crowdsecurity/crowdsec · error

while selecting machine entry for

Error message

while selecting machine entry for %s: %w

What it means

authTLS found no machine row and the lookup itself failed: the else-if branch wraps the DbClient.SelectMachine error as 'while selecting machine entry for %s'. This means the database query for the certificate CN failed, not that the machine is merely unknown (unknown machines get created instead).

Solutions

1. Verify the database is up and credentials in crowdsec.db/api section are correct
2. Test locally: cscli machines list (uses the same DB) — fix any connection error it reports
3. Restart LAPI so DB connections are re-established after a DB outage
4. If it's context cancellation, check why the client disconnects during login (timeouts, wrong port)

// check the DB is queryable before the watcher connects
cscli machines list >/dev/null || echo "LAPI database not reachable"

_, err := client.Login(ctx)
if err != nil && strings.Contains(err.Error(), "while selecting machine entry") {
    // transient DB issue: backoff and retry login
    time.Sleep(backoff)
    return client.Login(ctx)
}

When it happens

Trigger: Authenticator -> authTLS: cert CN is parsed to ret.machineID, the machine does not exist (so the create branch is skipped), and SelectMachine returns a DB error — connection refused, table missing, context canceled, DB timeout.

Common situations: LAPI started before the database was ready; SQLite file corrupted or moved; PostgreSQL credentials changed; long TLS handshake canceled by the client causing context cancellation mid-query.

Understand the failure class

Background: Database query failed: Internal Server Error 500s wrapping SQL, Prisma, and connection failures — what to check first — this error's family across 16 libraries.

Related errors

• while creating machine entry for
• machine attempted to auth with TLS cert but it is…
• missing scenarios list in login request for TLS auth
• cannot use TLS with a unix socket
• certificate revoked by CRL

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/47214cebf2d0b56e. Report an issue: GitHub.

Appendix: source

Thrown at pkg/apiserver/middlewares/v1/jwt.go:100

		// Machine was not found, let's create it
		logger.Infof("machine %s not found, create it", ret.machineID)
		// let's use an apikey as the password, doesn't matter in this case (generatePassword is only available in cscli)
		pwd, err := GenerateAPIKey(dummyAPIKeySize)
		if err != nil {
			logger.WithField("cn", extractedCN).
				Errorf("error generating password: %s", err)

			return nil, errors.New("error generating password")
		}

		password := strfmt.Password(pwd)

		ret.clientMachine, err = j.DbClient.CreateMachine(ctx, &ret.machineID, &password, "", true, true, types.TlsAuthType)
		if err != nil {
			return nil, fmt.Errorf("while creating machine entry for %s: %w", ret.machineID, err)
		}
	} else if err != nil {
		return nil, fmt.Errorf("while selecting machine entry for %s: %w", ret.machineID, err)
	} else {
		if ret.clientMachine.AuthType != types.TlsAuthType {
			return nil, fmt.Errorf("machine %s attempted to auth with TLS cert but it is configured to use %s", ret.machineID, ret.clientMachine.AuthType)
		}

		ret.machineID = ret.clientMachine.MachineId
	}

	loginInput := struct {
		Scenarios []string `json:"scenarios"`
	}{
		Scenarios: []string{},
	}

	err = c.ShouldBindJSON(&loginInput)
	if err != nil {
		return nil, fmt.Errorf("missing scenarios list in login request for TLS auth: %w", err)
	}

View on GitHub (pinned to 909b515798)