crowdsecurity/crowdsec · error

while starting VictoriaLogs tail

Error message

while starting VictoriaLogs tail: %w

What it means

Inside the streaming goroutine, the initial call to `getResponseChan` (tail start) failed, so the whole streaming acquisition goroutine returns an error into the tomb and the datasource shuts down. This wraps the same tail transport/HTTP failures as the client-level errors.

Solutions

1. Fix the wrapped root cause (connectivity, HTTP status, query) reported in the accompanying 'could not start VictoriaLogs tail' log line.
2. Confirm the tail endpoint: `curl -N '<url>/select/logsql/tail?query=...'` streams SSE.
3. Check crowdsec logs for whether the tomb was already dying (shutdown race) — if so the error is expected noise during reload/stop.
4. Verify config `url`, `prefix`, `query` and auth settings.
5. Restart crowdsec once VictoriaLogs is confirmed healthy.

Example fix

// before
url: http://127.0.0.1:9429
// after
url: http://127.0.0.1:9428  # correct VictoriaLogs HTTP port

// pre-flight the tail endpoint
resp, err := http.Get(cfg.URL + "/select/logsql/tail?limit=1&query=" + url.QueryEscape(cfg.Query))
if err != nil || resp.StatusCode != 200 { return err }

err := t.Go(func() error { ... })
// on tomb error:
if errors.Is(err, context.Canceled) { return nil } // shutdown race, ignore

When it happens

Trigger: `s.getResponseChan(lctx, true)` errors on the initial `Client.Tail` call: VictoriaLogs unreachable or answering non-200 after retries, or `lctx` already canceled because the tomb is dying / clientCancel fired.

Common situations: VictoriaLogs restarting exactly when the streamer opens its tail; wrong URL/port in config; network outage at crowdsec start; the lctx canceled by a prior shutdown, producing a benign wrapped cancel error.

Understand the failure class

Background: "API request failed": what wrapped HTTP errors from external APIs mean and how to find the real cause — this error's family across 29 libraries.

Related errors

• error tailing logs
• error when starting acquisition
• error while reading tail response
• appsec is down
• bad HTTP response code

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/309791d93f761935. Report an issue: GitHub.

Appendix: source

Thrown at pkg/acquisition/modules/victorialogs/run.go:106

	}

	lctx, clientCancel := context.WithCancel(ctx)
	// Don't defer clientCancel(), the client outlives this function call

	t.Go(func() error {
		<-t.Dying()
		clientCancel()

		return nil
	})

	t.Go(func() error {
		respChan, err := s.getResponseChan(lctx, true)
		if err != nil {
			clientCancel()
			s.logger.Errorf("could not start VictoriaLogs tail: %s", err)

			return fmt.Errorf("while starting VictoriaLogs tail: %w", err)
		}

		for {
			select {
			case resp, ok := <-respChan:
				if !ok {
					s.logger.Warnf("VictoriaLogs channel closed")
					clientCancel()

					return err
				}

				s.readOneEntry(resp, s.Config.Labels, out)
			case <-t.Dying():
				clientCancel()
				return nil
			}
		}

View on GitHub (pinned to 909b515798)