duration_expr not working in profiles.yaml

Hello,

I just installed crowdsec with apt and I want to enable increasing durations for ban decisions.

In /etc/crowdsec/profiles.yaml, I tried uncommenting the included

duration_expr

duration_expr

string but it causes crowdsec to fail to start with this error

$sudo crowdsec -t
FATAL while loading profiles for LAPI: while decoding /etc/crowdsec/profiles.yaml: yaml: unmarshal errors:
  line 2: field duration_expr not found in type models.Decision

$sudo crowdsec -t
FATAL while loading profiles for LAPI: while decoding /etc/crowdsec/profiles.yaml: yaml: unmarshal errors:
  line 2: field duration_expr not found in type models.Decision

Here is the section from my profiles.yaml

name: default_ip_remediation
#debug: true
filters:
 - Alert.Remediation == true && Alert.GetScope() == "Ip"
decisions:
 - type: ban
   duration_expr: "Sprintf('%dh', (GetDecisionsCount(Alert.GetValue()) + 1) * 4)"
   #duration: 4h
on_success: break

name: default_ip_remediation
#debug: true
filters:
 - Alert.Remediation == true && Alert.GetScope() == "Ip"
decisions:
 - type: ban
   duration_expr: "Sprintf('%dh', (GetDecisionsCount(Alert.GetValue()) + 1) * 4)"
   #duration: 4h
on_success: break

I tried with and without quotations around the expr value, both caused the above error.

$crowdsec -version
version: v1.7.0-debian-pragmatic-amd64-c3036e21
Codename: alphaga
BuildDate: 2025-09-02_12:36:34
GoVersion: 1.24.6
Platform: linux
libre2: C++
User-Agent: crowdsec/v1.7.0-debian-pragmatic-amd64-c3036e21-linux
Constraint_parser: >= 1.0, <= 3.0
Constraint_scenario: >= 1.0, <= 3.0
Constraint_api: v1
Constraint_acquis: >= 1.0, < 2.0
Built-in optional components: datasource_appsec, datasource_cloudwatch, datasource_docker, datasource_file, datasource_http, datasource_journalctl, datasource_k8s-audit, datasource_kafka, datasource_kinesis, datasource_loki, datasource_s3, datasource_syslog, datasource_victorialogs, datasource_wineventlog
Excluded components: cscli_setup

$crowdsec -version
version: v1.7.0-debian-pragmatic-amd64-c3036e21
Codename: alphaga
BuildDate: 2025-09-02_12:36:34
GoVersion: 1.24.6
Platform: linux
libre2: C++
User-Agent: crowdsec/v1.7.0-debian-pragmatic-amd64-c3036e21-linux
Constraint_parser: >= 1.0, <= 3.0
Constraint_scenario: >= 1.0, <= 3.0
Constraint_api: v1
Constraint_acquis: >= 1.0, < 2.0
Built-in optional components: datasource_appsec, datasource_cloudwatch, datasource_docker, datasource_file, datasource_http, datasource_journalctl, datasource_k8s-audit, datasource_kafka, datasource_kinesis, datasource_loki, datasource_s3, datasource_syslog, datasource_victorialogs, datasource_wineventlog
Excluded components: cscli_setup

Would appreciate any help

CrowdSec•6mo ago•

4 replies

llp

duration_expr not working in profiles.yaml

Hello,

I just installed crowdsec with apt and I want to enable increasing durations for ban decisions.

In /etc/crowdsec/profiles.yaml, I tried uncommenting the included

duration_expr

duration_expr

string but it causes crowdsec to fail to start with this error

$sudo crowdsec -t
FATAL while loading profiles for LAPI: while decoding /etc/crowdsec/profiles.yaml: yaml: unmarshal errors:
  line 2: field duration_expr not found in type models.Decision

$sudo crowdsec -t
FATAL while loading profiles for LAPI: while decoding /etc/crowdsec/profiles.yaml: yaml: unmarshal errors:
  line 2: field duration_expr not found in type models.Decision

Here is the section from my profiles.yaml

name: default_ip_remediation
#debug: true
filters:
 - Alert.Remediation == true && Alert.GetScope() == "Ip"
decisions:
 - type: ban
   duration_expr: "Sprintf('%dh', (GetDecisionsCount(Alert.GetValue()) + 1) * 4)"
   #duration: 4h
on_success: break

name: default_ip_remediation
#debug: true
filters:
 - Alert.Remediation == true && Alert.GetScope() == "Ip"
decisions:
 - type: ban
   duration_expr: "Sprintf('%dh', (GetDecisionsCount(Alert.GetValue()) + 1) * 4)"
   #duration: 4h
on_success: break

I tried with and without quotations around the expr value, both caused the above error.

$crowdsec -version
version: v1.7.0-debian-pragmatic-amd64-c3036e21
Codename: alphaga
BuildDate: 2025-09-02_12:36:34
GoVersion: 1.24.6
Platform: linux
libre2: C++
User-Agent: crowdsec/v1.7.0-debian-pragmatic-amd64-c3036e21-linux
Constraint_parser: >= 1.0, <= 3.0
Constraint_scenario: >= 1.0, <= 3.0
Constraint_api: v1
Constraint_acquis: >= 1.0, < 2.0
Built-in optional components: datasource_appsec, datasource_cloudwatch, datasource_docker, datasource_file, datasource_http, datasource_journalctl, datasource_k8s-audit, datasource_kafka, datasource_kinesis, datasource_loki, datasource_s3, datasource_syslog, datasource_victorialogs, datasource_wineventlog
Excluded components: cscli_setup

$crowdsec -version
version: v1.7.0-debian-pragmatic-amd64-c3036e21
Codename: alphaga
BuildDate: 2025-09-02_12:36:34
GoVersion: 1.24.6
Platform: linux
libre2: C++
User-Agent: crowdsec/v1.7.0-debian-pragmatic-amd64-c3036e21-linux
Constraint_parser: >= 1.0, <= 3.0
Constraint_scenario: >= 1.0, <= 3.0
Constraint_api: v1
Constraint_acquis: >= 1.0, < 2.0
Built-in optional components: datasource_appsec, datasource_cloudwatch, datasource_docker, datasource_file, datasource_http, datasource_journalctl, datasource_k8s-audit, datasource_kafka, datasource_kinesis, datasource_loki, datasource_s3, datasource_syslog, datasource_victorialogs, datasource_wineventlog
Excluded components: cscli_setup

Would appreciate any help

duration_expr not working in profiles.yaml

Similar Threads

duration_expr not working in profiles.yaml

Similar Threads

Similar Threads

Similar Threads