crowdsecurity/crowdsec · error

while selecting machine entry for %s: %w

Error message

while selecting machine entry for %s: %w

What it means

authTLS found no machine row and the lookup itself failed: the else-if branch wraps the DbClient.SelectMachine error as 'while selecting machine entry for %s'. This means the database query for the certificate CN failed, not that the machine is merely unknown (unknown machines get created instead).

Source

Thrown at pkg/apiserver/middlewares/v1/jwt.go:100

		// Machine was not found, let's create it
		logger.Infof("machine %s not found, create it", ret.machineID)
		// let's use an apikey as the password, doesn't matter in this case (generatePassword is only available in cscli)
		pwd, err := GenerateAPIKey(dummyAPIKeySize)
		if err != nil {
			logger.WithField("cn", extractedCN).
				Errorf("error generating password: %s", err)

			return nil, errors.New("error generating password")
		}

		password := strfmt.Password(pwd)

		ret.clientMachine, err = j.DbClient.CreateMachine(ctx, &ret.machineID, &password, "", true, true, types.TlsAuthType)
		if err != nil {
			return nil, fmt.Errorf("while creating machine entry for %s: %w", ret.machineID, err)
		}
	} else if err != nil {
		return nil, fmt.Errorf("while selecting machine entry for %s: %w", ret.machineID, err)
	} else {
		if ret.clientMachine.AuthType != types.TlsAuthType {
			return nil, fmt.Errorf("machine %s attempted to auth with TLS cert but it is configured to use %s", ret.machineID, ret.clientMachine.AuthType)
		}

		ret.machineID = ret.clientMachine.MachineId
	}

	loginInput := struct {
		Scenarios []string `json:"scenarios"`
	}{
		Scenarios: []string{},
	}

	err = c.ShouldBindJSON(&loginInput)
	if err != nil {
		return nil, fmt.Errorf("missing scenarios list in login request for TLS auth: %w", err)
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Verify the database is up and credentials in crowdsec.db/api section are correct
2. Test locally: cscli machines list (uses the same DB) — fix any connection error it reports
3. Restart LAPI so DB connections are re-established after a DB outage
4. If it's context cancellation, check why the client disconnects during login (timeouts, wrong port)

// check the DB is queryable before the watcher connects
cscli machines list >/dev/null || echo "LAPI database not reachable"

_, err := client.Login(ctx)
if err != nil && strings.Contains(err.Error(), "while selecting machine entry") {
    // transient DB issue: backoff and retry login
    time.Sleep(backoff)
    return client.Login(ctx)
}

When it happens

Trigger: Authenticator -> authTLS: cert CN is parsed to ret.machineID, the machine does not exist (so the create branch is skipped), and SelectMachine returns a DB error — connection refused, table missing, context canceled, DB timeout.

Common situations: LAPI started before the database was ready; SQLite file corrupted or moved; PostgreSQL credentials changed; long TLS handshake canceled by the client causing context cancellation mid-query.

Understand the failure class

Background: Database query failed: Internal Server Error 500s wrapping SQL, Prisma, and connection failures — what to check first — this error's family across 16 libraries.

Related errors

• while creating machine entry for %s: %w
• machine %s attempted to auth with TLS cert but it is configu
• missing scenarios list in login request for TLS auth: %w
• tls authentication required
• certificate revoked by OCSP

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/47214cebf2d0b56e. Report an issue: GitHub.