. When a page fetch fails the error is wrapped as `while reading <group>/<stream>: <err>`, logged as a warning by the stream's logger, and returned, terminating that stream's tailing goroutine.

Source

Thrown at pkg/acquisition/modules/cloudwatch/run.go:309

	streamIndexMutex.Unlock()

	for {
		select {
		case <-ticker.C:
			p := cloudwatchlogs.NewGetLogEventsPaginator(
				s.cwClient,
				&cloudwatchlogs.GetLogEventsInput{
					Limit:         aws.Int32(cfg.GetLogEventsPagesLimit),
					LogGroupName:  aws.String(cfg.GroupName),
					LogStreamName: aws.String(cfg.StreamName),
					NextToken:     startFrom,   // if set, StartFromHead is ignored by AWS
					StartFromHead: aws.Bool(true),
				},
				)
			for p.HasMorePages() {
				page, err := p.NextPage(ctx)
				if err != nil {
					newerr := fmt.Errorf("while reading %s/%s: %w", cfg.GroupName, cfg.StreamName, err)
					cfg.logger.Warningf("err: %s", newerr)

					return newerr
				}

				// Update token/index
				startFrom = page.NextForwardToken
				if startFrom != nil {
					streamIndexMutex.Lock()
					s.streamIndexes[cfg.GroupName+"+"+cfg.StreamName] = *startFrom
					streamIndexMutex.Unlock()
				}

				if len(page.Events) > 0 {
					lastReadMessage = time.Now().UTC()
				}

				for _, ev := range page.Events {

View on GitHub (pinned to 909b515798)

Solutions

Verify the log group and stream still exist in the AWS console or with `aws logs describe-log-streams`
Check IAM permissions for logs:GetLogEvents
Retry on transient errors — restart crowdsec or rely on acquisition reconfiguration; investigate the wrapped AWS error code for throttling
Check network connectivity/VPN to the AWS endpoint

Example fix

// before
cloudwatch://my-group?log_stream=deleted-stream
// after — verify stream exists, or point to an active stream
cloudwatch://my-group?log_stream=active-stream

Defensive patterns

Strategy: retry

Validate before calling

_, err := client.DescribeLogStreams(ctx, &cwlogs.DescribeLogStreamsInput{
    LogGroupName: aws.String(group), LogStreamNamePrefix: aws.String(stream),
})
if err != nil { return fmt.Errorf("stream %s/%s not reachable: %w", group, stream, err) }

Try / catch

page, err := p.NextPage(ctx)
if err != nil {
    if isTransient(err) { time.Sleep(backoff); /* re-tail from saved token */ continue }
    return err
}

Prevention

Persist the last event token so tails can resume after errors
Alert on stream/group deletion if names are dynamic
Grant logs:GetLogEvents and logs:DescribeLogStreams
Back off on ThrottlingException instead of tight-looping

When it happens

Trigger: TailLogStream's p.NextPage(ctx) fails: expired/invalid nextToken after stream or group deletion, throttling, network outage, or IAM missing logs:GetLogEvents.

Common situations: Log stream deleted while being tailed; AWS throttling during bursts; network partition on a long-lived tail; credentials rotated and revoked.

Understand the failure class

Background: "API request failed": what wrapped HTTP errors from external APIs mean and how to find the real cause — this error's family across 29 libraries.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/fb3ed61d77aa3819. Report an issue: GitHub.