# Ban list location path

**URL:** <https://discourse.crowdsec.net/t/ban-list-location-path/1714>\
**Category:** crowdsec\
**Created:** [March 23, 2024, 7:54am UTC](https://discourse.crowdsec.net/t/ban-list-location-path/1714 "2024-03-23T07:54:11Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![papahausa](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/papahausa/32/823_2.png) [@papahausa](https://discourse.crowdsec.net/u/papahausa)\
**Post date:** [March 23, 2024, 7:54am UTC](https://discourse.crowdsec.net/t/ban-list-location-path/1714/1 "2024-03-23T07:54:11Z")

</div>

Hello. how can check log file with banned ip in server?

> **[Screenshot](https://prnt.sc/VMtSq6FInGUt)**
>
> Captured with Lightshot

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [March 23, 2024, 9:05am UTC](https://discourse.crowdsec.net/t/ban-list-location-path/1714/2 "2024-03-23T09:05:23Z")

</div>

The log file for CrowSec is different depending on the platform you can view the default locations [here](https://docs.crowdsec.net/u/troubleshooting/security_engine#where-are-the-logs-stored)

You can filter the log file you will see entries like

```bash
grep performed /var/log/crowdsec.log

```

`time="2024-03-23T07:44:25Z" level=info msg="Ip 192.168.1.1 performed 'crowdsecurity/endlessh-bf' (6 events over 55.815407421s) at 2024-03-23 07:44:25.896865151 +0000 UTC"`

**I changed the ip address within the example for PII sake**

However, you can also query the decisions and alerts using `cscli` binary

```auto
cscli decisions list

```

List active decisions [docs](https://docs.crowdsec.net/docs/next/cscli/cscli_decisions_list)

```auto
cscli alerts list

```

List all alerts inc active decisions [docs](https://docs.crowdsec.net/docs/next/cscli/cscli_alerts_list)

Hope this helps 👍

---

<div class="post-metadata">

**Author:** ![papahausa](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/papahausa/32/823_2.png) [@papahausa](https://discourse.crowdsec.net/u/papahausa)\
**Post date:** [March 23, 2024, 9:11am UTC](https://discourse.crowdsec.net/t/ban-list-location-path/1714/3 "2024-03-23T09:11:50Z")

</div>

> [@iiAmLoz](#):
>
> `cscli decisions list`

at me, there is no any list.  
root@observer ~ # cscli decisions list  
No active decisions

* * *

this is from log. grep -E “level=(error|fatal)” /var/log/crowdsec.log

time=“2024-03-20T19:51:27+01:00” level=fatal msg=“while starting API server: listening on 127.0.0.1:8080: listen tcp 127.0.0.1:8080: bind: address already in use”  
time=“2024-03-20T19:52:30+01:00” level=fatal msg=“while starting API server: listening on 127.0.0.1:8080: listen tcp 127.0.0.1:8080: bind: address already in use”  
time=“2024-03-20T19:53:34+01:00” level=fatal msg=“while starting API server: listening on 127.0.0.1:8080: listen tcp 127.0.0.1:8080: bind: address already in use”  
time=“2024-03-20T19:54:37+01:00” level=fatal msg=“while starting API server: listening on 127.0.0.1:8080: listen tcp 127.0.0.1:8080: bind: address already in use”  
time=“2024-03-20T19:55:40+01:00” level=fatal msg=“while starting API server: listening on 127.0.0.1:8080: listen tcp 127.0.0.1:8080: bind: address already in use”  
time=“2024-03-20T19:56:44+01:00” level=fatal msg=“while starting API server: listening on 127.0.0.1:8080: listen tcp 127.0.0.1:8080: bind: address already in use”  
time=“2024-03-20T19:57:47+01:00” level=fatal msg=“while starting API server: listening on 127.0.0.1:8080: listen tcp 127.0.0.1:8080: bind: address already in use”  
time=“2024-03-20T19:58:51+01:00” level=fatal msg=“while starting API server: listening on 127.0.0.1:8080: listen tcp 127.0.0.1:8080: bind: address already in use”  
time=“2024-03-20T19:59:54+01:00” level=fatal msg=“while starting API server: listening on 127.0.0.1:8081: listen tcp 127.0.0.1:8081: bind: address already in use”  
time=“2024-03-20T20:00:58+01:00” level=fatal msg=“while starting API server: listening on 127.0.0.1:8081: listen tcp 127.0.0.1:8081: bind: address already in use”  
time=“2024-03-20T20:02:01+01:00” level=fatal msg=“while starting API server: listening on 127.0.0.1:8081: listen tcp 127.0.0.1:8081: bind: address already in use”  
time=“2024-03-20T20:03:05+01:00” level=fatal msg=“starting outputs error : authenticate watcher (fab9f9341e3747c5b7db6620482b614ditu8O7eMDzQIsSr2): API error: http code 400, no error message”  
time=“2024-03-20T20:04:09+01:00” level=fatal msg=“starting outputs error : authenticate watcher (fab9f9341e3747c5b7db6620482b614ditu8O7eMDzQIsSr2): API error: http code 400, no error message”  
time=“2024-03-20T20:05:14+01:00” level=fatal msg=“starting outputs error : authenticate watcher (fab9f9341e3747c5b7db6620482b614ditu8O7eMDzQIsSr2): API error: http code 400, no error message”  
time=“2024-03-20T20:06:18+01:00” level=fatal msg=“starting outputs error : authenticate watcher (fab9f9341e3747c5b7db6620482b614ditu8O7eMDzQIsSr2): API error: http code 400, no error message”  
time=“2024-03-20T20:07:23+01:00” level=fatal msg=“starting outputs error : authenticate watcher (fab9f9341e3747c5b7db6620482b614ditu8O7eMDzQIsSr2): API error: http code 400, no error message”  
time=“2024-03-20T20:08:27+01:00” level=fatal msg=“starting outputs error : authenticate watcher (fab9f9341e3747c5b7db6620482b614ditu8O7eMDzQIsSr2): API error: http code 400, no error message”  
time=“2024-03-20T20:09:31+01:00” level=fatal msg=“starting outputs error : authenticate watcher (fab9f9341e3747c5b7db6620482b614ditu8O7eMDzQIsSr2): API error: http code 400, no error message”  
time=“2024-03-20T20:10:36+01:00” level=fatal msg=“starting outputs error : authenticate watcher (fab9f9341e3747c5b7db6620482b614ditu8O7eMDzQIsSr2): API error: http code 400, no error message”  
time=“2024-03-20T20:11:40+01:00” level=fatal msg=“starting outputs error : authenticate watcher (fab9f9341e3747c5b7db6620482b614ditu8O7eMDzQIsSr2): API error: http code 400, no error message”  
time=“2024-03-20T20:12:44+01:00” level=fatal msg=“starting outputs error : authenticate watcher (fab9f9341e3747c5b7db6620482b614ditu8O7eMDzQIsSr2): API error: http code 400, no error message”  
time=“2024-03-21T03:53:36+01:00” level=error msg=“sending signal to central API: while performing request: API error: Unauthorized”  
time=“2024-03-21T11:24:17+01:00” level=error msg=“sending signal to central API: while performing request: API error: Unauthorized”  
time=“2024-03-23T08:15:16+01:00” level=fatal msg=“-dsn requires a -type argument”  
time=“2024-03-23T09:00:44+01:00” level=error msg=“capi metrics: failed: API error: Unauthorized”

But i changer port to 7188 because 8080 is busy by other.  
netstat -tulpn | grep :8080  
tcp6 0 0 :::8080 :::\* LISTEN 22745/agent  
root@observer ~ # netstat -tulpn | grep :7188  
tcp 0 0 127.0.0.1:7188 0.0.0.0:\* LISTEN 176406/crowdsec netstat -tulpn | grep :8080  
tcp6 0 0 :::8080 :::\* LISTEN 22745/agent  
root@observer ~ # netstat -tulpn | grep :7188  
tcp 0 0 127.0.0.1:7188 0.0.0.0:\* LISTEN 176406/crowdsec

---

<div class="post-metadata">

**Author:** ![papahausa](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/papahausa/32/823_2.png) [@papahausa](https://discourse.crowdsec.net/u/papahausa)\
**Post date:** [March 23, 2024, 9:14am UTC](https://discourse.crowdsec.net/t/ban-list-location-path/1714/4 "2024-03-23T09:14:21Z")

</div>

Also this command show. cscli alerts list

> **[Screenshot](https://prnt.sc/ZXWnOHuoYy5l)**
>
> Captured with Lightshot

seems all works and scanned ip is banned.?

---

<div class="post-metadata">

**Author:** ![papahausa](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/papahausa/32/823_2.png) [@papahausa](https://discourse.crowdsec.net/u/papahausa)\
**Post date:** [March 23, 2024, 9:15am UTC](https://discourse.crowdsec.net/t/ban-list-location-path/1714/5 "2024-03-23T09:15:57Z")

</div>

> [@iiAmLoz](#):
>
> `cscli decisions list`

cscli decisions list

root@observer ~ # cscli decisions list  
No active decisions

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [March 23, 2024, 9:31am UTC](https://discourse.crowdsec.net/t/ban-list-location-path/1714/6 "2024-03-23T09:31:53Z")

</div>

They _did_ have an active decision, however, the default ban timer of 4 hours has now expired, so yes the detection is working and as long as you installed a remediation component it should be actively enforcing it.

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [March 23, 2024, 9:35am UTC](https://discourse.crowdsec.net/t/ban-list-location-path/1714/7 "2024-03-23T09:35:12Z")

</div>

Im guessing you resolve the port conflict errors?

---

<div class="post-metadata">

**Author:** ![papahausa](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/papahausa/32/823_2.png) [@papahausa](https://discourse.crowdsec.net/u/papahausa)\
**Post date:** [March 23, 2024, 12:56pm UTC](https://discourse.crowdsec.net/t/ban-list-location-path/1714/8 "2024-03-23T12:56:33Z")

</div>

> [@iiAmLoz](#):
>
> 4 hours

How add more ban time. For example 36hr or 1 year ?

---

<div class="post-metadata">

**Author:** ![papahausa](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/papahausa/32/823_2.png) [@papahausa](https://discourse.crowdsec.net/u/papahausa)\
**Post date:** [March 23, 2024, 12:56pm UTC](https://discourse.crowdsec.net/t/ban-list-location-path/1714/9 "2024-03-23T12:56:54Z")

</div>

With port correction yes. its solved.

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [March 23, 2024, 12:58pm UTC](https://discourse.crowdsec.net/t/ban-list-location-path/1714/10 "2024-03-23T12:58:58Z")

</div>

CrowdSec is designed to provision small timely bans as IP addresses are dynamic in nature you can alter the behaviour via [profiles](https://docs.crowdsec.net/docs/next/profiles/format)

---

<div class="post-metadata">

**Author:** ![papahausa](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/papahausa/32/823_2.png) [@papahausa](https://discourse.crowdsec.net/u/papahausa)\
**Post date:** [March 23, 2024, 1:02pm UTC](https://discourse.crowdsec.net/t/ban-list-location-path/1714/11 "2024-03-23T13:02:35Z")

</div>

Thanks. U are the bet. 😉  
Now solved.