Crowdsec decision expiration

crowdsec
1

I have a crowdsec setup with a central server:

Log Centralization | CrowdSec (a similar setup to this)
The central server receives those logs and writes them into files.
The Security Engine then analyzes those logs on this same server to detect malicious behaviours.
Finally, a Firewall Remediation Component running on each web server blocks the malicious IPs.

Every time a “decision” is created on the central server, it lasts two hours less than on the VMs that have the “Firewall Remediation Component”. For example:

A test was conducted using IP 158.23.184.117, which was added to CrowdSec decisions at approximately 09:41 CEST (UTC+2).

Initial Check (around 09:41 CEST / 07:41 UTC)

  • Central Server (SQLite DB):

    • Command:

      sqlite3 /var/lib/crowdsec/data/crowdsec.db "SELECT value, start_ip, until FROM decisions WHERE until LIKE '2026-08-26%' LIMIT 10;"

    • Output:

      158.23.184.117 | -9223372034202421130 | 2026-08-26 11:41:53.017444592+00:00

      (Note: The database recorded an expiration time of 11:41 UTC, which corresponds to 13:41 CEST — a 4-hour duration).

  • Remediation VM (nftables):

    • Command:

      nft list table ip crowdsec | grep 158.23.184.117

    • Output:

      158.23.184.117 timeout 3h59m49s expires 3h59m6s227ms

      (Note: nftables received the full 4-hour timeout setting).

Second Check (around 12:10 CEST / 10:10 UTC)

  • Central Server (SQLite DB):

    The entry is gone (purged/expired at 11:41 CEST / 09:41 UTC, after only 2 hours).

  • Remediation VM (nftables):

    158.23.184.117 timeout 3h59m49s expires 1h22m17s2ms

    *(Note: The decision is still active with ~1h 22m remaining, sticking to its original 4-hour lifespan).
    *
    How can I make sure that the centralized server and the distributed servers are aligned and synchronized?