crowdsecurity/crowdsec · error

while replacing allowlist %s: %s

Error message

while replacing allowlist %s: %s

What it means

After ensuring the allowlist exists, the sync calls ReplaceAllowlist(ctx, list, items, true) to atomically replace the list's contents with the freshly pulled items. This error wraps a failure of that bulk replace, so the allowlist content in the local DB was not updated from the downloaded payload.

Source

Thrown at pkg/apiserver/apic.go:775

	}

	list, err := a.dbClient.GetAllowListByID(ctx, *link.ID, false)
	if err != nil {
		if !ent.IsNotFound(err) {
			return fmt.Errorf("while getting allowlist %s: %s", *link.Name, err)
		}
	}

	if list == nil {
		list, err = a.dbClient.CreateAllowList(ctx, *link.Name, description, *link.ID, true)
		if err != nil {
			return fmt.Errorf("while creating allowlist %s: %s", *link.Name, err)
		}
	}

	added, err := a.dbClient.ReplaceAllowlist(ctx, list, items, true)
	if err != nil {
		return fmt.Errorf("while replacing allowlist %s: %s", *link.Name, err)
	}

	log.Infof("added %d values to allowlist %s", added, list.Name)

	if list.Name != *link.Name || list.Description != description {
		err = a.dbClient.UpdateAllowlistMeta(ctx, *link.ID, *link.Name, description)
		if err != nil {
			return fmt.Errorf("while updating allowlist meta %s: %s", *link.Name, err)
		}
	}

	log.Infof("Allowlist %s updated", *link.Name)

	return nil
}

func (a *apic) UpdateAllowlists(ctx context.Context, allowlistsLinks []*modelscapi.AllowlistLink, forcePull bool) error {
	if len(allowlistsLinks) == 0 {

View on GitHub (pinned to 909b515798)

Solutions

1. Read the wrapped %s message to determine transaction vs constraint vs connection failure
2. Check for SQLite lock/disk-space issues and retry the sync after resolving
3. Restart crowdsec to reset DB connections, then re-run (or wait for the periodic pull)
4. Verify DB schema is up to date (cscli dbstatus / proper upgrade path)
5. If a specific item value is rejected, inspect the pulled payload for malformed entries

// verify the pull succeeded and items look sane before replace
if len(items) == 0 {
    return fmt.Errorf("allowlist %s: pulled 0 items, refusing to replace", *link.Name)
}

err := a.updateOneAllowlist(ctx, client, link)
if err != nil && strings.Contains(err.Error(), "while replacing allowlist") {
    // transient DB issues (locks, lost connections) are common here — back off and retry
    time.Sleep(30 * time.Second)
    if retryErr := a.updateOneAllowlist(ctx, client, link); retryErr != nil {
        log.Errorf("allowlist replace failed after retry: %s", retryErr)
    }
}

When it happens

Trigger: ReplaceAllowlist fails during a scheduled or forced allowlist pull: DB transaction error while deleting+reinserting all items, connection loss mid-transaction, constraint violation on item values, or empty/invalid items causing a write error.

Common situations: SQLite lock contention (backup, another crowdsec component) during the transaction; disk full when replacing a large allowlist; DB connection dropped during a long pull; schema mismatch after an upgrade.

Related errors

• error creating transaction: %w
• unable to delete allowlist contents: %w
• while getting allowlist %s: %s
• while creating allowlist %s: %s
• while updating allowlist meta %s: %s

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/d68d9bde1e20fcdb. Report an issue: GitHub.