getsops/sops · critical

Pinging audit database failed: %s

Error message

Pinging audit database failed: %s

What it means

NewPostgresAuditor verifies connectivity to the audit database by running SELECT 1 before returning the auditor. This error means the QueryRow("SELECT 1").Scan failed, i.e. the database is unreachable, credentials are wrong, or the connection dropped.

Source

Thrown at audit/audit.go:127

// It persists the audit event by writing a row to the 'audit_event' table.
// Errors with writing to the database will output a log message and the
// process will exit with status set to 1
type PostgresAuditor struct {
	DB *sql.DB
}

// NewPostgresAuditor is the constructor for a new PostgresAuditor struct
// initialized with the given db connection string
func NewPostgresAuditor(connStr string) (*PostgresAuditor, error) {
	db, err := sql.Open("postgres", connStr)
	pg := &PostgresAuditor{DB: db}
	if err != nil {
		return pg, err
	}
	var result int
	err = pg.DB.QueryRow("SELECT 1").Scan(&result)
	if err != nil {
		return pg, fmt.Errorf("Pinging audit database failed: %s", err)
	} else if result != 1 {
		return pg, fmt.Errorf("Database malfunction: SELECT 1 should return 1, but returned %d", result)
	}
	return pg, nil
}

// Handle persists the audit event by writing a row to the
// 'audit_event' postgres table
func (p *PostgresAuditor) Handle(event interface{}) {
	u, err := user.Current()
	if err != nil {
		log.Fatalf("Error getting current user for auditing: %s", err)
	}
	switch event := event.(type) {
	case DecryptEvent:
		// Save the event to the database
		log.WithField("file", event.File).
			Debug("Saving decrypt event to database")

View on GitHub (pinned to 13442bb981)

Solutions

1. Confirm Postgres is reachable: psql "<same DSN>" -c 'SELECT 1'
2. Check the connection string (host, port, user, password, dbname) in the audit config/environment
3. Inspect server logs and pg_hba.conf to confirm the client host/auth method is allowed
4. Verify network path: firewall, security groups, VPN, DNS resolution for the DB host

Example fix

// before
NewPostgresAuditor("postgres://user:pass@localhost:5433/auditdb")  # wrong port
// after
NewPostgresAuditor("postgres://user:pass@localhost:5432/auditdb")

conn := fmt.Sprintf("postgres://%s:%s@%s:%s/%s?sslmode=require", user, pass, host, port, db)
db, err := sql.Open("postgres", conn)
if err != nil { return err }
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
defer cancel()
if err := db.PingContext(ctx); err != nil {
    return fmt.Errorf("audit DB preflight failed: %w", err)
}

pg, err := audit.NewPostgresAuditor(dsn)
if err != nil {
    if strings.Contains(err.Error(), "Pinging audit database failed") {
        // retry with backoff or fail fast with a clear ops message
    }
    return err
}

When it happens

Trigger: init calls NewPostgresAuditor; pg.DB.QueryRow("SELECT 1").Scan returns a driver-level error: connection refused, authentication failure, TLS mismatch, DNS failure, or context timeout.

Common situations: Postgres not running or wrong host/port in config; bad username/password; database doesn't exist; pg_hba.conf rejecting the connection; network/firewall blocking; SSL mode mismatch.

Related errors

• Database malfunction: SELECT 1 should return 1, but returned

AI-assisted analysis of getsops/sops@13442bb981 (2026-09-01). Data as JSON: /api/errors/37d45bf948dbd3c6. Report an issue: GitHub.