# Uncategorized

**URL:** https://discourse.crowdsec.net/c/uncategorized/1.md

[Latest](https://discourse.crowdsec.net/latest.md) · [Categories](https://discourse.crowdsec.net/categories.md)

---

## [CrowdSec Discord server](https://discourse.crowdsec.net/t/crowdsec-discord-server/528)

<div class="topic-metadata">

**Author:** [@klausagnoletti](https://discourse.crowdsec.net/u/klausagnoletti)\
**Replies:** 1\
**Last updated:** [January 14, 2022, 8:50pm UTC](https://discourse.crowdsec.net/t/crowdsec-discord-server/528 "2022-01-14T20:50:08Z")

</div>

We’ve started a Discord server! It’s thriving! So please join it by clicking the invite link. We are doing this not to skip Discourse but to use both platforms in the best way possible to build up a strong and healthy c…

---

## [Welcome to CrowdSecurity discourse!](https://discourse.crowdsec.net/t/welcome-to-crowdsecurity-discourse/7)

<div class="topic-metadata">

**Author:** [@system](https://discourse.crowdsec.net/u/system)\
**Replies:** 6\
**Last updated:** [August 4, 2020, 9:09am UTC](https://discourse.crowdsec.net/t/welcome-to-crowdsecurity-discourse/7 "2020-08-04T09:09:13Z")

</div>

This is a place to discuss the open-source software published by crowdsecurity. Here is a good place to exchange and learn about your experiences. Having trouble installing or configuring software components ? Having tr…

---

## [AppSec (WAF) Feedback (Poll)](https://discourse.crowdsec.net/t/appsec-waf-feedback-poll/2264)

<div class="topic-metadata">

**Author:** [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Replies:** 4\
**Last updated:** [August 1, 2026, 12:56pm UTC](https://discourse.crowdsec.net/t/appsec-waf-feedback-poll/2264 "2026-08-01T12:56:03Z")

</div>

Hey :wave: We appreciate your feedback on the current status of AppSec Component (WAF) and we currently see a lot of users not using this functionality compared to normal use of CrowdSec. Let us know the reason if you …

---

## [No se define API Key al momento de instalar bouncer nftables](https://discourse.crowdsec.net/t/no-se-define-api-key-al-momento-de-instalar-bouncer-nftables/2917)

<div class="topic-metadata">

**Author:** [@jteran](https://discourse.crowdsec.net/u/jteran)\
**Replies:** 0\
**Last updated:** [July 7, 2026, 1:07am UTC](https://discourse.crowdsec.net/t/no-se-define-api-key-al-momento-de-instalar-bouncer-nftables/2917 "2026-07-07T01:07:26Z")

</div>

Hola muchachos como va? Aqui les dejo una issue en la instalacion del paquete crowdsec-firewall-bouncer-nftables 0.0.34; Les dejo la secuencia de comandos que se usaron para resolverlo: dpkg -l | grep crowdsec apt-cac…

---

## [Appsec triggers alerts, but no decisions](https://discourse.crowdsec.net/t/appsec-triggers-alerts-but-no-decisions/2872)

<div class="topic-metadata">

**Author:** [@dani](https://discourse.crowdsec.net/u/dani)\
**Replies:** 2\
**Last updated:** [June 1, 2026, 9:53am UTC](https://discourse.crowdsec.net/t/appsec-triggers-alerts-but-no-decisions/2872 "2026-06-01T09:53:02Z")

</div>

Hi. I’m just prototyping Crowdsec, inluding appsec. I have a multi node setups Some (1 for now) dedicated log-processors, which receive logs from an HTTP datasource Some (1 for now) local-api The logs part is working …

---

## [Still no package for fedora newer than 39?](https://discourse.crowdsec.net/t/still-no-package-for-fedora-newer-than-39/2811)

<div class="topic-metadata">

**Author:** [@Thenesis](https://discourse.crowdsec.net/u/Thenesis)\
**Replies:** 0\
**Last updated:** [May 12, 2026, 8:29am UTC](https://discourse.crowdsec.net/t/still-no-package-for-fedora-newer-than-39/2811 "2026-05-12T08:29:51Z")

</div>

Is there a reason why crowdsec did stop the development of crowdsec for fedora? We are at fedora 44 atm and nothing.

---

## [IP Public was blacklisted](https://discourse.crowdsec.net/t/ip-public-was-blacklisted/2798)

<div class="topic-metadata">

**Author:** [@abrenon](https://discourse.crowdsec.net/u/abrenon)\
**Replies:** 1\
**Last updated:** [April 13, 2026, 11:18am UTC](https://discourse.crowdsec.net/t/ip-public-was-blacklisted/2798 "2026-04-13T11:18:40Z")

</div>

Hi, My IP Public is blacklisted by crowdsec but i’m not administrator pf crowdsec. I was blacklisted for access to a partner platform … The problem was multiple query with a bad parameter, so i just change parameter so…

---

## [Home assistant logs not parsed](https://discourse.crowdsec.net/t/home-assistant-logs-not-parsed/948)

<div class="topic-metadata">

**Author:** [@krisbogaerts](https://discourse.crowdsec.net/u/krisbogaerts)\
**Replies:** 5\
**Last updated:** [March 30, 2026, 4:28pm UTC](https://discourse.crowdsec.net/t/home-assistant-logs-not-parsed/948 "2026-03-30T16:28:29Z")

</div>

Hi, I installed the home assistant add-on, but the logs are not parsed, and it ignores failed logins or banned IP’s Also tried to cscli explain the logs directly but this does not seem to parse Configuration is …

---

## [Frequent IP Bans by CrowdSec Due to Synapse Matrix Requests: Seeking Help and Solutions](https://discourse.crowdsec.net/t/frequent-ip-bans-by-crowdsec-due-to-synapse-matrix-requests-seeking-help-and-solutions/1472)

<div class="topic-metadata">

**Author:** [@alpha-ars](https://discourse.crowdsec.net/u/alpha-ars)\
**Replies:** 10\
**Last updated:** [March 13, 2026, 6:44pm UTC](https://discourse.crowdsec.net/t/frequent-ip-bans-by-crowdsec-due-to-synapse-matrix-requests-seeking-help-and-solutions/1472 "2026-03-13T18:44:12Z")

</div>

I’ve been facing a recurring issue with CrowdSec and wanted to share my experience and seek advice. My IP address has been getting banned quite often, and I suspect that it’s related to the requests made to my Synapse ma…

---

## [K8s LAPI restarts periodically, can't find config, restarts again](https://discourse.crowdsec.net/t/k8s-lapi-restarts-periodically-cant-find-config-restarts-again/2767)

<div class="topic-metadata">

**Author:** [@sven](https://discourse.crowdsec.net/u/sven)\
**Replies:** 0\
**Last updated:** [February 13, 2026, 1:41pm UTC](https://discourse.crowdsec.net/t/k8s-lapi-restarts-periodically-cant-find-config-restarts-again/2767 "2026-02-13T13:41:57Z")

</div>

Hi friends, Running a LAPI server installed with Helm in a K8s cluster. Just short under an hour of running, the pod is restarted. There are no K8s events nor crashloops related to the pod, it just runs and then restart…

---

## [New haproxy bouncer : ban issue?](https://discourse.crowdsec.net/t/new-haproxy-bouncer-ban-issue/2766)

<div class="topic-metadata">

**Author:** [@sebastian](https://discourse.crowdsec.net/u/sebastian)\
**Replies:** 0\
**Last updated:** [February 12, 2026, 1:26pm UTC](https://discourse.crowdsec.net/t/new-haproxy-bouncer-ban-issue/2766 "2026-02-12T13:26:26Z")

</div>

hello we are deploying the new haproxy bouncer, so far so good, ban works and offending ip get the html ban page. the ban trigger is a nikto scan, the ban works at he haprocy http/https level, but i can rerun the nikto…

---

## [Security Engine: no activity on OPNsense](https://discourse.crowdsec.net/t/security-engine-no-activity-on-opnsense/2761)

<div class="topic-metadata">

**Author:** [@dtgolder](https://discourse.crowdsec.net/u/dtgolder)\
**Replies:** 3\
**Last updated:** [February 10, 2026, 7:06pm UTC](https://discourse.crowdsec.net/t/security-engine-no-activity-on-opnsense/2761 "2026-02-10T19:06:24Z")

</div>

Hi– New user here…have installed Crowdsec on OPNsense as a plugin. It seems to be configured correctly, but I’m getting a persistent “Security Engine - no activity” error: Security Engine No Alerts The Engine No Alert…

---

## [SECUBOX - New OpenWRT based system for security](https://discourse.crowdsec.net/t/secubox-new-openwrt-based-system-for-security/2760)

<div class="topic-metadata">

**Author:** [@Gandalf](https://discourse.crowdsec.net/u/Gandalf)\
**Replies:** 1\
**Last updated:** [February 8, 2026, 8:59am UTC](https://discourse.crowdsec.net/t/secubox-new-openwrt-based-system-for-security/2760 "2026-02-08T08:59:10Z")

</div>

Next up? VoIP Integration (secubox-voip) — Asterisk micro-PBX for E2E encrypted calls over WireGuard mesh Matrix Integration (secubox-matrix) — Conduit Matrix server (~15MB RAM) for E2EE messaging Factory Auto…

---

## [Crowdsec banning my ip from random websites?](https://discourse.crowdsec.net/t/crowdsec-banning-my-ip-from-random-websites/2755)

<div class="topic-metadata">

**Author:** [@asdasdasda](https://discourse.crowdsec.net/u/asdasdasda)\
**Replies:** 1\
**Last updated:** [February 5, 2026, 10:02am UTC](https://discourse.crowdsec.net/t/crowdsec-banning-my-ip-from-random-websites/2755 "2026-02-05T10:02:28Z")

</div>

Hello, I am just daily internet user and I keep getting banned from random websites by crowdsec i am trying to access, i have no idea why. as i said i am just a normal dude. could you guys help me thanks.

---

## [I'm directly get blocked by your services](https://discourse.crowdsec.net/t/im-directly-get-blocked-by-your-services/2751)

<div class="topic-metadata">

**Author:** [@fine77](https://discourse.crowdsec.net/u/fine77)\
**Replies:** 0\
**Last updated:** [January 27, 2026, 1:48pm UTC](https://discourse.crowdsec.net/t/im-directly-get-blocked-by-your-services/2751 "2026-01-27T13:48:23Z")

</div>

what is the issue here? i’m trying to implement your services but ending up with 403 Forbidden every time at my opnsense firewalls. i can not see that i’ve done something wrong and i’m not attacking your services. in t…

---

## [I can setup in windows server 2008r2 system,the error is service 'crowdsec' failed to strat. verify that you have suffcient privilege](https://discourse.crowdsec.net/t/i-can-setup-in-windows-server-2008r2-system-the-error-is-service-crowdsec-failed-to-strat-verify-that-you-have-suffcient-privilege/2742)

<div class="topic-metadata">

**Author:** [@echo50059](https://discourse.crowdsec.net/u/echo50059)\
**Replies:** 1\
**Last updated:** [January 7, 2026, 4:07pm UTC](https://discourse.crowdsec.net/t/i-can-setup-in-windows-server-2008r2-system-the-error-is-service-crowdsec-failed-to-strat-verify-that-you-have-suffcient-privilege/2742 "2026-01-07T16:07:38Z")

</div>

I need help~ my acquis.yamal is vent\_ids: 4625 4623 event\_level: information labels: type: eventlog ##Firewall filenames: C:\\Windows\\System32\\LogFiles\\Firewall\*.log labels: type: windows-firewall ##SQL Se…

---

## [Abuseip confidence score and total reports enricher](https://discourse.crowdsec.net/t/abuseip-confidence-score-and-total-reports-enricher/2731)

<div class="topic-metadata">

**Author:** [@maxdd](https://discourse.crowdsec.net/u/maxdd)\
**Replies:** 0\
**Last updated:** [December 10, 2025, 9:20pm UTC](https://discourse.crowdsec.net/t/abuseip-confidence-score-and-total-reports-enricher/2731 "2025-12-10T21:20:48Z")

</div>

Hello, I have a small sh script which I was hoping to somehow deploy on my crowdsec docker instance in order to enrich/append the metrics I’m sending to Prometheus with information such as the confidence score and the t…

---

## [Parser for software "Sympa"?](https://discourse.crowdsec.net/t/parser-for-software-sympa/2714)

<div class="topic-metadata">

**Author:** [@Cyrille37](https://discourse.crowdsec.net/u/Cyrille37)\
**Replies:** 5\
**Last updated:** [November 9, 2025, 9:40pm UTC](https://discourse.crowdsec.net/t/parser-for-software-sympa/2714 "2025-11-09T21:40:42Z")

</div>

Hi Has someone did some work to process Sympa logs for crowdsec ? To detect bad scan like : ... wwsympa\[1278\]: info main:: \[robot listes.comptoir.net\] \[session 78542549836374\] \[client 172.192.56.48\] Unknown list "pki-…

---

## [OpenWRT - entries got added and deleted](https://discourse.crowdsec.net/t/openwrt-entries-got-added-and-deleted/2710)

<div class="topic-metadata">

**Author:** [@\_shorty](https://discourse.crowdsec.net/u/_shorty)\
**Replies:** 0\
**Last updated:** [October 31, 2025, 12:21pm UTC](https://discourse.crowdsec.net/t/openwrt-entries-got-added-and-deleted/2710 "2025-10-31T12:21:42Z")

</div>

Hi, on my fresh installed openWRT I was able to get crowdsec configured and running. It is also enrolled to the crowdsec API. When I try to manually block an IP it is working fine, the IP is blocked perfectly. But I d…

---

## [Joplin xs539/joplin-server-logs not Parsered](https://discourse.crowdsec.net/t/joplin-xs539-joplin-server-logs-not-parsered/2697)

<div class="topic-metadata">

**Author:** [@Benjamin](https://discourse.crowdsec.net/u/Benjamin)\
**Replies:** 0\
**Last updated:** [October 4, 2025, 11:31pm UTC](https://discourse.crowdsec.net/t/joplin-xs539-joplin-server-logs-not-parsered/2697 "2025-10-04T23:31:42Z")

</div>

Nginx access \*.log Docker logs Hi i have Problems with parser the logs. I have Installed the Joplin Collection. Can anybody help me ?

---

## [Parsing of the Vaultwarden logs](https://discourse.crowdsec.net/t/parsing-of-the-vaultwarden-logs/2695)

<div class="topic-metadata">

**Author:** [@Eirikr70](https://discourse.crowdsec.net/u/Eirikr70)\
**Replies:** 1\
**Last updated:** [September 28, 2025, 6:24am UTC](https://discourse.crowdsec.net/t/parsing-of-the-vaultwarden-logs/2695 "2025-09-28T06:24:35Z")

</div>

Hello, I have set up the Vaultwarden scenario by Dominic Wagner. I have set the logging system at the format proposed on the hub. The scenario is active and reads the logs but seems to be unable to parse them. cscli me…

---

## [Local API behind traefik](https://discourse.crowdsec.net/t/local-api-behind-traefik/2685)

<div class="topic-metadata">

**Author:** [@urbaman](https://discourse.crowdsec.net/u/urbaman)\
**Replies:** 2\
**Last updated:** [September 15, 2025, 9:30pm UTC](https://discourse.crowdsec.net/t/local-api-behind-traefik/2685 "2025-09-15T21:30:57Z")

</div>

Hi, I’m trying to put the API behind a reserve proxy (traefik) os there a best practice for it, or someone that already did it? I’m getting 500 internal server error for the noment. Thank you very much.

---

## [How to not forward alerts](https://discourse.crowdsec.net/t/how-to-not-forward-alerts/2675)

<div class="topic-metadata">

**Author:** [@yadd](https://discourse.crowdsec.net/u/yadd)\
**Replies:** 5\
**Last updated:** [September 4, 2025, 11:07am UTC](https://discourse.crowdsec.net/t/how-to-not-forward-alerts/2675 "2025-09-04T11:07:50Z")

</div>

My Crowdsec server receives many alerts, I’d like to forward to Crowdsec only those with a decision. Is it possible ? How ?

---

## [I want Advice on Using Golang with Security Tools](https://discourse.crowdsec.net/t/i-want-advice-on-using-golang-with-security-tools/2667)

<div class="topic-metadata">

**Author:** [@Olivia](https://discourse.crowdsec.net/u/Olivia)\
**Replies:** 0\
**Last updated:** [August 21, 2025, 9:33am UTC](https://discourse.crowdsec.net/t/i-want-advice-on-using-golang-with-security-tools/2667 "2025-08-21T09:33:36Z")

</div>

Hey All, I have started diving into Golang & I am quite impressed with how clean and efficient it feels compared to some other languages I have tried. While exploring more about it, I came across CrowdSec & the whole id…

---

## [Using Crowdsec in mcvlans](https://discourse.crowdsec.net/t/using-crowdsec-in-mcvlans/2644)

<div class="topic-metadata">

**Author:** [@AsD](https://discourse.crowdsec.net/u/AsD)\
**Replies:** 2\
**Last updated:** [July 26, 2025, 10:51pm UTC](https://discourse.crowdsec.net/t/using-crowdsec-in-mcvlans/2644 "2025-07-26T22:51:24Z")

</div>

Hey there i got a problem / beeing confused with using crowdsec on docker-container, specificly on mcvlans. Before i start: I have a NAS and a Rasp-Pi with docker-compose and portainer. I’m using nginx and like 20 ser…

---

## [Exec: "journalctl": executable file not found in $PATH](https://discourse.crowdsec.net/t/exec-journalctl-executable-file-not-found-in-path/2642)

<div class="topic-metadata">

**Author:** [@vic1707](https://discourse.crowdsec.net/u/vic1707)\
**Replies:** 1\
**Last updated:** [July 26, 2025, 8:57pm UTC](https://discourse.crowdsec.net/t/exec-journalctl-executable-file-not-found-in-path/2642 "2025-07-26T20:57:27Z")

</div>

Hi, Upon installing crowdsec (as a podman quadlet, see below), I wanted it to parse my journald logs. I installed the crowdsecurity/linux collection but Crowdsec complains about datasource 'journalctl' is not available…

---

## [Slow 404 bruteforce - how to address](https://discourse.crowdsec.net/t/slow-404-bruteforce-how-to-address/2639)

<div class="topic-metadata">

**Author:** [@isdnfan](https://discourse.crowdsec.net/u/isdnfan)\
**Replies:** 2\
**Last updated:** [July 25, 2025, 10:35pm UTC](https://discourse.crowdsec.net/t/slow-404-bruteforce-how-to-address/2639 "2025-07-25T22:35:53Z")

</div>

I’m seeing such traffic in my reverse proxy logs: "2025-07-22T00:52:57+02:00","20.225.136.34:62519",404,"https","nc.mydomain.tld","web-secure","-","/wordpress","nc@docker",404 "2025-07-22T00:58:21+02:00","20.225.136.34:…

---

## [MSSQL Collection on Linux not Work (No Docker)](https://discourse.crowdsec.net/t/mssql-collection-on-linux-not-work-no-docker/2519)

<div class="topic-metadata">

**Author:** [@Benjamin](https://discourse.crowdsec.net/u/Benjamin)\
**Replies:** 7\
**Last updated:** [July 16, 2025, 4:20pm UTC](https://discourse.crowdsec.net/t/mssql-collection-on-linux-not-work-no-docker/2519 "2025-07-16T16:20:33Z")

</div>

Hello, I have MSSQL installed on Linux Debian 12 and Crowdsec as well. Now I’m trying to secure it, but I’m failing at the acquisition stage. What do I need to specify here on Linux? My MSSQL Log file is: /var/opt/mss…

---

## [Crowdsec not parsing docker log](https://discourse.crowdsec.net/t/crowdsec-not-parsing-docker-log/2615)

<div class="topic-metadata">

**Author:** [@\_shorty](https://discourse.crowdsec.net/u/_shorty)\
**Replies:** 8\
**Last updated:** [July 2, 2025, 7:16pm UTC](https://discourse.crowdsec.net/t/crowdsec-not-parsing-docker-log/2615 "2025-07-02T19:16:27Z")

</div>

i there, I do have a problem with a running crowdsec docker container. I got everything set up except the ability to parse the docker logs. I create a new variable in docker for the docker.sock of Unraid. This is then c…

---

## [Best Practices for Tuning CrowdSec on Self-Hosted Web Servers?](https://discourse.crowdsec.net/t/best-practices-for-tuning-crowdsec-on-self-hosted-web-servers/2605)

<div class="topic-metadata">

**Author:** [@marcellosalas](https://discourse.crowdsec.net/u/marcellosalas)\
**Replies:** 0\
**Last updated:** [June 17, 2025, 5:49am UTC](https://discourse.crowdsec.net/t/best-practices-for-tuning-crowdsec-on-self-hosted-web-servers/2605 "2025-06-17T05:49:27Z")

</div>

Hey everyone, I have been using CrowdSec for a few weeks now on my self-hosted Ubuntu web server running Nginx and PHP-FPM. The initial setup went smoothly.., and I am already seeing some IPs being blocked.., which is g…

[Next page](https://discourse.crowdsec.net/c/uncategorized/1.md?page=1)