CrowdSec•3w ago

duration_expr not working in profiles.yaml

Hello, I just installed crowdsec with apt and I want to enable increasing durations for ban decisions. In /etc/crowdsec/profiles.yaml, I tried uncommenting the included duration_expr string but it causes crowdsec to fail to start with this error

$sudo crowdsec -t
FATAL while loading profiles for LAPI: while decoding /etc/crowdsec/profiles.yaml: yaml: unmarshal errors:
  line 2: field duration_expr not found in type models.Decision

$sudo crowdsec -t
FATAL while loading profiles for LAPI: while decoding /etc/crowdsec/profiles.yaml: yaml: unmarshal errors:
  line 2: field duration_expr not found in type models.Decision

Here is the section from my profiles.yaml

name: default_ip_remediation
#debug: true
filters:
 - Alert.Remediation == true && Alert.GetScope() == "Ip"
decisions:
 - type: ban
   duration_expr: "Sprintf('%dh', (GetDecisionsCount(Alert.GetValue()) + 1) * 4)"
   #duration: 4h
on_success: break

name: default_ip_remediation
#debug: true
filters:
 - Alert.Remediation == true && Alert.GetScope() == "Ip"
decisions:
 - type: ban
   duration_expr: "Sprintf('%dh', (GetDecisionsCount(Alert.GetValue()) + 1) * 4)"
   #duration: 4h
on_success: break

I tried with and without quotations around the expr value, both caused the above error.

$crowdsec -version
version: v1.7.0-debian-pragmatic-amd64-c3036e21
Codename: alphaga
BuildDate: 2025-09-02_12:36:34
GoVersion: 1.24.6
Platform: linux
libre2: C++
User-Agent: crowdsec/v1.7.0-debian-pragmatic-amd64-c3036e21-linux
Constraint_parser: >= 1.0, <= 3.0
Constraint_scenario: >= 1.0, <= 3.0
Constraint_api: v1
Constraint_acquis: >= 1.0, < 2.0
Built-in optional components: datasource_appsec, datasource_cloudwatch, datasource_docker, datasource_file, datasource_http, datasource_journalctl, datasource_k8s-audit, datasource_kafka, datasource_kinesis, datasource_loki, datasource_s3, datasource_syslog, datasource_victorialogs, datasource_wineventlog
Excluded components: cscli_setup

$crowdsec -version
version: v1.7.0-debian-pragmatic-amd64-c3036e21
Codename: alphaga
BuildDate: 2025-09-02_12:36:34
GoVersion: 1.24.6
Platform: linux
libre2: C++
User-Agent: crowdsec/v1.7.0-debian-pragmatic-amd64-c3036e21-linux
Constraint_parser: >= 1.0, <= 3.0
Constraint_scenario: >= 1.0, <= 3.0
Constraint_api: v1
Constraint_acquis: >= 1.0, < 2.0
Built-in optional components: datasource_appsec, datasource_cloudwatch, datasource_docker, datasource_file, datasource_http, datasource_journalctl, datasource_k8s-audit, datasource_kafka, datasource_kinesis, datasource_loki, datasource_s3, datasource_syslog, datasource_victorialogs, datasource_wineventlog
Excluded components: cscli_setup

Would appreciate any help

3 Replies

CrowdSec•3w ago

Important Information

This post has been marked as resolved. If this is a mistake please press the red button below or type /unresolve

blotus•3w ago

Hello, duration_expr should be set a the top level of the document, not in decisions

CrowdSec•3w ago

Resolving duration_expr not working in profiles.yaml This has now been resolved. If you think this is a mistake please run /unresolve

Gaming

Programming

duration_expr not working in profiles.yaml

Did you find this page helpful?