Database malfunction: SELECT 1 should return 1, but returned

Error message

Database malfunction: SELECT 1 should return 1, but returned %d

What it means

After SELECT 1 succeeds, NewPostgresAuditor sanity-checks the returned value. This error means the query executed but the row value was not 1, indicating the connection is talking to something that is not behaving like a healthy Postgres instance.

Source

Thrown at audit/audit.go:129

// process will exit with status set to 1
type PostgresAuditor struct {
	DB *sql.DB
}

// NewPostgresAuditor is the constructor for a new PostgresAuditor struct
// initialized with the given db connection string
func NewPostgresAuditor(connStr string) (*PostgresAuditor, error) {
	db, err := sql.Open("postgres", connStr)
	pg := &PostgresAuditor{DB: db}
	if err != nil {
		return pg, err
	}
	var result int
	err = pg.DB.QueryRow("SELECT 1").Scan(&result)
	if err != nil {
		return pg, fmt.Errorf("Pinging audit database failed: %s", err)
	} else if result != 1 {
		return pg, fmt.Errorf("Database malfunction: SELECT 1 should return 1, but returned %d", result)
	}
	return pg, nil
}

// Handle persists the audit event by writing a row to the
// 'audit_event' postgres table
func (p *PostgresAuditor) Handle(event interface{}) {
	u, err := user.Current()
	if err != nil {
		log.Fatalf("Error getting current user for auditing: %s", err)
	}
	switch event := event.(type) {
	case DecryptEvent:
		// Save the event to the database
		log.WithField("file", event.File).
			Debug("Saving decrypt event to database")
		_, err = p.DB.Exec("INSERT INTO audit_event (action, username, file) VALUES ($1, $2, $3)", "decrypt", u.Username, event.File)
		if err != nil {

View on GitHub (pinned to 13442bb981)

Solutions

Bypass any proxy/load balancer and connect directly to Postgres to confirm SELECT 1 returns 1
Check for test doubles or connection interceptors (e.g. sqlmock leftovers) in the connection path
Restart the Postgres instance and re-run; rule out server-side corruption
Print the DSN and confirm the target is a genuine Postgres server

Example fix

// before
DSN=postgres://user@proxy.internal:5432/auditdb  # proxy mangles queries
// after
DSN=postgres://user@db.internal:5432/auditdb      # direct connection

Defensive patterns

Strategy: validation

Validate before calling

db, err := sql.Open("postgres", dsn)
if err != nil { return err }
var result int
if err := db.QueryRow("SELECT 1").Scan(&result); err != nil { return err }
if result != 1 {
    return fmt.Errorf("unexpected SELECT 1 result %d from %s", result, hostFromDSN(dsn))
}

Try / catch

pg, err := audit.NewPostgresAuditor(dsn)
if err != nil {
    if strings.Contains(err.Error(), "Database malfunction") {
        log.Fatalf("endpoint %s is not behaving like Postgres; check proxies", dsn)
    }
    return err
}

Prevention

Connect directly to Postgres, not through rewriting proxies
Never point production DSNs at test doubles
Verify the endpoint with psql before registering it

When it happens

Trigger: QueryRow("SELECT 1").Scan succeeds but result != 1 — practically only possible with a proxy/middleware rewriting queries, a corrupt driver, or a non-Postgres endpoint accepting the connection.

Common situations: Connecting through a misbehaving TCP proxy or load balancer that returns synthetic rows; pointing the DSN at a mock/fake server in tests; exotic connection pooling middleware intercepting queries.

Related errors

Pinging audit database failed: %s

AI-assisted analysis of getsops/sops@13442bb981 (2026-09-01). Data as JSON: /api/errors/89ede0ae7793fb65. Report an issue: GitHub.