crowdsecurity/crowdsec · error

while starting VictoriaLogs tail: %w

Error message

while starting VictoriaLogs tail: %w

What it means

Inside the streaming goroutine, the initial call to `getResponseChan` (tail start) failed, so the whole streaming acquisition goroutine returns an error into the tomb and the datasource shuts down. This wraps the same tail transport/HTTP failures as the client-level errors.

Source

Thrown at pkg/acquisition/modules/victorialogs/run.go:106

	}

	lctx, clientCancel := context.WithCancel(ctx)
	// Don't defer clientCancel(), the client outlives this function call

	t.Go(func() error {
		<-t.Dying()
		clientCancel()

		return nil
	})

	t.Go(func() error {
		respChan, err := s.getResponseChan(lctx, true)
		if err != nil {
			clientCancel()
			s.logger.Errorf("could not start VictoriaLogs tail: %s", err)

			return fmt.Errorf("while starting VictoriaLogs tail: %w", err)
		}

		for {
			select {
			case resp, ok := <-respChan:
				if !ok {
					s.logger.Warnf("VictoriaLogs channel closed")
					clientCancel()

					return err
				}

				s.readOneEntry(resp, s.Config.Labels, out)
			case <-t.Dying():
				clientCancel()
				return nil
			}
		}

View on GitHub (pinned to 909b515798)

Solutions

1. Fix the wrapped root cause (connectivity, HTTP status, query) reported in the accompanying 'could not start VictoriaLogs tail' log line.
2. Confirm the tail endpoint: `curl -N '<url>/select/logsql/tail?query=...'` streams SSE.
3. Check crowdsec logs for whether the tomb was already dying (shutdown race) — if so the error is expected noise during reload/stop.
4. Verify config `url`, `prefix`, `query` and auth settings.
5. Restart crowdsec once VictoriaLogs is confirmed healthy.

Example fix

// before
url: http://127.0.0.1:9429
// after
url: http://127.0.0.1:9428  # correct VictoriaLogs HTTP port

// pre-flight the tail endpoint
resp, err := http.Get(cfg.URL + "/select/logsql/tail?limit=1&query=" + url.QueryEscape(cfg.Query))
if err != nil || resp.StatusCode != 200 { return err }

err := t.Go(func() error { ... })
// on tomb error:
if errors.Is(err, context.Canceled) { return nil } // shutdown race, ignore

When it happens

Trigger: `s.getResponseChan(lctx, true)` errors on the initial `Client.Tail` call: VictoriaLogs unreachable or answering non-200 after retries, or `lctx` already canceled because the tomb is dying / clientCancel fired.

Common situations: VictoriaLogs restarting exactly when the streamer opens its tail; wrong URL/port in config; network outage at crowdsec start; the lctx canceled by a prior shutdown, producing a benign wrapped cancel error.

Understand the failure class

Background: "API request failed": what wrapped HTTP errors from external APIs mean and how to find the real cause — this error's family across 29 libraries.

Related errors

• error tailing logs: %w
• error while reading tail response: %w
• error when starting acquisition: %w
• loki channel closed
• VictoriaLogs url is mandatory

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/309791d93f761935. Report an issue: GitHub.