Crowdsec traefik decisions not getting through.

Container

Hi everyone,

I used to get messages of decisions about every half an hour. Currently not getting any. I've moved from nginx to traefik, and I don't know if it is even functioning correctly at this point.

Part of my

acquis.yaml

acquis.yaml

filenames:
  - /var/log/nginx/*.log
  - ./tests/nginx/nginx.log
  - /var/log/swag/*.log
  - /var/log/traefik/*
#this is not a syslog log, indicate which kind of logs it is
labels:
#  type: nginx
  type: traefik

filenames:
  - /var/log/nginx/*.log
  - ./tests/nginx/nginx.log
  - /var/log/swag/*.log
  - /var/log/traefik/*
#this is not a syslog log, indicate which kind of logs it is
labels:
#  type: nginx
  type: traefik

I still have parts of the old logs in here, but only traefik is getting updated.

My dynamic file is as follows:

http:
  middlewares:
    crowdsec-bouncer:
      plugin:
        crowdsec-bouncer-traefik-plugin:
          enabled: true
          crowdsecMode: live
          crowdseclapikey: "api key generated by doing"

http:
  middlewares:
    crowdsec-bouncer:
      plugin:
        crowdsec-bouncer-traefik-plugin:
          enabled: true
          crowdsecMode: live
          crowdseclapikey: "api key generated by doing"

docker exec crowdsec cscli bouncers add TraefikBouncer, please see: https://share.golfwithus.nl/u/zBLusE.png

I don't know why my decisions are not getting through, am I missing something?
I am running both traefik and crowdsec in docker.

My profiles.yaml is as follows:

name: default_ip_remediation
#debug: true
filters:
 - Alert.Remediation == true && Alert.GetScope() == "Ip"
decisions:
 - type: ban
   duration: 24h
duration_expr: "Sprintf('%dh', (GetDecisionsCount(Alert.GetValue()) + 1) * 24)"
notifications:
  - discord  # Set the webhook in /etc/crowdsec/notifications/slack.yaml before enabling this.
on_success: break

name: default_ip_remediation
#debug: true
filters:
 - Alert.Remediation == true && Alert.GetScope() == "Ip"
decisions:
 - type: ban
   duration: 24h
duration_expr: "Sprintf('%dh', (GetDecisionsCount(Alert.GetValue()) + 1) * 24)"
notifications:
  - discord  # Set the webhook in /etc/crowdsec/notifications/slack.yaml before enabling this.
on_success: break

CrowdSec•2mo ago•

57 replies

Quafley

Crowdsec traefik decisions not getting through.

Container

acquis.yaml

acquis.yaml

filenames:
  - /var/log/nginx/*.log
  - ./tests/nginx/nginx.log
  - /var/log/swag/*.log
  - /var/log/traefik/*
#this is not a syslog log, indicate which kind of logs it is
labels:
#  type: nginx
  type: traefik

filenames:
  - /var/log/nginx/*.log
  - ./tests/nginx/nginx.log
  - /var/log/swag/*.log
  - /var/log/traefik/*
#this is not a syslog log, indicate which kind of logs it is
labels:
#  type: nginx
  type: traefik

I still have parts of the old logs in here, but only traefik is getting updated.

My dynamic file is as follows:

http:
  middlewares:
    crowdsec-bouncer:
      plugin:
        crowdsec-bouncer-traefik-plugin:
          enabled: true
          crowdsecMode: live
          crowdseclapikey: "api key generated by doing"

http:
  middlewares:
    crowdsec-bouncer:
      plugin:
        crowdsec-bouncer-traefik-plugin:
          enabled: true
          crowdsecMode: live
          crowdseclapikey: "api key generated by doing"

name: default_ip_remediation
#debug: true
filters:
 - Alert.Remediation == true && Alert.GetScope() == "Ip"
decisions:
 - type: ban
   duration: 24h
duration_expr: "Sprintf('%dh', (GetDecisionsCount(Alert.GetValue()) + 1) * 24)"
notifications:
  - discord  # Set the webhook in /etc/crowdsec/notifications/slack.yaml before enabling this.
on_success: break

name: default_ip_remediation
#debug: true
filters:
 - Alert.Remediation == true && Alert.GetScope() == "Ip"
decisions:
 - type: ban
   duration: 24h
duration_expr: "Sprintf('%dh', (GetDecisionsCount(Alert.GetValue()) + 1) * 24)"
notifications:
  - discord  # Set the webhook in /etc/crowdsec/notifications/slack.yaml before enabling this.
on_success: break

Crowdsec traefik decisions not getting through.

Similar Threads

Crowdsec traefik decisions not getting through.

Similar Threads

Similar Threads

Similar Threads