Traefik bouncer plugin-metrics 403
I set up the crowdsec helm chart + traefik bouncer yesterday and seeing some errors I can't explain. The bouncer plugin reports every 10 minutes:
Any suggestion on how to troubleshoot? The bouncer is correctly registered, and the engine is communicating with CAPI so it seems to be working otherwise.
ERROR: CrowdsecBouncerTraefikPlugin: 2025/07/25 11:31:08 handleMetricsTicker:reportMetrics reportMetrics:query crowdsecQuery method:POST url:http://crowdsec-service.crowdsec.svc.cluster.local:8080/v1/usage-metrics, statusCode:403 (expected: 2xx)
I suspect this is also related to this error in the agent logs as they seem to have the same timestamp
time="2025-07-25T11:31:08Z" level=warning msg="failed to run filter : unexpected end of JSON input (1:1)\n | UnmarshalJSON(evt.Parsed.message, evt.Unmarshaled, \"traefik\") in [\"\", nil]\n | ^" id=black-moon name=child-crowdsecurity/traefik-logs stage=s01-parse
time="2025-07-25T11:41:08Z" level=error msg="UnmarshalJSON : unexpected end of JSON input" line=Any suggestion on how to troubleshoot? The bouncer is correctly registered, and the engine is communicating with CAPI so it seems to be working otherwise.
3 Replies
Important Information
This post has been marked as resolved. If this is a mistake please press the red button below or type
/unresolve© Created By WhyAydan for CrowdSec ❤️
no idea why, but the usage-metrics is no longer returning a 403. Still seeing the other error in the Traefik parsing. Maybe related to the debug output of the plugin, and it trying to parse those? Not sure
I switched the plugin to log level ERROR and I'm still seeing this error for the Traefik JSON parsing. I've checked my logs on disk, and theylook like they're not truncated to me:
2025-07-31T19:22:43.539162011Z stdout F {"ClientHost":"10.17.44.220","DownstreamStatus":200,"Duration":1228419,"OriginStatus":200,"RequestHost":"whoami.domain.local","RequestMethod":"GET","RequestPath":"/favicon.ico","RetryAttempts":0,"ServiceName":"default-whoami-ingress-014a110e484aa0e2606d@kubernetescrd","level":"info","msg":"","request_User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:141.0) Gecko/20100101 Firefox/141.0","time":"2025-07-31T19:22:43Z"}
We do strip down teh fields that we're keeping, so maybe something it's expecting to be here isn't?
I needed to set container_runtime: containerd in order for the logs to be parsed correctly.Resolving Traefik bouncer plugin-metrics 403
This has now been resolved. If you think this is a mistake please run
/unresolve