I am setting up my first windows firewall engine and when i use the console enroll command i get the follow ing error.
level=fatal msg=“accepts 1 arg(s), received 0”
I am running as powershell admin, not sure what to do. First time user
So you are running:
cscli.exe console enroll <id>
if so can you provide cscli.exe version
So i was able to enroll the engine but now no logs are being parsed. it look like the log files cannot be found. below are the messages from the crowsec log.
time=“2025-02-07T21:45:38+09:00” level=info msg=“loading acquisition file : C:\ProgramData\CrowdSec\config\acquis.yaml”
time=“2025-02-07T21:45:38+09:00” level=warning msg=“No matching files for pattern C:\Windows\System32\LogFiles\Firewall\.log" type=file
time=“2025-02-07T21:45:38+09:00” level=warning msg="No matching files for pattern C:\inetpub\logs\LogFiles\\*.log” type=file
PS C:\Users\vpira> cscli version
version: v1.6.4-fb733ee4
Codename: alphaga
BuildDate: 2024-11-20_11:23:05
GoVersion: 1.23.3
Platform: windows
libre2: WebAssembly
User-Agent: crowdsec/v1.6.4-fb733ee4-windows
Constraint_parser: >= 1.0, <= 3.0
Constraint_scenario: >= 1.0, <= 3.0
Constraint_api: v1
Constraint_acquis: >= 1.0, < 2.0
Built-in optional components: cscli_setup, datasource_appsec, datasource_cloudwatch, datasource_docker, datasource_file, datasource_http, datasource_journalctl, datasource_k8s-audit, datasource_kafka, datasource_kinesis, datasource_loki, datasource_s3, datasource_syslog, datasource_wineventlog
I also had this same problem when installing all Windows stations. On Linux stations it ran correctly. How can I solve this? Why does this problem happen?
Can you provide additional context like logs for example?
we cant seem to replicate the issue with enrollment on the latest version so please ensure you are on the latest install.
Yes, I don’t know of any other fonts to download, only the font from the website that I downloaded today.
time=“2025-03-06T06:29:27-03:00” level=error msg=“error while performing request: dial tcp: lookup api.crowdsec.net on [::1]:53: read udp [::1]:54961->[::1]:53: i/o timeout; 4 retries left”
time=“2025-03-06T06:29:27-03:00” level=info msg=“retrying in 29 seconds (attempt 2 of 5)”
time=“2025-03-06T06:29:59-03:00” level=info msg=“Sent 1 usage metrics”
time=“2025-03-06T06:30:00-03:00” level=info msg=“capi/community-blocklist : 0 explicit deletions”
time=“2025-03-06T06:30:03-03:00” level=info msg=“crowdsecurity/community-blocklist : added 3000 entries, deleted 2873 entries (alert:28)”
time=“2025-03-06T06:52:16-03:00” level=info msg=“Sent 1 usage metrics”
time=“2025-03-06T06:59:59-03:00” level=info msg=“capi metrics: sending”
time=“2025-03-06T07:23:50-03:00” level=error msg=“unable to send usage metrics: Post "https://api.crowdsec.net/v3/usage-metrics\”: performing jwt auth: net/http: TLS handshake timeout"
time=“2025-03-06T07:30:00-03:00” level=info msg=“capi metrics: sending”
time=“2025-03-06T07:52:16-03:00” level=info msg=“Sent 2 usage metrics”
time=“2025-03-06T08:00:11-03:00” level=info msg=“capi metrics: sending”
time=“2025-03-06T08:22:20-03:00” level=info msg=“Sent 1 usage metrics”
time=“2025-03-06T08:29:06-03:00” level=info msg=“Starting community-blocklist update”
time=“2025-03-06T08:29:08-03:00” level=info msg=“capi/community-blocklist : 0 explicit deletions”
time=“2025-03-06T08:29:11-03:00” level=info msg=“crowdsecurity/community-blocklist : added 3000 entries, deleted 2865 entries (alert:29)”
time=“2025-03-06T08:30:12-03:00” level=info msg=“capi metrics: sending”
time=“2025-03-06T08:52:16-03:00” level=info msg=“Sent 1 usage metrics”
time=“2025-03-06T09:00:12-03:00” level=info msg=“capi metrics: sending”
time=“2025-03-06T09:22:16-03:00” level=info msg=“Sent 1 usage metrics”
time=“2025-03-06T09:30:13-03:00” level=info msg=“capi metrics: sending”
time=“2025-03-06T09:52:18-03:00” level=info msg=“Sent 1 usage metrics”
time=“2025-03-06T10:00:14-03:00” level=info msg=“capi metrics: sending”
time=“2025-03-06T10:22:19-03:00” level=info msg=“Sent 1 usage metrics”
This is a problem with the machine DNS, that it seems to be timing out
Same again the machine is timing out when trying to do the TLS handshake, if you machine is behind a corporate proxy or something doing TLS inspection this may happen as it adds some overhead to the request timings.