Getting wierd random erros from Crowdsec in terminal #1449

DJKatastrof · 2025-01-29T13:36:35Z

DJKatastrof
Jan 29, 2025

Getting strange errors in my crowdsec container.
Compose.yaml file

services:
  npmplus:
    container_name: npmplus
    image: docker.io/zoeyvid/npmplus:latest
    restart: always
    network_mode: host
    volumes:
      - ./npmplus:/data
      #- "/var/www:/var/www" 
    environment:
      - TZ=Europe/Stockholm
      - [email protected]
      - [email protected]
      - INITIAL_ADMIN_PASSWORD=redacted
      - LOGROTATE=true

  crowdsec:
    container_name: crowdsec
    image: docker.io/crowdsecurity/crowdsec:latest
    restart: always
    network_mode: bridge
    ports:
      - 127.0.0.1:7422:7422
      - 127.0.0.1:8080:8080
    environment:
      - TZ=Europe/Stockholm # needs to be changed
      - COLLECTIONS=ZoeyVid/npmplus
    volumes:
      - ./npmplus/crowdsec/conf:/etc/crowdsec
      - ./npmplus/crowdsec/data:/var/lib/crowdsec/data
      - ./npmplus/nginx:/opt/npmplus/nginx:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro

Answered by Zoey2936

Jan 29, 2025

I think I found the error:
1.

[...]
    volumes:
      - ./npmplus:/data
[...]
    volumes:
      - ./npmplus/crowdsec/conf:/etc/crowdsec
      - ./npmplus/crowdsec/data:/var/lib/crowdsec/data
      - ./npmplus/nginx:/opt/npmplus/nginx:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro

npmplus creates a folder called crowdsec in the /data folder which can make trubbel, please delete the ./npmplus/crowdsec folder and restart npmplus so it will recreated and you can configure it again. and for the crowdsec container you should change the paths to for example:

    volumes:
      - ./crowdsec/conf:/etc/crowdsec
      - ./crowdsec/data:/var/lib/crowdsec/data
      - ./npmplus/nginx:/opt/…

View full answer

Zoey2936 · 2025-01-29T13:38:36Z

Zoey2936
Jan 29, 2025
Maintainer

please also post the crowdsec docker logs

2 replies

DJKatastrof Jan 29, 2025
Author

Sorry, where can I find them?

Zoey2936 Jan 29, 2025
Maintainer

docker logs crowdsec

DJKatastrof · 2025-01-29T13:45:55Z

DJKatastrof
Jan 29, 2025
Author

level=info msg="Upgrading parsers"
level=info msg="crowdsecurity/appsec-logs: up-to-date"
level=info msg="crowdsecurity/cri-logs: up-to-date"
level=info msg="crowdsecurity/dateparse-enrich: up-to-date"
level=info msg="crowdsecurity/docker-logs: up-to-date"
level=info msg="crowdsecurity/geoip-enrich: up-to-date"
level=info msg="crowdsecurity/http-logs: up-to-date"
level=info msg="crowdsecurity/modsecurity: up-to-date"
level=info msg="crowdsecurity/sshd-logs: up-to-date"
level=info msg="crowdsecurity/syslog-logs: up-to-date"
level=info msg="crowdsecurity/whitelists: up-to-date"
level=info msg="openappsec/openappsec-logs: up-to-date"
level=info msg="ZoeyVid/npmplus-logs: up-to-date"
level=info msg="Upgraded 0 parsers"
level=info msg="Upgrading postoverflows"
level=info msg="Upgraded 0 postoverflows"
level=info msg="Upgrading scenarios"
level=info msg="crowdsecurity/apache_log4j2_cve-2021-44228: up-to-date"
level=info msg="crowdsecurity/appsec-vpatch: up-to-date"
level=info msg="crowdsecurity/CVE-2017-9841: up-to-date"
level=info msg="crowdsecurity/CVE-2019-18935: up-to-date"
level=info msg="crowdsecurity/CVE-2022-26134: up-to-date"
level=info msg="crowdsecurity/CVE-2022-35914: up-to-date"
level=info msg="crowdsecurity/CVE-2022-37042: up-to-date"
level=info msg="crowdsecurity/CVE-2022-40684: up-to-date"
level=info msg="crowdsecurity/CVE-2022-41082: up-to-date"
level=info msg="crowdsecurity/CVE-2022-41697: up-to-date"
level=info msg="crowdsecurity/CVE-2022-42889: up-to-date"
level=info msg="crowdsecurity/CVE-2022-44877: up-to-date"
level=info msg="crowdsecurity/CVE-2022-46169: up-to-date"
level=info msg="crowdsecurity/CVE-2023-22515: up-to-date"
level=info msg="crowdsecurity/CVE-2023-22518: up-to-date"
level=info msg="crowdsecurity/CVE-2023-49103: up-to-date"
level=info msg="crowdsecurity/CVE-2024-0012: up-to-date"
level=info msg="crowdsecurity/CVE-2024-38475: up-to-date"
level=info msg="crowdsecurity/CVE-2024-9474: up-to-date"
level=info msg="crowdsecurity/f5-big-ip-cve-2020-5902: up-to-date"
level=info msg="crowdsecurity/fortinet-cve-2018-13379: up-to-date"
level=info msg="crowdsecurity/grafana-cve-2021-43798: up-to-date"
level=info msg="crowdsecurity/http-admin-interface-probing: up-to-date"
level=info msg="crowdsecurity/http-backdoors-attempts: up-to-date"
level=info msg="crowdsecurity/http-bad-user-agent: up-to-date"
level=info msg="crowdsecurity/http-crawl-non_statics: up-to-date"
level=info msg="crowdsecurity/http-cve-2021-41773: up-to-date"
level=info msg="crowdsecurity/http-cve-2021-42013: up-to-date"
level=info msg="crowdsecurity/http-cve-probing: up-to-date"
level=info msg="crowdsecurity/http-generic-bf: up-to-date"
level=info msg="crowdsecurity/http-open-proxy: up-to-date"
level=info msg="crowdsecurity/http-path-traversal-probing: up-to-date"
level=info msg="crowdsecurity/http-probing: up-to-date"
level=info msg="crowdsecurity/http-sensitive-files: up-to-date"
level=info msg="crowdsecurity/http-sqli-probing: up-to-date"
level=info msg="crowdsecurity/http-wordpress-scan: up-to-date"
level=info msg="crowdsecurity/http-xss-probing: up-to-date"
level=info msg="crowdsecurity/jira_cve-2021-26086: up-to-date"
level=info msg="crowdsecurity/modsecurity: up-to-date"
level=info msg="crowdsecurity/netgear_rce: up-to-date"
level=info msg="crowdsecurity/nginx-req-limit-exceeded: up-to-date"
level=info msg="crowdsecurity/pulse-secure-sslvpn-cve-2019-11510: up-to-date"
level=info msg="crowdsecurity/spring4shell_cve-2022-22965: up-to-date"
level=info msg="crowdsecurity/ssh-bf: up-to-date"
level=info msg="crowdsecurity/ssh-cve-2024-6387: up-to-date"
level=info msg="crowdsecurity/ssh-slow-bf: up-to-date"
level=info msg="crowdsecurity/thinkphp-cve-2018-20062: up-to-date"
level=info msg="crowdsecurity/vmware-cve-2022-22954: up-to-date"
level=info msg="crowdsecurity/vmware-vcenter-vmsa-2021-0027: up-to-date"
level=info msg="ltsich/http-w00tw00t: up-to-date"
level=info msg="openappsec/openappsec-bot-protection: up-to-date"
level=info msg="openappsec/openappsec-cross-site-redirect: up-to-date"
level=info msg="openappsec/openappsec-csrf: up-to-date"
level=info msg="openappsec/openappsec-error-disclosure: up-to-date"
level=info msg="openappsec/openappsec-error-limit: up-to-date"
level=info msg="openappsec/openappsec-evasion-techniques: up-to-date"
level=info msg="openappsec/openappsec-general: up-to-date"
level=info msg="openappsec/openappsec-http-limit-violation: up-to-date"
level=info msg="openappsec/openappsec-http-method-violation: up-to-date"
level=info msg="openappsec/openappsec-ldap-injection: up-to-date"
level=info msg="openappsec/openappsec-open-redirect: up-to-date"
level=info msg="openappsec/openappsec-path-traversal: up-to-date"
level=info msg="openappsec/openappsec-probing: up-to-date"
level=info msg="openappsec/openappsec-rce: up-to-date"
level=info msg="openappsec/openappsec-request-rate-limit: up-to-date"
level=info msg="openappsec/openappsec-schema-validation: up-to-date"
level=info msg="openappsec/openappsec-sql-injection: up-to-date"
level=info msg="openappsec/openappsec-url-instead-of-file: up-to-date"
level=info msg="openappsec/openappsec-xss: up-to-date"
level=info msg="openappsec/openappsec-xxe: up-to-date"
level=info msg="Upgraded 0 scenarios"
level=info msg="Upgrading contexts"
level=info msg="crowdsecurity/appsec_base: up-to-date"
level=info msg="crowdsecurity/bf_base: up-to-date"
level=info msg="crowdsecurity/http_base: up-to-date"
level=info msg="Upgraded 0 contexts"
level=info msg="Upgrading appsec-configs"
level=info msg="crowdsecurity/appsec-default: up-to-date"
level=info msg="crowdsecurity/generic-rules: up-to-date"
level=info msg="crowdsecurity/virtual-patching: up-to-date"
level=info msg="Upgraded 0 appsec-configs"
level=info msg="Upgrading appsec-rules"
level=info msg="crowdsecurity/base-config: up-to-date"
level=info msg="crowdsecurity/generic-freemarker-ssti: up-to-date"
level=info msg="crowdsecurity/generic-wordpress-uploads-php: up-to-date"
level=info msg="crowdsecurity/vpatch-connectwise-auth-bypass: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2017-9841: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2018-1000861: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2018-10562: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2018-13379: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2018-20062: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2019-1003030: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2019-12989: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2019-18935: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2020-11738: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2020-17496: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2020-5902: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2021-22941: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2021-26086: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2021-3129: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2022-22954: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2022-22965: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2022-26134: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2022-27926: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2022-35914: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2022-41082: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2022-44877: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2022-46169: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2023-1389: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2023-20198: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2023-22515: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2023-22527: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2023-23752: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2023-24489: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2023-28121: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2023-33617: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2023-34362: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2023-35078: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2023-35082: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2023-3519: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2023-38205: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2023-40044: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2023-42793: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2023-46805: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2023-47218: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2023-49070: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2023-50164: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2023-6553: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2023-7028: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2024-0012: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2024-1212: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2024-22024: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2024-23897: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2024-27198: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2024-27348: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2024-27954: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2024-27956: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2024-28255: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2024-28987: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2024-29824: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2024-29849: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2024-29973: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2024-32113: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2024-3272: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2024-3273: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2024-34102: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2024-38816: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2024-38856: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2024-41713: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2024-4577: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2024-51378: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2024-51567: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2024-52301: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2024-7593: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2024-8190: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2024-8963: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2024-9465: up-to-date"
level=info msg="crowdsecurity/vpatch-CVE-2024-9474: up-to-date"
level=info msg="crowdsecurity/vpatch-env-access: up-to-date"
level=info msg="crowdsecurity/vpatch-git-config: up-to-date"
level=info msg="crowdsecurity/vpatch-laravel-debug-mode: up-to-date"
level=info msg="crowdsecurity/vpatch-symfony-profiler: up-to-date"
level=info msg="Upgraded 0 appsec-rules"
level=info msg="Upgrading collections"
level=info msg="crowdsecurity/appsec-generic-rules: up-to-date"
level=info msg="crowdsecurity/appsec-virtual-patching: up-to-date"
level=info msg="crowdsecurity/base-http-scenarios: up-to-date"
level=info msg="crowdsecurity/http-cve: up-to-date"
level=info msg="crowdsecurity/linux: up-to-date"
level=info msg="crowdsecurity/modsecurity: up-to-date"
level=info msg="crowdsecurity/sshd: up-to-date"
level=info msg="openappsec/openappsec: up-to-date"
level=info msg="ZoeyVid/npmplus: up-to-date"
level=info msg="Upgraded 0 collections"
level=info msg="Downloaded crowdsecurity/docker-logs"
level=info msg="Enabled crowdsecurity/docker-logs"
level=info msg="Run 'sudo systemctl reload crowdsec' for the new configuration to be effective."
level=info msg="Downloaded crowdsecurity/cri-logs"
level=info msg="Enabled crowdsecurity/cri-logs"
level=info msg="Run 'sudo systemctl reload crowdsec' for the new configuration to be effective."
level=info msg="Downloaded ZoeyVid/npmplus-logs"
level=info msg="Downloaded crowdsecurity/cri-logs"
level=info msg="Downloaded crowdsecurity/dateparse-enrich"
level=info msg="Downloaded crowdsecurity/nginx-req-limit-exceeded"
level=info msg="Downloaded crowdsecurity/appsec-logs"
level=info msg="Downloaded crowdsecurity/appsec-vpatch"
level=info msg="Downloaded crowdsecurity/appsec_base"
level=info msg="Downloaded crowdsecurity/virtual-patching"
level=info msg="Downloaded crowdsecurity/appsec-default"
level=info msg="Downloaded crowdsecurity/base-config"
level=info msg="Downloaded crowdsecurity/vpatch-env-access"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2023-40044"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2017-9841"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2020-11738"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2022-27926"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2022-35914"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2022-46169"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2023-20198"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2023-22515"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2023-33617"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2023-34362"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2023-3519"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2023-42793"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2023-50164"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2023-38205"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2023-24489"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2021-3129"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2021-22941"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2019-12989"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2022-44877"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2018-10562"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2023-6553"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2018-1000861"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2019-1003030"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2022-22965"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2023-23752"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2023-49070"
level=info msg="Downloaded crowdsecurity/vpatch-laravel-debug-mode"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2023-28121"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2020-17496"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2023-1389"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2023-7028"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2023-46805"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2024-23897"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2023-22527"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2023-35078"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2023-35082"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2022-22954"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2024-1212"
level=info msg="Downloaded crowdsecurity/vpatch-symfony-profiler"
level=info msg="Downloaded crowdsecurity/vpatch-connectwise-auth-bypass"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2024-22024"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2024-27198"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2024-3273"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2024-4577"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2024-29849"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2023-47218"
level=info msg="Downloaded crowdsecurity/vpatch-git-config"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2024-32113"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2024-3272"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2024-28255"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2024-29824"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2024-27348"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2020-5902"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2018-13379"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2022-26134"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2024-34102"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2024-29973"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2022-41082"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2019-18935"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2024-8190"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2024-28987"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2024-38856"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2018-20062"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2021-26086"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2024-51567"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2024-27956"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2024-27954"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2024-0012"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2024-9474"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2024-7593"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2024-52301"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2024-8963"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2024-38816"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2024-9465"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2024-51378"
level=info msg="Downloaded crowdsecurity/vpatch-CVE-2024-41713"
level=info msg="Downloaded crowdsecurity/appsec-virtual-patching"
level=info msg="Downloaded crowdsecurity/appsec-virtual-patching"
level=info msg="Downloaded crowdsecurity/appsec-logs"
level=info msg="Downloaded crowdsecurity/appsec-vpatch"
level=info msg="Downloaded crowdsecurity/appsec_base"
level=info msg="Downloaded crowdsecurity/generic-rules"
level=info msg="Downloaded crowdsecurity/appsec-default"
level=info msg="Downloaded crowdsecurity/base-config"
level=info msg="Downloaded crowdsecurity/generic-freemarker-ssti"
level=info msg="Downloaded crowdsecurity/generic-wordpress-uploads-php"
level=info msg="Downloaded crowdsecurity/appsec-generic-rules"
level=info msg="Downloaded crowdsecurity/appsec-generic-rules"
level=info msg="Downloaded crowdsecurity/http-logs"
level=info msg="Downloaded crowdsecurity/http-crawl-non_statics"
level=info msg="Downloaded crowdsecurity/http-probing"
level=info msg="Downloaded crowdsecurity/http-bad-user-agent"
level=info msg="Downloaded crowdsecurity/http-path-traversal-probing"
level=info msg="Downloaded crowdsecurity/http-sensitive-files"
level=info msg="Downloaded crowdsecurity/http-sqli-probing"
level=info msg="Downloaded crowdsecurity/http-xss-probing"
level=info msg="Downloaded crowdsecurity/http-backdoors-attempts"
level=info msg="Downloaded ltsich/http-w00tw00t"
level=info msg="Downloaded crowdsecurity/http-generic-bf"
level=info msg="Downloaded crowdsecurity/http-open-proxy"
level=info msg="Downloaded crowdsecurity/http-admin-interface-probing"
level=info msg="Downloaded crowdsecurity/http-wordpress-scan"
level=info msg="Downloaded crowdsecurity/http-cve-probing"
level=info msg="Downloaded crowdsecurity/http_base"
level=info msg="Downloaded crowdsecurity/http-cve-2021-41773"
level=info msg="Downloaded crowdsecurity/http-cve-2021-42013"
level=info msg="Downloaded crowdsecurity/grafana-cve-2021-43798"
level=info msg="Downloaded crowdsecurity/vmware-vcenter-vmsa-2021-0027"
level=info msg="Downloaded crowdsecurity/fortinet-cve-2018-13379"
level=info msg="Downloaded crowdsecurity/pulse-secure-sslvpn-cve-2019-11510"
level=info msg="Downloaded crowdsecurity/f5-big-ip-cve-2020-5902"
level=info msg="Downloaded crowdsecurity/thinkphp-cve-2018-20062"
level=info msg="Downloaded crowdsecurity/apache_log4j2_cve-2021-44228"
level=info msg="Downloaded crowdsecurity/jira_cve-2021-26086"
level=info msg="Downloaded crowdsecurity/spring4shell_cve-2022-22965"
level=info msg="Downloaded crowdsecurity/vmware-cve-2022-22954"
level=info msg="Downloaded crowdsecurity/CVE-2022-37042"
level=info msg="Downloaded crowdsecurity/CVE-2022-41082"
level=info msg="Downloaded crowdsecurity/CVE-2022-35914"
level=info msg="Downloaded crowdsecurity/CVE-2022-40684"
level=info msg="Downloaded crowdsecurity/CVE-2022-26134"
level=info msg="Downloaded crowdsecurity/CVE-2022-42889"
level=info msg="Downloaded crowdsecurity/CVE-2022-41697"
level=info msg="Downloaded crowdsecurity/CVE-2022-46169"
level=info msg="Downloaded crowdsecurity/CVE-2022-44877"
level=info msg="Downloaded crowdsecurity/CVE-2019-18935"
level=info msg="Downloaded crowdsecurity/netgear_rce"
level=info msg="Downloaded crowdsecurity/CVE-2023-22515"
level=info msg="Downloaded crowdsecurity/CVE-2023-22518"
level=info msg="Downloaded crowdsecurity/CVE-2023-49103"
level=info msg="Downloaded crowdsecurity/CVE-2017-9841"
level=info msg="Downloaded crowdsecurity/CVE-2024-38475"
level=info msg="Downloaded crowdsecurity/CVE-2024-0012"
level=info msg="Downloaded crowdsecurity/CVE-2024-9474"
level=info msg="Downloaded crowdsecurity/http-cve"
level=info msg="Downloaded crowdsecurity/http-cve"
level=info msg="Downloaded crowdsecurity/base-http-scenarios"
level=info msg="Downloaded crowdsecurity/base-http-scenarios"
level=info msg="Downloaded crowdsecurity/modsecurity"
level=info msg="Downloaded crowdsecurity/modsecurity"
level=info msg="Downloaded crowdsecurity/modsecurity"
level=info msg="Downloaded crowdsecurity/modsecurity"
level=info msg="Downloaded openappsec/openappsec-logs"
level=info msg="Downloaded openappsec/openappsec-ldap-injection"
level=info msg="Downloaded openappsec/openappsec-path-traversal"
level=info msg="Downloaded openappsec/openappsec-probing"
level=info msg="Downloaded openappsec/openappsec-rce"
level=info msg="Downloaded openappsec/openappsec-sql-injection"
level=info msg="Downloaded openappsec/openappsec-xss"
level=info msg="Downloaded openappsec/openappsec-xxe"
level=info msg="Downloaded openappsec/openappsec-url-instead-of-file"
level=info msg="Downloaded openappsec/openappsec-schema-validation"
level=info msg="Downloaded openappsec/openappsec-request-rate-limit"
level=info msg="Downloaded openappsec/openappsec-open-redirect"
level=info msg="Downloaded openappsec/openappsec-http-method-violation"
level=info msg="Downloaded openappsec/openappsec-http-limit-violation"
level=info msg="Downloaded openappsec/openappsec-general"
level=info msg="Downloaded openappsec/openappsec-evasion-techniques"
level=info msg="Downloaded openappsec/openappsec-error-disclosure"
level=info msg="Downloaded openappsec/openappsec-error-limit"
level=info msg="Downloaded openappsec/openappsec-csrf"
level=info msg="Downloaded openappsec/openappsec-bot-protection"
level=info msg="Downloaded openappsec/openappsec-cross-site-redirect"
level=info msg="Downloaded openappsec/openappsec"
level=info msg="Downloaded openappsec/openappsec"
level=info msg="Downloaded ZoeyVid/npmplus"
level=info msg="/etc/crowdsec/collections/appsec-virtual-patching.yaml already exists."
level=info msg="Enabled collections: crowdsecurity/appsec-virtual-patching"
level=info msg="/etc/crowdsec/collections/appsec-generic-rules.yaml already exists."
level=info msg="Enabled collections: crowdsecurity/appsec-generic-rules"
level=info msg="/etc/crowdsec/collections/http-cve.yaml already exists."
level=info msg="Enabled collections: crowdsecurity/http-cve"
level=info msg="/etc/crowdsec/collections/base-http-scenarios.yaml already exists."
level=info msg="Enabled collections: crowdsecurity/base-http-scenarios"
level=info msg="/etc/crowdsec/collections/modsecurity.yaml already exists."
level=info msg="Enabled collections: crowdsecurity/modsecurity"
level=info msg="/etc/crowdsec/collections/openappsec.yaml already exists."
level=info msg="Enabled collections: openappsec/openappsec"
level=info msg="/etc/crowdsec/collections/npmplus.yaml already exists."
level=info msg="Enabled collections: ZoeyVid/npmplus"
level=info msg="Enabled ZoeyVid/npmplus"
level=info msg="Run 'sudo systemctl reload crowdsec' for the new configuration to be effective."
time="2025-01-29T14:23:31+01:00" level=info msg="Enabled feature flags: <none>"
time="2025-01-29T14:23:31+01:00" level=info msg="Crowdsec v1.6.4-523164f6"
time="2025-01-29T14:23:31+01:00" level=info msg="Loading prometheus collectors"
time="2025-01-29T14:23:31+01:00" level=info msg="Loading CAPI manager"
time="2025-01-29T14:23:32+01:00" level=info msg="CAPI manager configured successfully"
time="2025-01-29T14:23:32+01:00" level=info msg="Start sending metrics to CrowdSec Central API (interval: 19m37s once, then 30m0s)"
time="2025-01-29T14:23:32+01:00" level=info msg="Start push to CrowdSec Central API (interval: 11s once, then 10s)"
time="2025-01-29T14:23:32+01:00" level=info msg="CrowdSec Local API listening on 127.0.0.1:8080"
time="2025-01-29T14:23:32+01:00" level=info msg="capi metrics: sending"
time="2025-01-29T14:23:32+01:00" level=info msg="last CAPI pull is newer than 1h30, skip."
time="2025-01-29T14:23:32+01:00" level=info msg="Start pull from CrowdSec Central API (interval: 2h1m3s once, then 2h0m0s)"
time="2025-01-29T14:23:32+01:00" level=info msg="Loading grok library /etc/crowdsec/patterns"
time="2025-01-29T14:23:33+01:00" level=info msg="Loading enrich plugins"
time="2025-01-29T14:23:33+01:00" level=info msg="Successfully registered enricher 'GeoIpCity'"
time="2025-01-29T14:23:33+01:00" level=info msg="Successfully registered enricher 'GeoIpASN'"
time="2025-01-29T14:23:33+01:00" level=info msg="Successfully registered enricher 'IpToRange'"
time="2025-01-29T14:23:33+01:00" level=info msg="Successfully registered enricher 'reverse_dns'"
time="2025-01-29T14:23:33+01:00" level=info msg="Successfully registered enricher 'ParseDate'"
time="2025-01-29T14:23:33+01:00" level=info msg="Successfully registered enricher 'UnmarshalJSON'"
time="2025-01-29T14:23:33+01:00" level=info msg="Loading parsers from 12 files"
time="2025-01-29T14:23:33+01:00" level=info msg="Loaded 1 parser nodes" file=/etc/crowdsec/parsers/s00-raw/cri-logs.yaml stage=s00-raw
time="2025-01-29T14:23:33+01:00" level=info msg="Loaded 1 parser nodes" file=/etc/crowdsec/parsers/s00-raw/docker-logs.yaml stage=s00-raw
time="2025-01-29T14:23:33+01:00" level=info msg="Loaded 2 parser nodes" file=/etc/crowdsec/parsers/s00-raw/syslog-logs.yaml stage=s00-raw
time="2025-01-29T14:23:33+01:00" level=info msg="Loaded 1 parser nodes" file=/etc/crowdsec/parsers/s01-parse/appsec-logs.yaml stage=s01-parse
time="2025-01-29T14:23:33+01:00" level=info msg="Loaded 1 parser nodes" file=/etc/crowdsec/parsers/s01-parse/modsecurity.yaml stage=s01-parse
time="2025-01-29T14:23:33+01:00" level=info msg="Loaded 1 parser nodes" file=/etc/crowdsec/parsers/s01-parse/npmplus-logs.yaml stage=s01-parse
time="2025-01-29T14:23:33+01:00" level=info msg="Loaded 1 parser nodes" file=/etc/crowdsec/parsers/s01-parse/openappsec-logs.yaml stage=s01-parse
time="2025-01-29T14:23:33+01:00" level=info msg="Loaded 1 parser nodes" file=/etc/crowdsec/parsers/s01-parse/sshd-logs.yaml stage=s01-parse
time="2025-01-29T14:23:33+01:00" level=info msg="Loaded 1 parser nodes" file=/etc/crowdsec/parsers/s02-enrich/dateparse-enrich.yaml stage=s02-enrich
time="2025-01-29T14:23:33+01:00" level=info msg="Loaded 1 parser nodes" file=/etc/crowdsec/parsers/s02-enrich/geoip-enrich.yaml stage=s02-enrich
time="2025-01-29T14:23:33+01:00" level=info msg="Loaded 1 parser nodes" file=/etc/crowdsec/parsers/s02-enrich/http-logs.yaml stage=s02-enrich
time="2025-01-29T14:23:33+01:00" level=info msg="Loaded 1 parser nodes" file=/etc/crowdsec/parsers/s02-enrich/whitelists.yaml stage=s02-enrich
time="2025-01-29T14:23:33+01:00" level=info msg="Loaded 13 nodes from 3 stages"
time="2025-01-29T14:23:33+01:00" level=info msg="No postoverflow parsers to load"
time="2025-01-29T14:23:33+01:00" level=info msg="Loading 70 scenario files"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding trigger bucket" cfg=throbbing-leaf name=openappsec/openappsec-url-instead-of-file
time="2025-01-29T14:23:33+01:00" level=info msg="Adding trigger bucket" cfg=dry-sun name=openappsec/openappsec-http-limit-violation
time="2025-01-29T14:23:33+01:00" level=info msg="Adding leaky bucket" cfg=old-paper name=crowdsecurity/http-sensitive-files
time="2025-01-29T14:23:33+01:00" level=info msg="Adding leaky bucket" cfg=dry-forest name=crowdsecurity/http-cve-probing
time="2025-01-29T14:23:33+01:00" level=info msg="Adding trigger bucket" cfg=spring-smoke name=crowdsecurity/netgear_rce
time="2025-01-29T14:23:33+01:00" level=info msg="Adding trigger bucket" cfg=fragrant-brook name=crowdsecurity/vmware-vcenter-vmsa-2021-0027
time="2025-01-29T14:23:33+01:00" level=info msg="Adding trigger bucket" cfg=empty-water name=openappsec/openappsec-sql-injection
time="2025-01-29T14:23:33+01:00" level=info msg="Adding trigger bucket" cfg=silent-star name=crowdsecurity/CVE-2022-26134
time="2025-01-29T14:23:33+01:00" level=info msg="Adding trigger bucket" cfg=small-paper name=openappsec/openappsec-evasion-techniques
time="2025-01-29T14:23:33+01:00" level=info msg="Adding trigger bucket" cfg=winter-feather name=openappsec/openappsec-general
time="2025-01-29T14:23:33+01:00" level=info msg="Adding trigger bucket" cfg=delicate-surf name=crowdsecurity/CVE-2022-41082
time="2025-01-29T14:23:33+01:00" level=info msg="Adding trigger bucket" cfg=rough-forest name=crowdsecurity/fortinet-cve-2022-40684
time="2025-01-29T14:23:33+01:00" level=info msg="Adding trigger bucket" cfg=icy-dream name=crowdsecurity/CVE-2022-35914
time="2025-01-29T14:23:33+01:00" level=info msg="Adding trigger bucket" cfg=spring-lake name=openappsec/openappsec-error-limit
time="2025-01-29T14:23:33+01:00" level=info msg="Adding leaky bucket" cfg=twilight-dust name=crowdsecurity/CVE-2022-46169-bf
time="2025-01-29T14:23:33+01:00" level=info msg="Adding trigger bucket" cfg=frosty-cherry name=crowdsecurity/CVE-2022-46169-cmd
time="2025-01-29T14:23:33+01:00" level=info msg="Adding leaky bucket" cfg=cool-flower name=crowdsecurity/http-wordpress-scan
time="2025-01-29T14:23:33+01:00" level=info msg="Adding trigger bucket" cfg=empty-bush name=crowdsecurity/thinkphp-cve-2018-20062
time="2025-01-29T14:23:33+01:00" level=info msg="Adding trigger bucket" cfg=dawn-mountain name=crowdsecurity/CVE-2019-18935
time="2025-01-29T14:23:33+01:00" level=info msg="Adding trigger bucket" cfg=lingering-wood name=crowdsecurity/CVE-2022-42889
time="2025-01-29T14:23:33+01:00" level=info msg="Adding leaky bucket" cfg=holy-hill name=crowdsecurity/nginx-req-limit-exceeded
time="2025-01-29T14:23:33+01:00" level=info msg="Adding trigger bucket" cfg=young-surf name=openappsec/openappsec-ldap-injection
time="2025-01-29T14:23:33+01:00" level=info msg="Adding leaky bucket" cfg=twilight-morning name=crowdsecurity/appsec-vpatch
time="2025-01-29T14:23:33+01:00" level=info msg="Adding trigger bucket" cfg=floral-snowflake name=openappsec/openappsec-csrf
time="2025-01-29T14:23:33+01:00" level=info msg="Adding trigger bucket" cfg=long-resonance name=openappsec/openappsec-path-traversal
time="2025-01-29T14:23:33+01:00" level=info msg="Adding trigger bucket" cfg=twilight-shadow name=crowdsecurity/CVE-2023-49103
time="2025-01-29T14:23:33+01:00" level=info msg="Adding trigger bucket" cfg=nameless-wood name=crowdsecurity/grafana-cve-2021-43798
time="2025-01-29T14:23:33+01:00" level=info msg="Adding leaky bucket" cfg=dawn-frost name=crowdsecurity/ssh-bf
time="2025-01-29T14:23:33+01:00" level=info msg="Adding leaky bucket" cfg=winter-hill name=crowdsecurity/ssh-bf_user-enum
time="2025-01-29T14:23:33+01:00" level=info msg="Adding trigger bucket" cfg=dry-sun name=crowdsecurity/apache_log4j2_cve-2021-44228
time="2025-01-29T14:23:33+01:00" level=info msg="Adding trigger bucket" cfg=bold-leaf name=openappsec/openappsec-error-disclosure
time="2025-01-29T14:23:33+01:00" level=info msg="Adding trigger bucket" cfg=weathered-snowflake name=openappsec/openappsec-xxe
time="2025-01-29T14:23:33+01:00" level=info msg="Adding leaky bucket" cfg=red-cloud name=crowdsecurity/ssh-cve-2024-6387
time="2025-01-29T14:23:33+01:00" level=info msg="Adding leaky bucket" cfg=delicate-sun name=crowdsecurity/http-bad-user-agent
time="2025-01-29T14:23:33+01:00" level=info msg="Adding leaky bucket" cfg=cold-water name=crowdsecurity/http-path-traversal-probing
time="2025-01-29T14:23:33+01:00" level=info msg="Adding trigger bucket" cfg=shy-cherry name=openappsec/openappsec-rce
time="2025-01-29T14:23:33+01:00" level=info msg="Adding trigger bucket" cfg=icy-dew name=openappsec/openappsec-xss
time="2025-01-29T14:23:33+01:00" level=info msg="Adding leaky bucket" cfg=sparkling-haze name=crowdsecurity/http-xss-probbing
time="2025-01-29T14:23:33+01:00" level=info msg="Adding trigger bucket" cfg=billowing-paper name=crowdsecurity/CVE-2024-0012
time="2025-01-29T14:23:33+01:00" level=info msg="Adding trigger bucket" cfg=patient-butterfly name=ltsich/http-w00tw00t
time="2025-01-29T14:23:33+01:00" level=info msg="Adding leaky bucket" cfg=quiet-waterfall name=crowdsecurity/http-admin-interface-probing
time="2025-01-29T14:23:33+01:00" level=info msg="Adding trigger bucket" cfg=summer-breeze name=crowdsecurity/CVE-2024-9474
time="2025-01-29T14:23:33+01:00" level=info msg="Adding leaky bucket" cfg=morning-brook name=crowdsecurity/http-generic-bf
time="2025-01-29T14:23:33+01:00" level=info msg="Adding leaky bucket" cfg=spring-shadow name=LePresidente/http-generic-401-bf
time="2025-01-29T14:23:33+01:00" level=info msg="Adding leaky bucket" cfg=withered-night name=LePresidente/http-generic-403-bf
time="2025-01-29T14:23:33+01:00" level=info msg="Adding trigger bucket" cfg=solitary-field name=crowdsecurity/CVE-2022-37042
time="2025-01-29T14:23:33+01:00" level=info msg="Adding leaky bucket" cfg=billowing-snow name=crowdsecurity/http-crawl-non_statics
time="2025-01-29T14:23:33+01:00" level=info msg="Adding trigger bucket" cfg=proud-bird name=openappsec/openappsec-open-redirect
time="2025-01-29T14:23:33+01:00" level=info msg="Adding trigger bucket" cfg=bitter-violet name=openappsec/openappsec-request-rate-limit
time="2025-01-29T14:23:33+01:00" level=info msg="Adding trigger bucket" cfg=spring-shape name=openappsec/openappsec-bot-protection
time="2025-01-29T14:23:33+01:00" level=info msg="Adding leaky bucket" cfg=falling-sky name=crowdsecurity/CVE-2024-38475
time="2025-01-29T14:23:33+01:00" level=info msg="Adding trigger bucket" cfg=bitter-pond name=crowdsecurity/vmware-cve-2022-22954
time="2025-01-29T14:23:33+01:00" level=info msg="Adding leaky bucket" cfg=divine-hill name=crowdsecurity/http-sqli-probbing-detection
time="2025-01-29T14:23:33+01:00" level=info msg="Adding leaky bucket" cfg=falling-thunder name=crowdsecurity/http-probing
time="2025-01-29T14:23:33+01:00" level=info msg="Adding trigger bucket" cfg=young-surf name=crowdsecurity/pulse-secure-sslvpn-cve-2019-11510
time="2025-01-29T14:23:33+01:00" level=info msg="Adding trigger bucket" cfg=dark-dawn name=crowdsecurity/CVE-2017-9841
time="2025-01-29T14:23:33+01:00" level=info msg="Adding trigger bucket" cfg=green-moon name=crowdsecurity/fortinet-cve-2018-13379
time="2025-01-29T14:23:33+01:00" level=info msg="Adding trigger bucket" cfg=spring-sun name=crowdsecurity/spring4shell_cve-2022-22965
time="2025-01-29T14:23:33+01:00" level=info msg="Adding trigger bucket" cfg=morning-wind name=openappsec/openappsec-cross-site-redirect
time="2025-01-29T14:23:33+01:00" level=info msg="Adding trigger bucket" cfg=white-thunder name=crowdsecurity/http-open-proxy
time="2025-01-29T14:23:33+01:00" level=info msg="Adding trigger bucket" cfg=blue-fire name=crowdsecurity/CVE-2023-22515
time="2025-01-29T14:23:33+01:00" level=info msg="Adding trigger bucket" cfg=summer-resonance name=crowdsecurity/f5-big-ip-cve-2020-5902
time="2025-01-29T14:23:33+01:00" level=info msg="Adding trigger bucket" cfg=young-cloud name=openappsec/openappsec-schema-validation
time="2025-01-29T14:23:33+01:00" level=info msg="Adding leaky bucket" cfg=morning-paper name=crowdsecurity/CVE-2022-41697
time="2025-01-29T14:23:33+01:00" level=info msg="Adding trigger bucket" cfg=hidden-surf name=crowdsecurity/jira_cve-2021-26086
time="2025-01-29T14:23:33+01:00" level=info msg="Adding trigger bucket" cfg=autumn-brook name=openappsec/openappsec-http-method-violation
time="2025-01-29T14:23:33+01:00" level=info msg="Adding trigger bucket" cfg=late-sound name=crowdsecurity/CVE-2023-22518
time="2025-01-29T14:23:33+01:00" level=info msg="Adding trigger bucket" cfg=cold-flower name=crowdsecurity/modsecurity
time="2025-01-29T14:23:33+01:00" level=info msg="Adding leaky bucket" cfg=frosty-mountain name=crowdsecurity/http-backdoors-attempts
time="2025-01-29T14:23:33+01:00" level=info msg="Adding trigger bucket" cfg=winter-river name=crowdsecurity/http-cve-2021-42013
time="2025-01-29T14:23:33+01:00" level=info msg="Adding leaky bucket" cfg=crimson-brook name=crowdsecurity/ssh-slow-bf
time="2025-01-29T14:23:33+01:00" level=info msg="Adding leaky bucket" cfg=restless-dew name=crowdsecurity/ssh-slow-bf_user-enum
time="2025-01-29T14:23:33+01:00" level=info msg="Adding trigger bucket" cfg=empty-leaf name=openappsec/openappsec-probing
time="2025-01-29T14:23:33+01:00" level=info msg="Adding trigger bucket" cfg=muddy-silence name=crowdsecurity/http-cve-2021-41773
time="2025-01-29T14:23:33+01:00" level=info msg="Adding trigger bucket" cfg=old-surf name=crowdsecurity/CVE-2022-44877
time="2025-01-29T14:23:33+01:00" level=info msg="Loaded 75 scenarios"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2023-46805 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2023-50164 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-27956 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2018-20062 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2023-34362 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-0012 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-27954 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-34102 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-41713 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2022-22965 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2022-41082 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2023-20198 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-29849 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-9465 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/generic-wordpress-uploads-php to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2022-27926 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2023-24489 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2023-33617 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2023-47218 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-32113 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2021-22941 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-laravel-debug-mode to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2019-1003030 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2020-17496 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2022-22954 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2023-22527 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-3273 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2018-1000861 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2022-46169 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2023-28121 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2023-40044 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-28987 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-3272 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-51378 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-52301 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/base-config to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2023-22515 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-29824 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-29973 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-4577 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-7593 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2020-5902 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-9474 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-symfony-profiler to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-8963 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2019-18935 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2023-23752 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2023-3519 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-27348 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-28255 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-8190 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2018-13379 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2017-9841 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2019-12989 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2022-26134 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-1212 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-38816 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-51567 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/generic-freemarker-ssti to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2023-42793 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-22024 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-connectwise-auth-bypass to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2023-49070 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-38856 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2023-38205 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2021-26086 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2023-35078 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-git-config to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-27198 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2020-11738 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2022-44877 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-env-access to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2018-10562 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2022-35914 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2023-1389 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2023-7028 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2021-3129 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2023-35082 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2023-6553 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-23897 to appsec rules"
time="2025-01-29T14:23:33+01:00" level=info msg="loading acquisition file : /etc/crowdsec/acquis.yaml"
time="2025-01-29T14:23:33+01:00" level=warning msg="No matching files for pattern /var/log/nginx/*.log" type=file
time="2025-01-29T14:23:33+01:00" level=warning msg="No matching files for pattern ./tests/nginx/nginx.log" type=file
time="2025-01-29T14:23:33+01:00" level=warning msg="No matching files for pattern /var/log/auth.log" type=file
time="2025-01-29T14:23:33+01:00" level=warning msg="No matching files for pattern /var/log/syslog" type=file
time="2025-01-29T14:23:33+01:00" level=warning msg="No matching files for pattern /var/log/apache2/*.log" type=file
time="2025-01-29T14:23:33+01:00" level=info msg="loading acquisition file : /etc/crowdsec/acquis.d/npmplus.yaml"
time="2025-01-29T14:23:33+01:00" level=info msg="Adding file /opt/npmplus/nginx/access.log to datasources" type=file
time="2025-01-29T14:23:33+01:00" level=info msg="Cache duration for auth not set, using default: 1m0s" name=appsec type=appsec
time="2025-01-29T14:23:33+01:00" level=info msg="loading /etc/crowdsec/appsec-configs/appsec-default.yaml" component=appsec_config name=appsec type=appsec
time="2025-01-29T14:23:33+01:00" level=info msg="Loaded 0 outofband rules" component=appsec_config name=appsec type=appsec
time="2025-01-29T14:23:33+01:00" level=info msg="loading inband rule crowdsecurity/base-config" component=appsec_config name=appsec type=appsec
time="2025-01-29T14:23:33+01:00" level=info msg="loading inband rule crowdsecurity/vpatch-*" component=appsec_config name=appsec type=appsec
time="2025-01-29T14:23:33+01:00" level=info msg="loading inband rule crowdsecurity/generic-*" component=appsec_config name=appsec type=appsec
time="2025-01-29T14:23:33+01:00" level=info msg="Loaded 80 inband rules" component=appsec_config name=appsec type=appsec
time="2025-01-29T14:23:33+01:00" level=info msg="Created 1 appsec runners" name=appsec type=appsec
time="2025-01-29T14:23:33+01:00" level=info msg="127.0.0.1 - [Wed, 29 Jan 2025 14:23:33 CET] \"POST /v1/watchers/login HTTP/1.1 200 83.024047ms \"crowdsec/v1.6.4-523164f6-docker\" \""
time="2025-01-29T14:23:33+01:00" level=info msg="Starting processing data"
time="2025-01-29T14:23:33+01:00" level=info msg="1 appsec runner to start" name=appsec type=appsec
time="2025-01-29T14:23:33+01:00" level=info msg="creating TCP server on 0.0.0.0:7422" name=appsec type=appsec
time="2025-01-29T14:23:33+01:00" level=info msg="Starting docker acquisition" type=docker
time="2025-01-29T14:23:33+01:00" level=info msg="Container watcher started, interval: 1s" type=docker
time="2025-01-29T14:23:33+01:00" level=info msg="DockerSource Manager started" type=docker
time="2025-01-29T14:23:33+01:00" level=info msg="Starting docker acquisition" type=docker
time="2025-01-29T14:23:33+01:00" level=info msg="Container watcher started, interval: 1s" type=docker
time="2025-01-29T14:23:33+01:00" level=info msg="DockerSource Manager started" type=docker
time="2025-01-29T14:23:33+01:00" level=info msg="Appsec Runner ready to process event" name=appsec runner_uuid=3e0bafeb-8903-445b-a759-1ab3f3e8ff70 type=appsec
time="2025-01-29T14:23:33+01:00" level=info msg="127.0.0.1 - [Wed, 29 Jan 2025 14:23:33 CET] \"POST /v1/usage-metrics HTTP/1.1 201 15.517088ms \"crowdsec/v1.6.4-523164f6-docker\" \""
time="2025-01-29T14:23:34+01:00" level=info msg="127.0.0.1 - [Wed, 29 Jan 2025 14:23:34 CET] \"HEAD /v1/decisions/stream HTTP/1.1 200 353.287µs \"Go-http-client/1.1\" \""
time="2025-01-29T14:23:34+01:00" level=info msg="start tail for container npmplus" container_name=npmplus type=docker
time="2025-01-29T14:23:34+01:00" level=info msg="start tail for container npmplus" container_name=npmplus type=docker
time="2025-01-29T14:24:33+01:00" level=info msg="127.0.0.1 - [Wed, 29 Jan 2025 14:24:33 CET] \"GET /v1/heartbeat HTTP/1.1 200 12.370633ms \"crowdsec/v1.6.4-523164f6-docker\" \""
time="2025-01-29T14:24:35+01:00" level=info msg="127.0.0.1 - [Wed, 29 Jan 2025 14:24:35 CET] \"HEAD /v1/decisions/stream HTTP/1.1 200 240.426µs \"Go-http-client/1.1\" \""
time="2025-01-29T14:25:33+01:00" level=info msg="127.0.0.1 - [Wed, 29 Jan 2025 14:25:33 CET] \"GET /v1/heartbeat HTTP/1.1 200 12.199077ms \"crowdsec/v1.6.4-523164f6-docker\" \""
time="2025-01-29T14:25:35+01:00" level=info msg="127.0.0.1 - [Wed, 29 Jan 2025 14:25:35 CET] \"HEAD /v1/decisions/stream HTTP/1.1 200 299.337µs \"Go-http-client/1.1\" \""
time="2025-01-29T14:26:33+01:00" level=info msg="127.0.0.1 - [Wed, 29 Jan 2025 14:26:33 CET] \"GET /v1/heartbeat HTTP/1.1 200 12.10513ms \"crowdsec/v1.6.4-523164f6-docker\" \""
time="2025-01-29T14:26:36+01:00" level=info msg="127.0.0.1 - [Wed, 29 Jan 2025 14:26:36 CET] \"HEAD /v1/decisions/stream HTTP/1.1 200 263.117µs \"Go-http-client/1.1\" \""
time="2025-01-29T14:27:33+01:00" level=info msg="127.0.0.1 - [Wed, 29 Jan 2025 14:27:33 CET] \"GET /v1/heartbeat HTTP/1.1 200 12.490768ms \"crowdsec/v1.6.4-523164f6-docker\" \""
time="2025-01-29T14:27:36+01:00" level=info msg="127.0.0.1 - [Wed, 29 Jan 2025 14:27:36 CET] \"HEAD /v1/decisions/stream HTTP/1.1 200 248.419µs \"Go-http-client/1.1\" \""
time="2025-01-29T14:28:33+01:00" level=info msg="127.0.0.1 - [Wed, 29 Jan 2025 14:28:33 CET] \"GET /v1/heartbeat HTTP/1.1 200 12.016084ms \"crowdsec/v1.6.4-523164f6-docker\" \""
time="2025-01-29T14:28:38+01:00" level=info msg="127.0.0.1 - [Wed, 29 Jan 2025 14:28:38 CET] \"HEAD /v1/decisions/stream HTTP/1.1 200 246.961µs \"Go-http-client/1.1\" \""
time="2025-01-29T14:29:33+01:00" level=info msg="127.0.0.1 - [Wed, 29 Jan 2025 14:29:33 CET] \"GET /v1/heartbeat HTTP/1.1 200 3.354836ms \"crowdsec/v1.6.4-523164f6-docker\" \""
time="2025-01-29T14:29:38+01:00" level=info msg="127.0.0.1 - [Wed, 29 Jan 2025 14:29:38 CET] \"HEAD /v1/decisions/stream HTTP/1.1 200 235.227µs \"Go-http-client/1.1\" \""
time="2025-01-29T14:30:33+01:00" level=info msg="127.0.0.1 - [Wed, 29 Jan 2025 14:30:33 CET] \"GET /v1/heartbeat HTTP/1.1 200 12.19865ms \"crowdsec/v1.6.4-523164f6-docker\" \""
time="2025-01-29T14:30:39+01:00" level=info msg="127.0.0.1 - [Wed, 29 Jan 2025 14:30:39 CET] \"HEAD /v1/decisions/stream HTTP/1.1 200 249.238µs \"Go-http-client/1.1\" \""
time="2025-01-29T14:31:33+01:00" level=info msg="127.0.0.1 - [Wed, 29 Jan 2025 14:31:33 CET] \"GET /v1/heartbeat HTTP/1.1 200 2.648589ms \"crowdsec/v1.6.4-523164f6-docker\" \""
time="2025-01-29T14:31:39+01:00" level=info msg="127.0.0.1 - [Wed, 29 Jan 2025 14:31:39 CET] \"HEAD /v1/decisions/stream HTTP/1.1 200 279.378µs \"Go-http-client/1.1\" \""
time="2025-01-29T14:32:33+01:00" level=info msg="127.0.0.1 - [Wed, 29 Jan 2025 14:32:33 CET] \"GET /v1/heartbeat HTTP/1.1 200 13.440946ms \"crowdsec/v1.6.4-523164f6-docker\" \""
time="2025-01-29T14:32:40+01:00" level=info msg="127.0.0.1 - [Wed, 29 Jan 2025 14:32:40 CET] \"HEAD /v1/decisions/stream HTTP/1.1 200 242.55µs \"Go-http-client/1.1\" \""
time="2025-01-29T14:33:33+01:00" level=info msg="127.0.0.1 - [Wed, 29 Jan 2025 14:33:33 CET] \"GET /v1/heartbeat HTTP/1.1 200 11.660221ms \"crowdsec/v1.6.4-523164f6-docker\" \""
time="2025-01-29T14:33:40+01:00" level=info msg="127.0.0.1 - [Wed, 29 Jan 2025 14:33:40 CET] \"HEAD /v1/decisions/stream HTTP/1.1 200 236.453µs \"Go-http-client/1.1\" \""
time="2025-01-29T14:34:33+01:00" level=info msg="127.0.0.1 - [Wed, 29 Jan 2025 14:34:33 CET] \"GET /v1/heartbeat HTTP/1.1 200 12.270428ms \"crowdsec/v1.6.4-523164f6-docker\" \""
time="2025-01-29T14:34:40+01:00" level=info msg="127.0.0.1 - [Wed, 29 Jan 2025 14:34:40 CET] \"HEAD /v1/decisions/stream HTTP/1.1 200 490.829µs \"Go-http-client/1.1\" \""
time="2025-01-29T14:34:40+01:00" level=info msg="127.0.0.1 - [Wed, 29 Jan 2025 14:34:40 CET] \"HEAD /v1/decisions/stream HTTP/1.1 200 911.535µs \"Go-http-client/1.1\" \""
time="2025-01-29T14:35:33+01:00" level=info msg="127.0.0.1 - [Wed, 29 Jan 2025 14:35:33 CET] \"GET /v1/heartbeat HTTP/1.1 200 11.425964ms \"crowdsec/v1.6.4-523164f6-docker\" \""
time="2025-01-29T14:35:41+01:00" level=info msg="127.0.0.1 - [Wed, 29 Jan 2025 14:35:41 CET] \"HEAD /v1/decisions/stream HTTP/1.1 200 296.891µs \"Go-http-client/1.1\" \""
time="2025-01-29T14:36:33+01:00" level=info msg="127.0.0.1 - [Wed, 29 Jan 2025 14:36:33 CET] \"GET /v1/heartbeat HTTP/1.1 200 11.769037ms \"crowdsec/v1.6.4-523164f6-docker\" \""
time="2025-01-29T14:36:42+01:00" level=info msg="127.0.0.1 - [Wed, 29 Jan 2025 14:36:42 CET] \"HEAD /v1/decisions/stream HTTP/1.1 200 311.372µs \"Go-http-client/1.1\" \""
time="2025-01-29T14:37:17+01:00" level=info msg="127.0.0.1 - [Wed, 29 Jan 2025 14:37:17 CET] \"POST /v1/watchers/login HTTP/1.1 200 83.007921ms \"crowdsec/v1.6.4-523164f6-docker\" \""
time="2025-01-29T14:37:33+01:00" level=info msg="127.0.0.1 - [Wed, 29 Jan 2025 14:37:33 CET] \"GET /v1/heartbeat HTTP/1.1 200 11.301489ms \"crowdsec/v1.6.4-523164f6-docker\" \""
time="2025-01-29T14:37:42+01:00" level=info msg="127.0.0.1 - [Wed, 29 Jan 2025 14:37:42 CET] \"HEAD /v1/decisions/stream HTTP/1.1 200 290.113µs \"Go-http-client/1.1\" \""
time="2025-01-29T14:38:33+01:00" level=info msg="127.0.0.1 - [Wed, 29 Jan 2025 14:38:33 CET] \"GET /v1/heartbeat HTTP/1.1 200 11.901248ms \"crowdsec/v1.6.4-523164f6-docker\" \""
time="2025-01-29T14:38:42+01:00" level=info msg="127.0.0.1 - [Wed, 29 Jan 2025 14:38:42 CET] \"HEAD /v1/decisions/stream HTTP/1.1 200 249.401µs \"Go-http-client/1.1\" \""
time="2025-01-29T14:39:33+01:00" level=info msg="127.0.0.1 - [Wed, 29 Jan 2025 14:39:33 CET] \"GET /v1/heartbeat HTTP/1.1 200 11.818197ms \"crowdsec/v1.6.4-523164f6-docker\" \""
time="2025-01-29T14:39:42+01:00" level=info msg="127.0.0.1 - [Wed, 29 Jan 2025 14:39:42 CET] \"HEAD /v1/decisions/stream HTTP/1.1 200 255.343µs \"Go-http-client/1.1\" \""
time="2025-01-29T14:40:33+01:00" level=info msg="127.0.0.1 - [Wed, 29 Jan 2025 14:40:33 CET] \"GET /v1/heartbeat HTTP/1.1 200 2.416099ms \"crowdsec/v1.6.4-523164f6-docker\" \""
time="2025-01-29T14:40:43+01:00" level=info msg="127.0.0.1 - [Wed, 29 Jan 2025 14:40:43 CET] \"HEAD /v1/decisions/stream HTTP/1.1 200 240.056µs \"Go-http-client/1.1\" \""
time="2025-01-29T14:41:33+01:00" level=info msg="127.0.0.1 - [Wed, 29 Jan 2025 14:41:33 CET] \"GET /v1/heartbeat HTTP/1.1 200 13.483953ms \"crowdsec/v1.6.4-523164f6-docker\" \""
time="2025-01-29T14:41:43+01:00" level=info msg="127.0.0.1 - [Wed, 29 Jan 2025 14:41:43 CET] \"HEAD /v1/decisions/stream HTTP/1.1 200 270.602µs \"Go-http-client/1.1\" \""
time="2025-01-29T14:42:33+01:00" level=info msg="127.0.0.1 - [Wed, 29 Jan 2025 14:42:33 CET] \"GET /v1/heartbeat HTTP/1.1 200 11.663057ms \"crowdsec/v1.6.4-523164f6-docker\" \""
time="2025-01-29T14:42:43+01:00" level=info msg="127.0.0.1 - [Wed, 29 Jan 2025 14:42:43 CET] \"HEAD /v1/decisions/stream HTTP/1.1 200 244.867µs \"Go-http-client/1.1\" \""
time="2025-01-29T14:42:43+01:00" level=info msg="127.0.0.1 - [Wed, 29 Jan 2025 14:42:43 CET] \"HEAD /v1/decisions/stream HTTP/1.1 200 560.221µs \"Go-http-client/1.1\" \""
time="2025-01-29T14:43:09+01:00" level=info msg="capi metrics: sending"
time="2025-01-29T14:43:33+01:00" level=info msg="127.0.0.1 - [Wed, 29 Jan 2025 14:43:33 CET] \"GET /v1/heartbeat HTTP/1.1 200 12.969288ms \"crowdsec/v1.6.4-523164f6-docker\" \""
time="2025-01-29T14:43:43+01:00" level=info msg="127.0.0.1 - [Wed, 29 Jan 2025 14:43:43 CET] \"HEAD /v1/decisions/stream HTTP/1.1 200 252.009µs \"Go-http-client/1.1\" \""

1 reply

Zoey2936 Jan 29, 2025
Maintainer

interesting no npmplus listed at all, please also send your crowdsec.conf file from the npmplus data folder (but remove the api key) Thanks!

DJKatastrof · 2025-01-29T13:50:17Z

DJKatastrof
Jan 29, 2025
Author

ENABLED=true
API_URL=http://127.0.0.1:8080
API_KEY=Redacted
CACHE_EXPIRATION=1
# bounce for all type of remediation that the bouncer can receive from the local API
BOUNCING_ON_TYPE=all
FALLBACK_REMEDIATION=ban
REQUEST_TIMEOUT=2500
UPDATE_FREQUENCY=10
# By default internal requests are ignored, such as any path affected by rewrite rule.
# set ENABLE_INTERNAL=true to allow checking on these internal requests.
ENABLE_INTERNAL=false
# live or stream
MODE=live
# exclude the bouncing on those location
EXCLUDE_LOCATION=
#those apply for "ban" action
# /!\ REDIRECT_LOCATION and RET_CODE can't be used together. REDIRECT_LOCATION take priority over RET_CODE
BAN_TEMPLATE_PATH=/data/crowdsec/ban.html
REDIRECT_LOCATION=
RET_CODE=
#those apply for "captcha" action
#valid providers are recaptcha, hcaptcha, turnstile
CAPTCHA_PROVIDER=
# Captcha Secret Key
SECRET_KEY=
# Captcha Site key
SITE_KEY=
CAPTCHA_TEMPLATE_PATH=/data/crowdsec/captcha.html
CAPTCHA_EXPIRATION=3600

APPSEC_URL=http://127.0.0.1:7422
APPSEC_FAILURE_ACTION=deny
APPSEC_CONNECT_TIMEOUT=1000
APPSEC_SEND_TIMEOUT=30000
APPSEC_PROCESS_TIMEOUT=10000
ALWAYS_SEND_TO_APPSEC=false
SSL_VERIFY=true

1 reply

Zoey2936 Jan 29, 2025
Maintainer

also looks good, what does docker exec npmplus curl -vvvvvvvvvvv http://127.0.0.1:8080 return?

DJKatastrof · 2025-01-29T13:54:03Z

DJKatastrof
Jan 29, 2025
Author

Seems good?

14:53:29.175688 [0-x] == Info: [READ] client_reset, clear readers
14:53:29.175808 [0-0] == Info: [SETUP] added
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     014:53:29.176148 [0-0] == Info: [HAPPY-EYEBALLS] created ipv4 (timeout 300000ms)
14:53:29.176271 [0-0] == Info: [HAPPY-EYEBALLS] ipv4 starting (timeout=300000ms)
14:53:29.176462 [0-0] == Info:   Trying 127.0.0.1:8080...
14:53:29.176530 [0-0] == Info: [TCP] cf_socket_open() -> 0, fd=4
14:53:29.176922 [0-0] == Info: [TCP] local address 127.0.0.1 port 49048...
14:53:29.177040 [0-0] == Info: [HAPPY-EYEBALLS] ipv4 connect -> 0, connected=0
14:53:29.177129 [0-0] == Info: [TCP] adjust_pollset, !connected, POLLOUT fd=4
14:53:29.177263 [0-0] == Info: [HAPPY-EYEBALLS] adjust_pollset -> 1 socks
14:53:29.177401 [0-0] == Info: [TCP] connected
14:53:29.177455 [0-0] == Info: [HAPPY-EYEBALLS] ipv4 connect -> 0, connected=1
14:53:29.177548 [0-0] == Info: [HAPPY-EYEBALLS] Connected to 127.0.0.1 (127.0.0.1) port 8080
14:53:29.177660 [0-0] == Info: Connected to 127.0.0.1 (127.0.0.1) port 8080
14:53:29.177752 [0-0] == Info: using HTTP/1.x
14:53:29.177835 [0-0] == Info: [TCP] send(len=78) -> 78, err=0
14:53:29.177920 [0-0] => Send header, 78 bytes (0x4e)
0000: GET / HTTP/1.1
0010: Host: 127.0.0.1:8080
0026: User-Agent: curl/8.11.1
003f: Accept: */*
004c: 
14:53:29.178265 [0-0] == Info: [TCP] recv(len=102400) -> 0, err=0
14:53:29.178479 [0-0] == Info: abort upload
14:53:29.178544 [0-0] == Info: [WRITE] xfer_write_resp(len=0, eos=1) -> 0
14:53:29.178640 [0-0] == Info: [WRITE] cw-out is notpaused
14:53:29.178759 [0-0] == Info: Empty reply from server
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
14:53:29.178913 [0-0] == Info: [WRITE] cw-out done
14:53:29.178975 [0-0] == Info: shutting down connection #0
14:53:29.179039 [0-0] == Info: [SETUP] shut down successfully
14:53:29.179130 [0-0] == Info: [HAPPY-EYEBALLS] shut down successfully
14:53:29.179211 [0-0] == Info: [TCP] cf_socket_shutdown(4)
14:53:29.179311 [0-0] == Info: [TCP] shut down successfully
14:53:29.179380 [0-0] == Info: [SETUP] close
14:53:29.179428 [0-0] == Info: [HAPPY-EYEBALLS] close
14:53:29.179491 [0-0] == Info: [TCP] cf_socket_close(4)
14:53:29.179562 [0-0] == Info: [TCP] destroy
14:53:29.179627 [0-0] == Info: [HAPPY-EYEBALLS] destroy
14:53:29.179693 [0-0] == Info: [SETUP] destroy
curl: (52) Empty reply from server

1 reply

Zoey2936 Jan 29, 2025
Maintainer

it should look like this: (but with a different IP for you, since crowdsec runs on a diffrent server for me)

14:57:29.178773 [0-x] == Info: [READ] client_reset, clear readers
14:57:29.179102 [0-0] == Info: [SETUP] added
14:57:29.179159 [0-0] == Info: [HAPPY-EYEBALLS] created ipv4 (timeout 300000ms)
14:57:29.179308 [0-0] == Info: [HAPPY-EYEBALLS] ipv4 starting (timeout=300000ms)
14:57:29.179458 [0-0] == Info:   Trying 192.168.168.2:8080...
14:57:29.179610 [0-0] == Info: [TCP] cf_socket_open() -> 0, fd=4
14:57:29.179793 [0-0] == Info: [TCP] local address 192.168.168.1 port 45104...
14:57:29.179975 [0-0] == Info: [HAPPY-EYEBALLS] ipv4 connect -> 0, connected=0
14:57:29.180121 [0-0] == Info: [TCP] adjust_pollset, !connected, POLLOUT fd=4
14:57:29.180285 [0-0] == Info: [HAPPY-EYEBALLS] adjust_pollset -> 1 socks
14:57:29.181088 [0-0] == Info: [TCP] connected
14:57:29.181151 [0-0] == Info: [HAPPY-EYEBALLS] ipv4 connect -> 0, connected=1
14:57:29.181247 [0-0] == Info: [HAPPY-EYEBALLS] Connected to 192.168.168.2 (192.168.168.2) port 8080
14:57:29.181428 [0-0] == Info: Connected to 192.168.168.2 (192.168.168.2) port 8080
14:57:29.181563 [0-0] == Info: using HTTP/1.x
14:57:29.181673 [0-0] == Info: [TCP] send(len=82) -> 82, err=0
14:57:29.181814 [0-0] => Send header, 82 bytes (0x52)
0000: GET / HTTP/1.1
0010: Host: 192.168.168.2:8080
002a: User-Agent: curl/8.11.1
0043: Accept: */*
0050: 
14:57:29.182145 [0-0] == Info: [TCP] recv(len=102400) -> -1, err=81
14:57:29.182262 [0-0] == Info: Request completely sent off
14:57:29.182952 [0-0] == Info: [TCP] recv(len=102400) -> 82, err=0
14:57:29.183111 [0-0] <= Recv header, 24 bytes (0x18)
0000: HTTP/1.1 404 Not Found
14:57:29.183285 [0-0] == Info: [WRITE] cw_out, wrote 24 header bytes -> 24
14:57:29.183448 [0-0] == Info: [WRITE] download_write header(type=c, blen=24) -> 0
14:57:29.183587 [0-0] == Info: [WRITE] client_write(type=c, len=24) -> 0
14:57:29.183750 [0-0] <= Recv header, 37 bytes (0x25)
0000: Date: Wed, 29 Jan 2025 13:57:29 GMT
14:57:29.183971 [0-0] == Info: [WRITE] header_collect pushed(type=1, len=37) -> 0
14:57:29.184297 [0-0] == Info: [WRITE] cw_out, wrote 37 header bytes -> 37
14:57:29.184394 [0-0] == Info: [WRITE] download_write header(type=4, blen=37) -> 0
14:57:29.184574 [0-0] == Info: [WRITE] client_write(type=4, len=37) -> 0
14:57:29.184734 [0-0] <= Recv header, 19 bytes (0x13)
0000: Content-Length: 0
14:57:29.184911 [0-0] == Info: [WRITE] header_collect pushed(type=1, len=19) -> 0
14:57:29.185045 [0-0] == Info: [WRITE] cw_out, wrote 19 header bytes -> 19
14:57:29.185166 [0-0] == Info: [WRITE] download_write header(type=4, blen=19) -> 0
14:57:29.185325 [0-0] == Info: [WRITE] client_write(type=4, len=19) -> 0
14:57:29.185479 [0-0] <= Recv header, 2 bytes (0x2)
0000: 
14:57:29.185616 [0-0] == Info: [WRITE] header_collect pushed(type=1, len=2) -> 0
14:57:29.185838 [0-0] == Info: [WRITE] cw_out, wrote 2 header bytes -> 2
14:57:29.186023 [0-0] == Info: [WRITE] download_write header(type=4, blen=2) -> 0
14:57:29.186159 [0-0] == Info: [WRITE] client_write(type=4, len=2) -> 0
14:57:29.186285 [0-0] == Info: [WRITE] xfer_write_resp(len=82, eos=0) -> 0
14:57:29.186398 [0-0] == Info: [WRITE] cw-out is notpaused
14:57:29.186520 [0-0] == Info: [WRITE] cw-out done
14:57:29.186617 [0-0] == Info: [READ] client_reset, clear readers
14:57:29.186742 [0-0] == Info: Connection #0 to host 192.168.168.2 left intact

can you run curl -vvvvvvvvvvv http://127.0.0.1:8080 again, but directly on the host?

DJKatastrof · 2025-01-29T14:02:58Z

DJKatastrof
Jan 29, 2025
Author

yea, im trying to setup a crowdsec lapi server

2 replies

Zoey2936 Jan 29, 2025
Maintainer

I think I found the error:
1.

[...]
    volumes:
      - ./npmplus:/data
[...]
    volumes:
      - ./npmplus/crowdsec/conf:/etc/crowdsec
      - ./npmplus/crowdsec/data:/var/lib/crowdsec/data
      - ./npmplus/nginx:/opt/npmplus/nginx:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro

npmplus creates a folder called crowdsec in the /data folder which can make trubbel, please delete the ./npmplus/crowdsec folder and restart npmplus so it will recreated and you can configure it again. and for the crowdsec container you should change the paths to for example:

    volumes:
      - ./crowdsec/conf:/etc/crowdsec
      - ./crowdsec/data:/var/lib/crowdsec/data
      - ./npmplus/nginx:/opt/npmplus/nginx:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro

in the ./crowdsec/conf/config.yaml file make sure that this options looks like this:

api:
[...]
  server:
[...]
    listen_uri: 0.0.0.0:8080
[...]
    enable: true

Answer selected by Zoey2936

DJKatastrof Jan 29, 2025
Author

I'll try, sec

DJKatastrof · 2025-01-29T14:23:00Z

DJKatastrof
Jan 29, 2025
Author

Cool. My terminal is not blowing up anymore. Thank you! :) Now I can try to setup remote api

4 replies

Zoey2936 Jan 29, 2025
Maintainer

so you want to have multiple crowdsec logs parsers but only on bouncer right? I will mark my last comment as answer

DJKatastrof Jan 29, 2025
Author

Trying to set this up, so I can have one place for redemtion
https://www.crowdsec.net/blog/multi-server-setup

Zoey2936 Jan 29, 2025
Maintainer

I have a similar setup, but please understand that I will not help you with this, if you have problems you should ask here: https://discourse.crowdsec.net/
I can only tell you that you need to create the bouncer credentials at your "main" crowdsec host and expose its port 8080 so that npmplus can access it so API_URL should point to your main crowdsec (with the credentials from that host), but the APPSEC_URL still needs to point to the local bouncer at 127.0.0.1:7422

DJKatastrof Jan 29, 2025
Author

Yea, im almost done now, thanks for the help!!

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Getting wierd random erros from Crowdsec in terminal #1449

{{title}}

Replies: 6 comments 11 replies

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

Select a reply

Getting wierd random erros from Crowdsec in terminal #1449

DJKatastrof Jan 29, 2025

Replies: 6 comments · 11 replies

Zoey2936 Jan 29, 2025 Maintainer

DJKatastrof Jan 29, 2025 Author

Zoey2936 Jan 29, 2025 Maintainer

DJKatastrof Jan 29, 2025 Author

Zoey2936 Jan 29, 2025 Maintainer

DJKatastrof Jan 29, 2025 Author

Zoey2936 Jan 29, 2025 Maintainer

DJKatastrof Jan 29, 2025 Author

Zoey2936 Jan 29, 2025 Maintainer

DJKatastrof Jan 29, 2025 Author

Zoey2936 Jan 29, 2025 Maintainer

DJKatastrof Jan 29, 2025 Author

DJKatastrof Jan 29, 2025 Author

Zoey2936 Jan 29, 2025 Maintainer

DJKatastrof Jan 29, 2025 Author

Zoey2936 Jan 29, 2025 Maintainer

DJKatastrof Jan 29, 2025 Author

DJKatastrof
Jan 29, 2025

Replies: 6 comments 11 replies

Zoey2936
Jan 29, 2025
Maintainer

DJKatastrof Jan 29, 2025
Author

Zoey2936 Jan 29, 2025
Maintainer

DJKatastrof
Jan 29, 2025
Author

Zoey2936 Jan 29, 2025
Maintainer

DJKatastrof
Jan 29, 2025
Author

Zoey2936 Jan 29, 2025
Maintainer

DJKatastrof
Jan 29, 2025
Author

Zoey2936 Jan 29, 2025
Maintainer

DJKatastrof
Jan 29, 2025
Author

Zoey2936 Jan 29, 2025
Maintainer

DJKatastrof Jan 29, 2025
Author

DJKatastrof
Jan 29, 2025
Author

Zoey2936 Jan 29, 2025
Maintainer

DJKatastrof Jan 29, 2025
Author

Zoey2936 Jan 29, 2025
Maintainer

DJKatastrof Jan 29, 2025
Author