Crowdsec "No matching files for pattern" for nginx logs and no crowdsec.conf file. #1516

Judman · 2025-02-12T02:56:42Z

Judman
Feb 12, 2025

Hey so I got NPM plus up and running with just NPM to migrate over from the old baudneo/crowdsec image that never really worked. I am hosting in proxmox inside a container. To test getting crowdsec up I cloned the working npm container and started following the guide for crowdsec.

I know just enough about docker to get myself in trouble and obviously did here by editing the compose yaml in a way that crowdsec cannot handle, but I dont really understand why.

The only changes I made to the stock config are the normally edited env varables and the volume mounts. Again I am pretty sure the volume mounts have broken crowdsec, but I am not sure why. For most of my other contaienrs, I like to mount any data volumes to the same location that has the compose.yaml. This is so I can easily back up those data files, check logs etc etc. Like I said I am not great a docker.

Anyway, below are the logs, right at the end crowdsec complains about no matching files. (probably because I changed the volume mounts)

I also noticed after running the 5. run docker exec crowdsec cscli bouncers add npmplus -o raw and save the output that there was no file at /opt/npmplus/crowdsec/crowdsec.conf so that has me confused as well.

Thanks in advance if anyone is able to help!

Logs hidden here

Local agent already registered
Check if lapi needs to register an additional agent
/etc/crowdsec was found in a volume
Running hub update
Skipping hub update, index file is recent
/var/lib/crowdsec/data was found in a volume
Running hub upgrade
Running: cscli  parsers install "crowdsecurity/docker-logs" 
Nothing to do.
Running: cscli  parsers install "crowdsecurity/cri-logs" 
Nothing to do.
Running: cscli  collections install "ZoeyVid/npmplus" 
Nothing to do.
time="2025-02-11T20:48:53-06:00" level=info msg="Enabled feature flags: none"
time="2025-02-11T20:48:53-06:00" level=info msg="Crowdsec v1.6.5-72b4354b"
time="2025-02-11T20:48:53-06:00" level=info msg="Loading prometheus collectors"
time="2025-02-11T20:48:53-06:00" level=info msg="Loading CAPI manager"
time="2025-02-11T20:48:54-06:00" level=info msg="CAPI manager configured successfully"
time="2025-02-11T20:48:54-06:00" level=info msg="Start push to CrowdSec Central API (interval: 5s once, then 10s)"
time="2025-02-11T20:48:54-06:00" level=info msg="PullCAPI is already running, skipping"
time="2025-02-11T20:48:54-06:00" level=info msg="Start pull from CrowdSec Central API (interval: 1h58m9s once, then 2h0m0s)"
time="2025-02-11T20:48:54-06:00" level=info msg="Start sending metrics to CrowdSec Central API (interval: 37m32s once, then 30m0s)"
time="2025-02-11T20:48:54-06:00" level=info msg="CrowdSec Local API listening on 0.0.0.0:8080"
time="2025-02-11T20:48:54-06:00" level=info msg="capi metrics: sending"
time="2025-02-11T20:48:54-06:00" level=info msg="Loading grok library /etc/crowdsec/patterns"
time="2025-02-11T20:48:56-06:00" level=info msg="Loading enrich plugins"
time="2025-02-11T20:48:56-06:00" level=info msg="Successfully registered enricher 'GeoIpCity'"
time="2025-02-11T20:48:56-06:00" level=info msg="Successfully registered enricher 'GeoIpASN'"
time="2025-02-11T20:48:56-06:00" level=info msg="Successfully registered enricher 'IpToRange'"
time="2025-02-11T20:48:56-06:00" level=info msg="Successfully registered enricher 'reverse_dns'"
time="2025-02-11T20:48:56-06:00" level=info msg="Successfully registered enricher 'ParseDate'"
time="2025-02-11T20:48:56-06:00" level=info msg="Successfully registered enricher 'UnmarshalJSON'"
time="2025-02-11T20:48:56-06:00" level=info msg="Loading parsers from 12 files"
time="2025-02-11T20:48:56-06:00" level=info msg="Loaded 1 parser nodes" file=/etc/crowdsec/parsers/s00-raw/cri-logs.yaml stage=s00-raw
time="2025-02-11T20:48:56-06:00" level=info msg="Loaded 1 parser nodes" file=/etc/crowdsec/parsers/s00-raw/docker-logs.yaml stage=s00-raw
time="2025-02-11T20:48:56-06:00" level=info msg="Loaded 2 parser nodes" file=/etc/crowdsec/parsers/s00-raw/syslog-logs.yaml stage=s00-raw
time="2025-02-11T20:48:56-06:00" level=info msg="Loaded 1 parser nodes" file=/etc/crowdsec/parsers/s01-parse/appsec-logs.yaml stage=s01-parse
time="2025-02-11T20:48:56-06:00" level=info msg="Loaded 1 parser nodes" file=/etc/crowdsec/parsers/s01-parse/modsecurity.yaml stage=s01-parse
time="2025-02-11T20:48:56-06:00" level=info msg="Loaded 1 parser nodes" file=/etc/crowdsec/parsers/s01-parse/npmplus-logs.yaml stage=s01-parse
time="2025-02-11T20:48:56-06:00" level=info msg="Loaded 1 parser nodes" file=/etc/crowdsec/parsers/s01-parse/openappsec-logs.yaml stage=s01-parse
time="2025-02-11T20:48:56-06:00" level=info msg="Loaded 1 parser nodes" file=/etc/crowdsec/parsers/s01-parse/sshd-logs.yaml stage=s01-parse
time="2025-02-11T20:48:56-06:00" level=info msg="Loaded 1 parser nodes" file=/etc/crowdsec/parsers/s02-enrich/dateparse-enrich.yaml stage=s02-enrich
time="2025-02-11T20:48:56-06:00" level=info msg="Loaded 1 parser nodes" file=/etc/crowdsec/parsers/s02-enrich/geoip-enrich.yaml stage=s02-enrich
time="2025-02-11T20:48:56-06:00" level=info msg="Loaded 1 parser nodes" file=/etc/crowdsec/parsers/s02-enrich/http-logs.yaml stage=s02-enrich
time="2025-02-11T20:48:56-06:00" level=info msg="Loaded 1 parser nodes" file=/etc/crowdsec/parsers/s02-enrich/whitelists.yaml stage=s02-enrich
time="2025-02-11T20:48:56-06:00" level=info msg="Loaded 13 nodes from 3 stages"
time="2025-02-11T20:48:56-06:00" level=info msg="No postoverflow parsers to load"
time="2025-02-11T20:48:56-06:00" level=info msg="Loading 70 scenario files"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding leaky bucket" cfg=purple-darkness name=crowdsecurity/http-xss-probbing
time="2025-02-11T20:48:56-06:00" level=info msg="Compiling distinct 'evt.Parsed.http_args'" cfg=purple-darkness name=crowdsecurity/http-xss-probbing
time="2025-02-11T20:48:56-06:00" level=info msg="Adding trigger bucket" cfg=wandering-water name=crowdsecurity/modsecurity
time="2025-02-11T20:48:56-06:00" level=info msg="Adding leaky bucket" cfg=withered-silence name=crowdsecurity/http-crawl-non_statics
time="2025-02-11T20:48:56-06:00" level=info msg="Compiling distinct 'evt.Parsed.file_name'" cfg=withered-silence name=crowdsecurity/http-crawl-non_statics
time="2025-02-11T20:48:56-06:00" level=info msg="Adding leaky bucket" cfg=bold-frog name=crowdsecurity/ssh-bf
time="2025-02-11T20:48:56-06:00" level=info msg="Adding leaky bucket" cfg=icy-shape name=crowdsecurity/ssh-bf_user-enum
time="2025-02-11T20:48:56-06:00" level=info msg="Compiling distinct 'evt.Meta.target_user'" cfg=icy-shape name=crowdsecurity/ssh-bf_user-enum
time="2025-02-11T20:48:56-06:00" level=info msg="Adding trigger bucket" cfg=wild-flower name=crowdsecurity/CVE-2022-41082
time="2025-02-11T20:48:56-06:00" level=info msg="Adding trigger bucket" cfg=broken-field name=crowdsecurity/fortinet-cve-2022-40684
time="2025-02-11T20:48:56-06:00" level=info msg="Adding trigger bucket" cfg=divine-forest name=openappsec/openappsec-probing
time="2025-02-11T20:48:56-06:00" level=info msg="Adding trigger bucket" cfg=wild-lake name=crowdsecurity/http-cve-2021-42013
time="2025-02-11T20:48:56-06:00" level=info msg="Adding trigger bucket" cfg=empty-mountain name=crowdsecurity/CVE-2023-22515
time="2025-02-11T20:48:56-06:00" level=info msg="Adding leaky bucket" cfg=hidden-breeze name=crowdsecurity/http-backdoors-attempts
time="2025-02-11T20:48:56-06:00" level=info msg="Compiling distinct 'evt.Parsed.file_name'" cfg=hidden-breeze name=crowdsecurity/http-backdoors-attempts
time="2025-02-11T20:48:56-06:00" level=info msg="Adding trigger bucket" cfg=snowy-dawn name=crowdsecurity/CVE-2022-26134
time="2025-02-11T20:48:56-06:00" level=info msg="Adding trigger bucket" cfg=silent-frog name=openappsec/openappsec-http-limit-violation
time="2025-02-11T20:48:56-06:00" level=info msg="Adding trigger bucket" cfg=aged-grass name=crowdsecurity/CVE-2023-49103
time="2025-02-11T20:48:56-06:00" level=info msg="Adding leaky bucket" cfg=wispy-pine name=crowdsecurity/nginx-req-limit-exceeded
time="2025-02-11T20:48:56-06:00" level=info msg="Adding leaky bucket" cfg=bitter-shadow name=crowdsecurity/http-generic-bf
time="2025-02-11T20:48:56-06:00" level=info msg="Adding leaky bucket" cfg=delicate-breeze name=LePresidente/http-generic-401-bf
time="2025-02-11T20:48:56-06:00" level=info msg="Adding leaky bucket" cfg=rough-resonance name=LePresidente/http-generic-403-bf
time="2025-02-11T20:48:56-06:00" level=info msg="Adding trigger bucket" cfg=withered-tree name=crowdsecurity/netgear_rce
time="2025-02-11T20:48:56-06:00" level=info msg="Adding leaky bucket" cfg=delicate-sun name=crowdsecurity/http-path-traversal-probing
time="2025-02-11T20:48:56-06:00" level=info msg="Compiling distinct 'evt.Meta.http_path'" cfg=delicate-sun name=crowdsecurity/http-path-traversal-probing
time="2025-02-11T20:48:56-06:00" level=info msg="Adding leaky bucket" cfg=floral-waterfall name=crowdsecurity/http-bad-user-agent
time="2025-02-11T20:48:56-06:00" level=info msg="Adding trigger bucket" cfg=quiet-grass name=openappsec/openappsec-rce
time="2025-02-11T20:48:56-06:00" level=info msg="Adding trigger bucket" cfg=white-bush name=crowdsecurity/CVE-2023-22518
time="2025-02-11T20:48:56-06:00" level=info msg="Adding leaky bucket" cfg=old-dawn name=crowdsecurity/http-probing
time="2025-02-11T20:48:56-06:00" level=info msg="Compiling distinct 'evt.Meta.http_path'" cfg=old-dawn name=crowdsecurity/http-probing
time="2025-02-11T20:48:56-06:00" level=info msg="Adding trigger bucket" cfg=falling-night name=openappsec/openappsec-ldap-injection
time="2025-02-11T20:48:56-06:00" level=info msg="Adding trigger bucket" cfg=autumn-thunder name=crowdsecurity/CVE-2022-44877
time="2025-02-11T20:48:56-06:00" level=info msg="Adding leaky bucket" cfg=damp-pine name=crowdsecurity/ssh-cve-2024-6387
time="2025-02-11T20:48:56-06:00" level=info msg="Adding trigger bucket" cfg=proud-flower name=openappsec/openappsec-request-rate-limit
time="2025-02-11T20:48:56-06:00" level=info msg="Adding trigger bucket" cfg=black-meadow name=crowdsecurity/CVE-2024-9474
time="2025-02-11T20:48:56-06:00" level=info msg="Adding trigger bucket" cfg=late-sun name=openappsec/openappsec-error-disclosure
time="2025-02-11T20:48:56-06:00" level=info msg="Adding trigger bucket" cfg=bitter-tree name=openappsec/openappsec-cross-site-redirect
time="2025-02-11T20:48:56-06:00" level=info msg="Adding trigger bucket" cfg=icy-sun name=crowdsecurity/spring4shell_cve-2022-22965
time="2025-02-11T20:48:56-06:00" level=info msg="Adding trigger bucket" cfg=twilight-dust name=crowdsecurity/CVE-2019-18935
time="2025-02-11T20:48:56-06:00" level=info msg="Adding leaky bucket" cfg=wandering-glade name=crowdsecurity/http-sensitive-files
time="2025-02-11T20:48:56-06:00" level=info msg="Compiling distinct 'evt.Parsed.request'" cfg=wandering-glade name=crowdsecurity/http-sensitive-files
time="2025-02-11T20:48:56-06:00" level=info msg="Adding trigger bucket" cfg=purple-pine name=openappsec/openappsec-error-limit
time="2025-02-11T20:48:56-06:00" level=info msg="Adding leaky bucket" cfg=fragrant-feather name=crowdsecurity/http-wordpress-scan
time="2025-02-11T20:48:56-06:00" level=info msg="Compiling distinct 'evt.Meta.http_path'" cfg=fragrant-feather name=crowdsecurity/http-wordpress-scan
time="2025-02-11T20:48:56-06:00" level=info msg="Adding trigger bucket" cfg=empty-haze name=openappsec/openappsec-bot-protection
time="2025-02-11T20:48:56-06:00" level=info msg="Adding trigger bucket" cfg=shy-thunder name=crowdsecurity/vmware-cve-2022-22954
time="2025-02-11T20:48:56-06:00" level=info msg="Adding trigger bucket" cfg=spring-bird name=openappsec/openappsec-general
time="2025-02-11T20:48:56-06:00" level=info msg="Adding trigger bucket" cfg=late-butterfly name=crowdsecurity/thinkphp-cve-2018-20062
time="2025-02-11T20:48:56-06:00" level=info msg="Adding trigger bucket" cfg=young-water name=openappsec/openappsec-url-instead-of-file
time="2025-02-11T20:48:56-06:00" level=info msg="Adding leaky bucket" cfg=restless-sunset name=crowdsecurity/http-cve-probing
time="2025-02-11T20:48:56-06:00" level=info msg="Compiling distinct 'evt.Meta.http_path'" cfg=restless-sunset name=crowdsecurity/http-cve-probing
time="2025-02-11T20:48:56-06:00" level=info msg="Adding trigger bucket" cfg=spring-grass name=openappsec/openappsec-schema-validation
time="2025-02-11T20:48:56-06:00" level=info msg="Adding trigger bucket" cfg=divine-fog name=openappsec/openappsec-sql-injection
time="2025-02-11T20:48:56-06:00" level=info msg="Adding trigger bucket" cfg=old-wave name=ltsich/http-w00tw00t
time="2025-02-11T20:48:56-06:00" level=info msg="Adding leaky bucket" cfg=wandering-sea name=crowdsecurity/ssh-slow-bf
time="2025-02-11T20:48:56-06:00" level=info msg="Adding leaky bucket" cfg=purple-sunset name=crowdsecurity/ssh-slow-bf_user-enum
time="2025-02-11T20:48:56-06:00" level=info msg="Compiling distinct 'evt.Meta.target_user'" cfg=purple-sunset name=crowdsecurity/ssh-slow-bf_user-enum
time="2025-02-11T20:48:56-06:00" level=info msg="Adding trigger bucket" cfg=divine-tree name=crowdsecurity/jira_cve-2021-26086
time="2025-02-11T20:48:56-06:00" level=info msg="Adding trigger bucket" cfg=snowy-waterfall name=crowdsecurity/grafana-cve-2021-43798
time="2025-02-11T20:48:56-06:00" level=info msg="Adding trigger bucket" cfg=twilight-sun name=openappsec/openappsec-xxe
time="2025-02-11T20:48:56-06:00" level=info msg="Adding trigger bucket" cfg=wispy-pond name=crowdsecurity/f5-big-ip-cve-2020-5902
time="2025-02-11T20:48:56-06:00" level=info msg="Adding trigger bucket" cfg=polished-violet name=openappsec/openappsec-path-traversal
time="2025-02-11T20:48:56-06:00" level=info msg="Adding trigger bucket" cfg=bold-butterfly name=openappsec/openappsec-xss
time="2025-02-11T20:48:56-06:00" level=info msg="Adding trigger bucket" cfg=twilight-sunset name=openappsec/openappsec-csrf
time="2025-02-11T20:48:56-06:00" level=info msg="Adding trigger bucket" cfg=fragrant-violet name=crowdsecurity/CVE-2017-9841
time="2025-02-11T20:48:56-06:00" level=info msg="Adding trigger bucket" cfg=frosty-cloud name=crowdsecurity/apache_log4j2_cve-2021-44228
time="2025-02-11T20:48:56-06:00" level=info msg="Adding leaky bucket" cfg=blue-water name=crowdsecurity/CVE-2024-38475
time="2025-02-11T20:48:56-06:00" level=info msg="Compiling distinct 'evt.Parsed.request'" cfg=blue-water name=crowdsecurity/CVE-2024-38475
time="2025-02-11T20:48:56-06:00" level=info msg="Adding trigger bucket" cfg=dark-bush name=crowdsecurity/CVE-2022-42889
time="2025-02-11T20:48:56-06:00" level=info msg="Adding leaky bucket" cfg=small-resonance name=crowdsecurity/http-admin-interface-probing
time="2025-02-11T20:48:56-06:00" level=info msg="Compiling distinct 'evt.Meta.http_path'" cfg=small-resonance name=crowdsecurity/http-admin-interface-probing
time="2025-02-11T20:48:56-06:00" level=info msg="Adding trigger bucket" cfg=frosty-flower name=crowdsecurity/http-open-proxy
time="2025-02-11T20:48:56-06:00" level=info msg="Adding trigger bucket" cfg=dark-fire name=openappsec/openappsec-evasion-techniques
time="2025-02-11T20:48:56-06:00" level=info msg="Adding trigger bucket" cfg=hidden-sound name=crowdsecurity/CVE-2022-35914
time="2025-02-11T20:48:56-06:00" level=info msg="Adding trigger bucket" cfg=withered-grass name=crowdsecurity/fortinet-cve-2018-13379
time="2025-02-11T20:48:56-06:00" level=info msg="Adding leaky bucket" cfg=wild-mountain name=crowdsecurity/CVE-2022-41697
time="2025-02-11T20:48:56-06:00" level=info msg="Adding trigger bucket" cfg=autumn-darkness name=crowdsecurity/CVE-2024-0012
time="2025-02-11T20:48:56-06:00" level=info msg="Adding trigger bucket" cfg=cold-star name=crowdsecurity/pulse-secure-sslvpn-cve-2019-11510
time="2025-02-11T20:48:56-06:00" level=info msg="Adding trigger bucket" cfg=rough-moon name=openappsec/openappsec-open-redirect
time="2025-02-11T20:48:56-06:00" level=info msg="Adding leaky bucket" cfg=hidden-bush name=crowdsecurity/http-sqli-probbing-detection
time="2025-02-11T20:48:56-06:00" level=info msg="Compiling distinct 'evt.Parsed.http_args'" cfg=hidden-bush name=crowdsecurity/http-sqli-probbing-detection
time="2025-02-11T20:48:56-06:00" level=info msg="Adding trigger bucket" cfg=dry-moon name=openappsec/openappsec-http-method-violation
time="2025-02-11T20:48:56-06:00" level=info msg="Adding trigger bucket" cfg=purple-resonance name=crowdsecurity/CVE-2022-37042
time="2025-02-11T20:48:56-06:00" level=info msg="Adding leaky bucket" cfg=shy-shadow name=crowdsecurity/CVE-2022-46169-bf
time="2025-02-11T20:48:56-06:00" level=info msg="Adding trigger bucket" cfg=divine-wind name=crowdsecurity/CVE-2022-46169-cmd
time="2025-02-11T20:48:56-06:00" level=info msg="Adding trigger bucket" cfg=long-surf name=crowdsecurity/http-cve-2021-41773
time="2025-02-11T20:48:56-06:00" level=info msg="Adding trigger bucket" cfg=crimson-violet name=crowdsecurity/vmware-vcenter-vmsa-2021-0027
time="2025-02-11T20:48:56-06:00" level=info msg="Adding leaky bucket" cfg=cold-water name=crowdsecurity/appsec-vpatch
time="2025-02-11T20:48:56-06:00" level=info msg="Compiling distinct 'evt.Meta.rule_name'" cfg=cold-water name=crowdsecurity/appsec-vpatch
time="2025-02-11T20:48:56-06:00" level=info msg="Loaded 75 scenarios"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2023-33617 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-4577 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2020-17496 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-29973 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-41713 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-laravel-debug-mode to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/generic-freemarker-ssti to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2021-26086 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2023-20198 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2023-35078 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-32113 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-7593 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2018-13379 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2019-1003030 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2023-42793 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2017-9841 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2022-26134 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-3273 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-git-config to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/generic-wordpress-uploads-php to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2023-3519 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-27956 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-38816 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-29824 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-52301 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2022-41082 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2023-28121 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2023-6553 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-0012 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-27954 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2020-11738 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2022-27926 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2022-35914 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2022-44877 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-9465 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/base-config to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-27198 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2019-12989 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2023-46805 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2023-7028 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-28987 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-8190 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-env-access to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2019-18935 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2022-46169 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-3272 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-27348 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-34102 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2018-10562 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2018-20062 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2022-22954 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2023-40044 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2023-49070 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-51378 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-8963 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-9474 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-symfony-profiler to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2018-1000861 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2021-22941 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2023-22527 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2023-47218 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2021-3129 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2023-24489 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-1212 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-6205 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-28255 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-38856 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2023-1389 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2023-35082 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2023-38205 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2023-50164 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-23897 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-51567 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-connectwise-auth-bypass to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-22024 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2024-29849 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2020-5902 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2022-22965 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2023-22515 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2023-23752 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="Adding crowdsecurity/vpatch-CVE-2023-34362 to appsec rules"
time="2025-02-11T20:48:56-06:00" level=info msg="loading acquisition file : /etc/crowdsec/acquis.yaml"
time="2025-02-11T20:48:56-06:00" level=warning msg="No matching files for pattern /var/log/nginx/*.log" type=file
time="2025-02-11T20:48:56-06:00" level=warning msg="No matching files for pattern ./tests/nginx/nginx.log" type=file
time="2025-02-11T20:48:56-06:00" level=warning msg="No matching files for pattern /var/log/auth.log" type=file
time="2025-02-11T20:48:56-06:00" level=warning msg="No matching files for pattern /var/log/syslog" type=file
time="2025-02-11T20:48:56-06:00" level=warning msg="No matching files for pattern /var/log/apache2/*.log" type=file
time="2025-02-11T20:48:56-06:00" level=info msg="loading acquisition file : /etc/crowdsec/acquis.d/npmplus.yaml"
time="2025-02-11T20:48:56-06:00" level=warning msg="No matching files for pattern /opt/npmplus/nginx/access.log" type=file
time="2025-02-11T20:48:56-06:00" level=info msg="127.0.0.1 - [Tue, 11 Feb 2025 20:48:56 CST] \"POST /v1/watchers/login HTTP/1.1 200 121.153515ms \"crowdsec/v1.6.5-72b4354b-docker\" \""
time="2025-02-11T20:48:56-06:00" level=info msg="Starting processing data"
time="2025-02-11T20:48:56-06:00" level=info msg="Starting docker acquisition" type=docker
time="2025-02-11T20:48:56-06:00" level=info msg="Container watcher started, interval: 1s" type=docker
time="2025-02-11T20:48:56-06:00" level=info msg="DockerSource Manager started" type=docker
time="2025-02-11T20:48:56-06:00" level=info msg="Starting docker acquisition" type=docker
time="2025-02-11T20:48:56-06:00" level=info msg="Container watcher started, interval: 1s" type=docker
time="2025-02-11T20:48:56-06:00" level=info msg="DockerSource Manager started" type=docker
time="2025-02-11T20:48:56-06:00" level=info msg="127.0.0.1 - [Tue, 11 Feb 2025 20:48:56 CST] \"POST /v1/usage-metrics HTTP/1.1 201 35.444682ms \"crowdsec/v1.6.5-72b4354b-docker\" \""
time="2025-02-11T20:48:57-06:00" level=info msg="start tail for container npmplus" container_name=npmplus type=docker
time="2025-02-11T20:48:57-06:00" level=info msg="start tail for container npmplus" container_name=npmplus type=docker

compose.yaml

services:
  npmplus:
    container_name: npmplus
    image: docker.io/zoeyvid/npmplus:latest # or ghcr.io/zoeyvid/npmplus:latest
    restart: always
    network_mode: host
    volumes:
      - "./data/npmplus:/data"

    environment:
      - "TZ=America/Chicago" # set timezone, required, set it to one of the values from the "TZ identifier" https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List
      - "[email protected]" # email address which should be used for acme, currently optional, may be required in the future, so I recommend you to enter your email here, optional for letsencrypt, but required for zerossl and google public ca
      - "DISABLE_IPV6=true" # fully disables listing on IPv6 and the IPv6 resolver of nginx, overrides IPV6_BINDING/NPM_IPV6_BINDING/GOA_IPV6_BINDING, default false
      - "LOGROTATE=true" # Enables writing http access logs to /opt/npmplus/nginx/access.log, stream access logs to /opt/npmplus/nginx/stream.log and enables daily logrotation, default false
      - "LOGROTATIONS=7" # Set how often the access.log should be rotated until it is deleted, default 3

# This can be used to enable crowdsec, see README for a guide
  crowdsec:
    container_name: crowdsec
    image: docker.io/crowdsecurity/crowdsec:latest
    restart: always
    network_mode: bridge
    ports:
      - "127.0.0.1:7422:7422"
      - "127.0.0.1:8080:8080"
    environment:
      - "TZ=America/Chicago" # needs to be changed
      - "COLLECTIONS=ZoeyVid/npmplus"
    volumes:
      - "./crowdsec/opt/crowdsec/conf:/etc/crowdsec"
      - "./crowdsec/opt/crowdsec/data:/var/lib/crowdsec/data"
      - "./crowdsec/opt/npmplus/nginx:/opt/npmplus/nginx:ro"
      - "./crowdsec/var/run/docker.sock:/var/run/docker.sock:ro"

./crowdsec/opt/crowdsec/conf/acquis.d$ cat npmplus.yaml

filenames:
  - /opt/npmplus/nginx/access.log
labels:
  type: npmplus
---
source: docker
container_name:
 - npmplus
labels:
  type: npmplus
---
source: docker
container_name:
 - npmplus
labels:
  type: modsecurity

Zoey2936 · 2025-02-12T06:21:13Z

Zoey2936
Feb 12, 2025
Maintainer

you changed the paths, in your case the path would be ./data/npmplus/crowdsec/crowdsec.conf instead of /opt/npmplus/crowdsec/crowdsec.conf
also the mount in crowdsec "./crowdsec/opt/npmplus/nginx:/opt/npmplus/nginx:ro" should be "./data/npmplus/nginx:/opt/npmplus/nginx:ro"

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Crowdsec "No matching files for pattern" for nginx logs and no crowdsec.conf file. #1516

{{title}}

Replies: 1 comment

{{title}}

Select a reply

Crowdsec "No matching files for pattern" for nginx logs and no crowdsec.conf file. #1516

Judman Feb 12, 2025

Replies: 1 comment

Zoey2936 Feb 12, 2025 Maintainer

Judman
Feb 12, 2025

Zoey2936
Feb 12, 2025
Maintainer