Fixed by myself, deleted directory and created a new captcha 
1 Like
docker logs Crowdsec shows
sqlite is not using WAL mode
the Crowdsec doc say it would be ok to add
use_wal: true
to db_conig in user_yaml
Will this be ok, here?
1 Like
I have not seen that before. Please try it
1 Like
Accept the enrollment on crowdsec console
1 Like
I did enroll and accepted it, it is shown on the ui. I do not see any alerts.
The decision list is empty.
oot@ubuntu-4gb-nbg1-2:~# docker exec -it crowdsec cscli metrics
╭────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ Acquisition Metrics │
├──────────────────────────────────┬────────────┬──────────────┬────────────────┬────────────────────────┬───────────────────┤
│ Source │ Lines read │ Lines parsed │ Lines unparsed │ Lines poured to bucket │ Lines whitelisted │
├──────────────────────────────────┼────────────┼──────────────┼────────────────┼────────────────────────┼───────────────────┤
│ file:/var/log/traefik/access.log │ 95 │ 95 │ - │ 74 │ - │
╰──────────────────────────────────┴────────────┴──────────────┴────────────────┴────────────────────────┴───────────────────╯
╭───────────────────────────────────────────╮
│ Local API Decisions │
├─────────────────┬────────┬────────┬───────┤
│ Reason │ Origin │ Action │ Count │
├─────────────────┼────────┼────────┼───────┤
│ ssh:bruteforce │ CAPI │ ban │ 2699 │
│ http:bruteforce │ CAPI │ ban │ 1432 │
│ http:crawl │ CAPI │ ban │ 646 │
│ http:exploit │ CAPI │ ban │ 8977 │
│ http:scan │ CAPI │ ban │ 2546 │
╰─────────────────┴────────┴────────┴───────╯
╭────────────────────────────────────╮
│ Local API Metrics │
├────────────────────┬────────┬──────┤
│ Route │ Method │ Hits │
├────────────────────┼────────┼──────┤
│ /v1/allowlists │ GET │ 21 │
│ /v1/heartbeat │ GET │ 20 │
│ /v1/usage-metrics │ POST │ 1 │
│ /v1/watchers/login │ POST │ 1 │
╰────────────────────┴────────┴──────╯
╭────────────────────────────────────────────╮
│ Local API Machines Metrics │
├───────────┬────────────────┬────────┬──────┤
│ Machine │ Route │ Method │ Hits │
├───────────┼────────────────┼────────┼──────┤
│ localhost │ /v1/allowlists │ GET │ 21 │
│ localhost │ /v1/heartbeat │ GET │ 20 │
╰───────────┴────────────────┴────────┴──────╯
╭───────────────────────────────────────────────────────────────╮
│ Parser Metrics │
├────────────────────────────────────┬──────┬────────┬──────────┤
│ Parsers │ Hits │ Parsed │ Unparsed │
├────────────────────────────────────┼──────┼────────┼──────────┤
│ child-crowdsecurity/http-logs │ 285 │ 230 │ 55 │
│ child-crowdsecurity/traefik-logs │ 190 │ 95 │ 95 │
│ crowdsecurity/dateparse-enrich │ 95 │ 95 │ - │
│ crowdsecurity/geoip-enrich │ 95 │ 95 │ - │
│ crowdsecurity/http-logs │ 95 │ 95 │ - │
│ crowdsecurity/non-syslog │ 95 │ 95 │ - │
│ crowdsecurity/public-dns-allowlist │ 95 │ 95 │ - │
│ crowdsecurity/traefik-logs │ 95 │ 95 │ - │
│ crowdsecurity/whitelists │ 95 │ 95 │ - │
╰────────────────────────────────────┴──────┴────────┴──────────╯
╭────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ Scenario Metrics │
├──────────────────────────────────────┬───────────────┬───────────┬──────────────┬────────┬─────────┤
│ Scenario │ Current Count │ Overflows │ Instantiated │ Poured │ Expired │
├──────────────────────────────────────┼───────────────┼───────────┼──────────────┼────────┼─────────┤
│ crowdsecurity/http-crawl-non_statics │ 2 │ - │ 18 │ 43 │ 16 │
│ crowdsecurity/http-probing │ 2 │ - │ 6 │ 29 │ 4 │
│ crowdsecurity/http-sensitive-files │ - │ - │ 1 │ 2 │ 1 │
╰──────────────────────────────────────┴───────────────┴───────────┴──────────────┴────────┴─────────╯
╭───────────────────────────────────────────────────────────────────────────────────────╮
│ Whitelist Metrics │
├────────────────────────────────────┬─────────────────────────────┬──────┬─────────────┤
│ Whitelist │ Reason │ Hits │ Whitelisted │
├────────────────────────────────────┼─────────────────────────────┼──────┼─────────────┤
│ crowdsecurity/public-dns-allowlist │ public DNS server │ 95 │ - │
│ crowdsecurity/whitelists │ private ipv4/ipv6 ip/ranges │ 95 │ - │
╰────────────────────────────────────┴─────────────────────────────┴──────┴─────────────╯
root@ubuntu-4gb-nbg1-2:~#
I do not find the error
1 Like
Apply the crowdsec middleware to a resource using the middleware manager
You should see some entries like this in resources-override.yml
10-router-auth:
entryPoints:
- websecure
middlewares:
- crowdsec@file
- badger@http
priority: 100
rule: "Host(`YOUR_RESOURCE_DOMAIN`)"
service: "10-service@http"
tls:
certResolver: "letsencrypt"
If not the crowdsec isn’t applied to your incoming routers
1 Like
I can’t access the MM dashboard. The following error message appears in the log, but unfortunately I don’t understand it with my limited abilities.
Initial resource check failed: failed to fetch resources: HTTP request failed: Get “``http://pangolin:3001/api/v1/traefik-config”:`` dial tcp 172.18.0.4:3001: connect: connection refused
Pangolin logs show api is started
2025-12-01T10:54:43+00:00 [info]: API server is running on http://localhost:3000
2025-12-01T10:54:43+00:00 [info]: Internal server is running on http://localhost:3001
After some minutes of wait, dashboard is reachable, I try
1 Like
Thank you for your patience and support.
I added the crowdsec bouncer to one resource, traefik dashboard shows the added middleware and no errors.
I added my IP, Step 14. Can see it in the decision list. The IP is not blocked, can access the resource
7-Calibre-router-auth-auth:
entryPoints:
- websecure
middlewares:
- crowdsec@file
- badger@http
priority: 100
rule: "Host(`xxxxxxxxxx`)"
service: "7-Calibre-service@http"
tls:
certResolver: "letsencrypt"
1 Like
its an overide file, its a separation from the main router/middleware we have to do to keep a track, what is your issue with it, anywhere it is causing a problem??
thankyou for explanation. Can I get rid off this override, please
1 Like
@hhf.technoloy Today I look at my logs, docker log crowdsec shows
/var/lib/crowdsec/data was found in a volume
Local agent already registered
Check if lapi needs to register an additional agent
Error: cscli console enroll: could not enroll instance: Post "https://api.crowdsec.net/v3/watchers/enroll": API error: Forbidden
I read the announcements from crowdsec and pangolin, edited the docker-compose.yml as mentioned.
It did not solve the problem, do I have to enroll a new engine or do I have to wait?
1 Like
I sent a mail to crowdsec and it took some time and it is working again.
1 Like
It was an issue on their(crowdsec) end and pangolin’s
does this point needs an update with
healthcheck:
test:
- CMD
- cscli
- lapi
- status
interval: 10s
timeout: 5s
retries: 3
start_period: 30s
1 Like
Yes it needs. I will tell the the mod to update it.
That’s update now. Thank you
1 Like
Hi,
Thank you for the very helpful guide. I am currently installing Pangolin on Oracle VPS. I am getting the error at cscli hub update
How can I rectify the error?
Error is :
Error: cscli hub update: unable to retrieve latest crowdsec version: unable to send request to ``https://version.crowdsec.net/latest:`` Get “``https://version.crowdsec.net/latest”:`` dial tcp: lookup ``version.crowdsec.net`` on 169.254.169.254:53: read udp 172.17.0.2:32805->169.254.169.254:53: read: connection refused
1 Like
Use docker exec crowdsec cscli hub update