# Apache2 logs are not parsing (all lines unsuccessfull)

**URL:** <https://discourse.crowdsec.net/t/apache2-logs-are-not-parsing-all-lines-unsuccessfull/2636>\
**Category:** crowdsec\
**Created:** [July 16, 2025, 8:30am UTC](https://discourse.crowdsec.net/t/apache2-logs-are-not-parsing-all-lines-unsuccessfull/2636 "2025-07-16T08:30:27Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![lootboss](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/lootboss/32/1264_2.png) [@lootboss](https://discourse.crowdsec.net/u/lootboss)\
**Post date:** [July 16, 2025, 8:30am UTC](https://discourse.crowdsec.net/t/apache2-logs-are-not-parsing-all-lines-unsuccessfull/2636/1 "2025-07-16T08:30:27Z")

</div>

Hello there. I’m new to crowdsec, please,help me. I installed crowdsec, default collection for apache, gettext, bouncer.

At /etc/crowdsec/acquis.yaml i added paths to my logs

filenames:

- /www/wwwlogs/access\_log
- /www/wwwlogs/my.domain-access\_log  
labels:  
type: apache2

Then i restarted crowdsec. But logs aren’t parsed. There is always trouble to parse time, but log format is compatible with grok pattern.

nodes:

- grok:  
pattern: ‘(%{IPORHOST:target\_fqdn}(:%{INT:port})? )?%{COMMONAPACHELOG}( “%{NOTDQUOTE:referrer}” “%{NOTDQUOTE:http\_user\_agent}”)?’

~# cscli metrics show acquisition  
╭─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮  
│ Acquisition Metrics │  
├───────────────────────────────────────────────┬────────────┬──────────────┬────────────────┬────────────────────────┬───────────────────┤  
│ Source │ Lines read │ Lines parsed │ Lines unparsed │ Lines poured to bucket │ Lines whitelisted │  
├───────────────────────────────────────────────┼────────────┼──────────────┼────────────────┼────────────────────────┼───────────────────┤  
│ file:/var/log/auth.log │ 10 │ - │ 10 │ - │ - │  
│ file:/var/log/kern.log │ 4 │ - │ 4 │ - │ - │  
│ file:/var/log/messages │ 4 │ - │ 4 │ - │ - │  
│ file:/var/log/syslog │ 6 │ - │ 6 │ - │ - │  
│ file:/www/wwwlogs/my.domain-access\_log │ 74 │ - │ 74 │ - │ - │  
╰───────────────────────────────────────────────┴────────────┴──────────────┴────────────────┴────────────────────────┴───────────────────╯  
~# tail -n 3 /www/wwwlogs/my.domain-access\_log | cscli explain -f- --type apache2 -v  
WARNING Line 0/10 is missing evt.StrTime. It is most likely a mistake as it will prevent your logs to be processed in time-machine/forensic mode. file=/tmp/cscli\_explain655300316/parser-dump.yaml  
WARNING Line 1/10 is missing evt.StrTime. It is most likely a mistake as it will prevent your logs to be processed in time-machine/forensic mode. file=/tmp/cscli\_explain655300316/parser-dump.yaml  
WARNING Line 2/10 is missing evt.StrTime. It is most likely a mistake as it will prevent your logs to be processed in time-machine/forensic mode. file=/tmp/cscli\_explain655300316/parser-dump.yaml  
WARNING Line 3/10 is missing evt.StrTime. It is most likely a mistake as it will prevent your logs to be processed in time-machine/forensic mode. file=/tmp/cscli\_explain655300316/parser-dump.yaml

line: 180.149.228.172 - - [16/Jul/2025:11:23:45 +0300] “GET /.well-known/pki-validation/moon.php HTTP/1.1” 404 2080 “-” “Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36”  
├ apache-custom.yaml  
| └ 🔴 crowdsecurity/apache2-custom  
└-------- parser failure 🔴

line: 180.149.228.174 - - [16/Jul/2025:11:23:47 +0300] “GET /credits.php HTTP/1.1” 404 2080 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:73.0) Gecko/20100101 Firefox/73.0”  
├ apache-custom.yaml  
| └ 🔴 crowdsecurity/apache2-custom  
└-------- parser failure 🔴

line: 180.149.228.174 - - [16/Jul/2025:11:23:48 +0300] “GET /wp-content/plugins/dummyyummy/wp-signup.php HTTP/1.1” 404 2080 “-” “Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)”  
├ apache-custom.yaml  
| └ 🔴 crowdsecurity/apache2-custom  
└-------- parser failure 🔴

What is the problem?

Same with default parsers

line: 45.248.76.214 - - [16/Jul/2025:11:31:17 +0300] “GET /wp-includes/click.php HTTP/1.1” 404 2080 “-” “Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36”  
├ s01-parse  
| ├ 🔴 crowdsecurity/apache2-logs  
| └ 🔴 crowdsecurity/nginx-logs  
└-------- parser failure 🔴

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [July 16, 2025, 11:53am UTC](https://discourse.crowdsec.net/t/apache2-logs-are-not-parsing-all-lines-unsuccessfull/2636/2 "2025-07-16T11:53:47Z")

</div>

Hi it seems you are missing the base parsers which should be installed by default please run

```auto
cscli collections install crowdsecurity/linux

```

once this is completed your explain should now work and then you can restart crowdsec via

```auto
systemctl restart crowdsec

```