C
CrowdSecβ€’2w ago
Laz

Error while parsing logs - schiz0phr3ne/sonarr-logs

I'm encountering an issue with a log parser bundled as part of a collection. https://app.crowdsec.net/hub/author/schiz0phr3ne/collections/sonarr Specifically with this parser https://app.crowdsec.net/hub/author/schiz0phr3ne/log-parsers/sonarr-logs When I run the command 
sh -c "tail -n 10 /var/log/sonarr/sonarr.txt | cscli explain --type syslog --file -"
sh -c "tail -n 10 /var/log/sonarr/sonarr.txt | cscli explain --type syslog --file -"
The following error appears (IP addresses redacted). These are authentication logs, and as I understand it, they should be parsed. 
line: 2025-08-18 20:00:54.3|Warn|Auth|Auth-Failure ip *.*.*.* username 'XXXXX'
        β”œ s00-raw
        |       β”œ πŸ”΄ crowdsecurity/cri-logs
        |       β”œ πŸ”΄ crowdsecurity/docker-logs
        |       β”œ πŸ”΄ crowdsecurity/syslog-logs
        |       β”” πŸ”΄ crowdsecurity/non-syslog
        β””-------- parser failure πŸ”΄

line: 2025-08-18 20:00:56.2|Info|Auth|Auth-Success ip *.*.*.*username 'YYYYY'
        β”œ s00-raw
        |       β”œ πŸ”΄ crowdsecurity/cri-logs
        |       β”œ πŸ”΄ crowdsecurity/docker-logs
        |       β”œ πŸ”΄ crowdsecurity/syslog-logs
        |       β”” πŸ”΄ crowdsecurity/non-syslog
        β””-------- parser failure πŸ”΄
line: 2025-08-18 20:00:54.3|Warn|Auth|Auth-Failure ip *.*.*.* username 'XXXXX'
        β”œ s00-raw
        |       β”œ πŸ”΄ crowdsecurity/cri-logs
        |       β”œ πŸ”΄ crowdsecurity/docker-logs
        |       β”œ πŸ”΄ crowdsecurity/syslog-logs
        |       β”” πŸ”΄ crowdsecurity/non-syslog
        β””-------- parser failure πŸ”΄

line: 2025-08-18 20:00:56.2|Info|Auth|Auth-Success ip *.*.*.*username 'YYYYY'
        β”œ s00-raw
        |       β”œ πŸ”΄ crowdsecurity/cri-logs
        |       β”œ πŸ”΄ crowdsecurity/docker-logs
        |       β”œ πŸ”΄ crowdsecurity/syslog-logs
        |       β”” πŸ”΄ crowdsecurity/non-syslog
        β””-------- parser failure πŸ”΄
I have no idea how parsers work, and have only a surface level understanding of docker and crowdsec so I've hit a bit of a wall here. Would appreciate some guidance.
Collections, AppSec Rules & Configurations | CrowdSec Hub
Manage collections, configurations, remediation components, and AppSec rules with CrowdSec Hub. Streamline security with tools and integrations for enhanced protection.
Collections, AppSec Rules & Configurations | CrowdSec Hub
Manage collections, configurations, remediation components, and AppSec rules with CrowdSec Hub. Streamline security with tools and integrations for enhanced protection.
7 Replies
CrowdSec
CrowdSecβ€’2w ago
Important Information
This post has been marked as resolved. If this is a mistake please press the red button below or type /unresolve
© Created By WhyAydan for CrowdSec ❀️
_KaszpiR_
_KaszpiR_β€’2w ago
I suggest making an GitHub issue on the crowdsec/hub if you think it is a parser issue
Laz
LazOPβ€’2w ago
Will do, thanks
iiamloz
iiamlozβ€’2w ago
The issue is you specified syslog when the type is when sonnar is writing to syslog so can you try specify the type parameter as Sonarr or mono note the caps matter
Laz
LazOPβ€’2w ago
It's always something so simple, thanks for the help
CrowdSec
CrowdSecβ€’2w ago
Resolving Error while parsing logs - schiz0phr3ne/sonarr-logs This has now been resolved. If you think this is a mistake please run /unresolve
iiamloz
iiamlozβ€’2w ago

Did you find this page helpful?