C
CrowdSec•2mo ago
SenseiMarv

Blocklist unsubscribe not working

Hey all, thanks for the great product! I wanted to swap out one of my subscribed blocklists. On one of my two in total security engines, this worked flawlessly with the next pull. However, on the other, even after 24 hours, the blocklist was still active, preventing me from enabling the other blocklist I want to activate. I then found a similar support request that had already been resolved: https://discord.com/channels/921520481163673640/1391559703724687390. I followed the recommendations there, e.g. looking up the blocklist name in the Local API Decisions when running cscli metrics and then running cscli decisions delete --scenario "firehol_cybercrime". The list disappeared from the metrics, so I waited for the next pull. After the next pull, I saw this in the logs: 
time=2025-08-27T12:13:05+02:00 level=info msg=Starting community-blocklist update
time=2025-08-27T12:13:06+02:00 level=info msg=capi/community-blocklist : 0 explicit deletions
time=2025-08-27T12:13:06+02:00 level=info msg=crowdsecurity/community-blocklist : added 2996 entries, deleted 2996 entries (alert:11214)
time=2025-08-27T12:13:06+02:00 level=info msg=blocklist firehol_cruzit_web_attacks hasn't been modified since Wed, 27 Aug 2025 06:10:17 GMT, skipping
time=2025-08-27T12:13:06+02:00 level=info msg=blocklist firehol_cybercrime hasn't been modified since Wed, 27 Aug 2025 08:10:00 GMT, skipping
time=2025-08-27T12:13:05+02:00 level=info msg=Starting community-blocklist update
time=2025-08-27T12:13:06+02:00 level=info msg=capi/community-blocklist : 0 explicit deletions
time=2025-08-27T12:13:06+02:00 level=info msg=crowdsecurity/community-blocklist : added 2996 entries, deleted 2996 entries (alert:11214)
time=2025-08-27T12:13:06+02:00 level=info msg=blocklist firehol_cruzit_web_attacks hasn't been modified since Wed, 27 Aug 2025 06:10:17 GMT, skipping
time=2025-08-27T12:13:06+02:00 level=info msg=blocklist firehol_cybercrime hasn't been modified since Wed, 27 Aug 2025 08:10:00 GMT, skipping
It reappeared in the logs, and sure enough, it was even showing up in cscli metrics again! Now I'm still blocked from subscribing to a new blocklist without paying, since it still shows up as active. For other blocklists, I can see the correct output that they're active and can be unsubscribed in the web app as seen in the added image. But for this blocklist, it shows up as active on one security engine with no way to unsubscribe again.
No description
No description
1 Reply
CrowdSec
CrowdSec•2mo ago
Important Information
Thank you for getting in touch with your support request. To expedite a swift resolution, could you kindly provide the following information? Rest assured, we will respond promptly, and we greatly appreciate your patience. While you wait, please check the links below to see if this issue has been previously addressed. If you have managed to resolve it, please use run the command /resolve or press the green resolve button below.
Log Files
If you possess any log files that you believe could be beneficial, please include them at this time. By default, CrowdSec logs to /var/log/, where you will discover a corresponding log file for each component.
Guide Followed (CrowdSec Official)
If you have diligently followed one of our guides and hit a roadblock, please share the guide with us. This will help us assess if any adjustments are necessary to assist you further.
Screenshots
Please forward any screenshots depicting errors you encounter. Your visuals will provide us with a clear view of the issues you are facing.
© Created By WhyAydan for CrowdSec ❤️

Did you find this page helpful?