What causes "while updating allowlist meta %s: %s" in crowdsecurity/crowdsec?

Inspect the wrapped %s message for the exact DB failure

while updating allowlist meta %s: %s

Error message

while updating allowlist meta %s: %s

What it means

If the allowlist's name or description changed since it was stored, updateOneAllowlist calls UpdateAllowlistMeta to sync the metadata locally. This error wraps a failure of that metadata UPDATE, meaning content was replaced but the name/description update in the DB failed.

Source

Thrown at pkg/apiserver/apic.go:783

	if list == nil {
		list, err = a.dbClient.CreateAllowList(ctx, *link.Name, description, *link.ID, true)
		if err != nil {
			return fmt.Errorf("while creating allowlist %s: %s", *link.Name, err)
		}
	}

	added, err := a.dbClient.ReplaceAllowlist(ctx, list, items, true)
	if err != nil {
		return fmt.Errorf("while replacing allowlist %s: %s", *link.Name, err)
	}

	log.Infof("added %d values to allowlist %s", added, list.Name)

	if list.Name != *link.Name || list.Description != description {
		err = a.dbClient.UpdateAllowlistMeta(ctx, *link.ID, *link.Name, description)
		if err != nil {
			return fmt.Errorf("while updating allowlist meta %s: %s", *link.Name, err)
		}
	}

	log.Infof("Allowlist %s updated", *link.Name)

	return nil
}

func (a *apic) UpdateAllowlists(ctx context.Context, allowlistsLinks []*modelscapi.AllowlistLink, forcePull bool) error {
	if len(allowlistsLinks) == 0 {
		return nil
	}

	client, err := apiclient.NewDefaultClient(a.apiClient.BaseURL, "", "", nil)
	if err != nil {
		return fmt.Errorf("while creating default client: %w", err)
	}

View on GitHub (pinned to 909b515798)

Solutions

Inspect the wrapped %s message for the exact DB failure
Check cscli allowlists list for duplicate/conflicting names and resolve them
Ensure no concurrent cscli deletion/edit of the allowlist during sync
Check DB writability (disk space, sqlite locks) and retry the sync
Restart crowdsec to reset DB connections, then wait for the next pull

Defensive patterns

Strategy: try-catch

Validate before calling

// ensure the new name doesn't collide before the meta update
for _, al := range existingAllowlists() {
    if al.Name == newName && al.ID != *link.ID {
        log.Warnf("allowlist name %s conflicts with another allowlist", newName)
        return
    }
}

Try / catch

if err := a.updateOneAllowlist(ctx, client, link); err != nil {
    if strings.Contains(err.Error(), "while updating allowlist meta") {
        log.Errorf("allowlist %s content synced but metadata update failed: %s", *link.Name, err)
    } else {
        log.Errorf("updating allowlists from CAPI: %s", err)
    }
}

Prevention

Don't rename or delete console allowlists via cscli at the same time a sync is running
Keep allowlist names unique across console and local definitions
Ensure the DB stays writable during the sync window
Re-run the sync after resolving any name conflict so metadata converges

When it happens

Trigger: UpdateAllowlistMeta(link.ID, newName, newDescription) fails: DB write error, the row was deleted between the lookup and the update, a name uniqueness conflict with another allowlist, or connection loss.

Common situations: Renaming an allowlist on the console while the local DB has a conflicting name; SQLite lock or read-only DB during the periodic pull; record deleted concurrently by cscli allowlist delete while crowdsec was syncing.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/907ee6c65eb5699d. Report an issue: GitHub.