403 causing crowdsec to endlessly try to update mmdb database
Solved
ContainerI'm seeing 403 errors when I start crowdsec. it Based on other posts, appears I am being rate-limited. I shut down crowdsec for a while and attempted to restart but still no dice.
/var/lib/crowdsec/data was found in a volume
Local agent already registered
Check if lapi needs to register an additional agent
/etc/crowdsec was found in a volume
Running hub update
Skipping hub update, index file is recent
/var/lib/crowdsec/data was found in a volume
Running hub upgrade
Action plan:
check & update data files
level=warning msg="Failed to check last modified: bad HTTP code 403 for https://hub-data.crowdsec.net/mmdb_update/GeoLite2-City.mmdb" url="https://hub-data.crowdsec.net/mmdb_update/GeoLite2-City.mmdb"
downloading https://hub-data.crowdsec.net/mmdb_update/GeoLite2-City.mmdb
Error: cscli hub upgrade: while downloading data for /etc/crowdsec/parsers/s02-enrich/geoip-enrich.yaml: while getting data: bad HTTP code 403 for https://hub-data.crowdsec.net/mmdb_update/GeoLite2-City.mmdb
... >>> install collection logs
time="2025-12-18T10:25:15-07:00" level=info msg="Enabled feature flags: none"
time="2025-12-18T10:25:15-07:00" level=info msg="Crowdsec v1.7.4-db3efdbf"
time="2025-12-18T10:25:15-07:00" level=info msg="Loading CAPI manager"
time="2025-12-18T10:25:15-07:00" level=info msg="flushed 1/277 alerts because they were created 168h0m0s ago or more" module=db
time="2025-12-18T10:25:16-07:00" level=info msg="attempt 1 out of 2"
time="2025-12-18T10:25:16-07:00" level=info msg="attempt 2 out of 2"
time="2025-12-18T10:25:16-07:00" level=info msg="max attempts reached for status code 403"
time="2025-12-18T10:25:16-07:00" level=fatal msg="api server init: unable to run local API: authenticate watcher (47734877fd38418b9b186606d0bbe9a1pR9D1y9Ln3g0KRDt): API error: Forbidden"
/var/lib/crowdsec/data was found in a volume
Local agent already registered
Check if lapi needs to register an additional agent
/etc/crowdsec was found in a volume
Running hub update
Skipping hub update, index file is recent
/var/lib/crowdsec/data was found in a volume
Running hub upgrade
Action plan:
check & update data fileslevel=warning msg="Failed to check last modified: bad HTTP code 403 for https://hub-data.crowdsec.net/mmdb_update/GeoLite2-City.mmdb" url="https://hub-data.crowdsec.net/mmdb_update/GeoLite2-City.mmdb"
downloading https://hub-data.crowdsec.net/mmdb_update/GeoLite2-City.mmdb
Error: cscli hub upgrade: while downloading data for /etc/crowdsec/parsers/s02-enrich/geoip-enrich.yaml: while getting data: bad HTTP code 403 for https://hub-data.crowdsec.net/mmdb_update/GeoLite2-City.mmdb
... >>> install collection logs
time="2025-12-18T10:25:15-07:00" level=info msg="Enabled feature flags: none"
time="2025-12-18T10:25:15-07:00" level=info msg="Crowdsec v1.7.4-db3efdbf"
time="2025-12-18T10:25:15-07:00" level=info msg="Loading CAPI manager"
time="2025-12-18T10:25:15-07:00" level=info msg="flushed 1/277 alerts because they were created 168h0m0s ago or more" module=db
time="2025-12-18T10:25:16-07:00" level=info msg="attempt 1 out of 2"
time="2025-12-18T10:25:16-07:00" level=info msg="attempt 2 out of 2"
time="2025-12-18T10:25:16-07:00" level=info msg="max attempts reached for status code 403"
time="2025-12-18T10:25:16-07:00" level=fatal msg="api server init: unable to run local API: authenticate watcher (47734877fd38418b9b186606d0bbe9a1pR9D1y9Ln3g0KRDt): API error: Forbidden"
