Crowdsec failing to start after executing cscli explain

crowdsec
1

I made another posting a few minutes ago regarding an error when using cscli explain.

Since executing that command I can no longer restart crowdsec

When I type ‘journalctl -xe’ I get

-- Unit crowdsec.service has begun starting up.
May 25 09:19:54 integra-nginx crowdsec[71060]: time="25-05-2022 09:19:54" level=fatal msg="Error decoding parsing configuration file '/etc/crowdsec/parsers/s02-enrich/parser-dump.yaml': yaml: unmarshal errors:\n  line 1: field s00-raw n
May 25 09:19:54 integra-nginx systemd[1]: crowdsec.service: Control process exited, code=exited status=1
May 25 09:19:54 integra-nginx systemd[1]: crowdsec.service: Failed with result 'exit-code'.
May 25 09:19:54 integra-nginx systemd[1]: Failed to start Crowdsec agent.
-- Subject: Unit crowdsec.service has failed

the file ‘/etc/crowdsec/parsers/s02-enrich/parser-dump.yaml’’ contains the lines I have been trying to analyze using cscli explain.
Since I didn’t generate this file I assume that cscli explain writes entries to it, but they appear to be incorrectly written and generate an error on startup.

I can wipe the file or I can leave it blank.

Whats the recommended course of action? Is this a bug I should report or have I done something incorrectly?

2

Hello,

This is because you ran cscli explain in the parser directory.

Currently, the command is not very “clean” and will create some files in the current directory.

When ran in the parser directory, crowdsec will see the YAML files created by cscli, and will try to load them as parsers which will fail.

Remove the files parser-dump.yaml, bucket-dump.yaml and bucketpour-dump.yaml, and crowdsec will start.

3

I’m laughing at myself here that I didn’t spot that particular one. Especially since I had two windows open, one to type the commands, edit configs, etc, another to check logs and restart the service. I hadn’t clicked to the fact that I was in the parser folder when I typed that.

Thanks, good to know.