Crowdsec Stopped Working on my Raspberry Pi (ARM?)

crowdsec
1

I had Crowdsec working for over a year, and I had upgraded my server from buster to bullseye and still had Crowdsec working. I was getting Prometheus data. A couple months ago it stopped working, the service won’t start. The only clue I get is when I remove Crowdsec, I get this error:

FATA[15-01-2023 10:16:51] cscli dashboard is only available on amd64, but you are running arm

I’m using the instructions from this post: How to secure your Raspberry Pi OS with CrowdSec - The open-source & collaborative IPS

Does anyone else have problems with Debian and Arm?

2

Hmmm that log will only happen whilst it tries to destory the dashboard. Metabase doesnt support arm that is why we had to introduce that FATAL later on but you may have run it beforehand.

There should be other instances inside the log that would suggest why the service is failing.

3

Here is the journalctl -xe for the service that doesn’t start:

Subject: A start job for unit crowdsec.service has begun execution
░░ Defined-By: systemd
░░ Support: https://www.debian.org/support
░░
░░ A start job for unit crowdsec.service has begun execution.
░░
░░ The job identifier is 6466.
Jan 20 07:02:12 piutil01 influxd-systemd-start.sh[573]: ts=2023-01-20T13:02:12.029989Z lvl=info msg="Snapshot for path written" log_id=0fLhcryl000 engine=tsm1 trace_id=0fVpCSs0000 op_name=tsm1_cache_snapshot path=/var/lib/influxdb/data/_internal/monitor/650 duration=865.193ms
Jan 20 07:02:12 piutil01 influxd-systemd-start.sh[573]: ts=2023-01-20T13:02:12.047472Z lvl=info msg="Cache snapshot (end)" log_id=0fLhcryl000 engine=tsm1 trace_id=0fVpCSs0000 op_name=tsm1_cache_snapshot op_event=end op_elapsed=882.586ms
Jan 20 07:02:13 piutil01 crowdsec[15954]: time="2023-01-20T07:02:13-06:00" level=fatal msg="/etc/crowdsec/config.yaml: yaml: unmarshal errors:\n  line 38: field color not found in type csconfig.CscliCfg"
Jan 20 07:02:13 piutil01 crowdsec[15954]: time="2023-01-20T07:02:13-06:00" level=fatal msg="/etc/crowdsec/config.yaml: yaml: unmarshal errors:\n  line 38: field color not found in type csconfig.CscliCfg"
Jan 20 07:02:13 piutil01 systemd[1]: crowdsec.service: Control process exited, code=exited, status=1/FAILURE
░░ Subject: Unit process exited
░░ Defined-By: systemd
░░ Support: https://www.debian.org/support
░░
░░ An ExecStartPre= process belonging to unit crowdsec.service has exited.
░░
░░ The process' exit code is 'exited' and its exit status is 1.
Jan 20 07:02:13 piutil01 systemd[1]: crowdsec.service: Failed with result 'exit-code'.
░░ Subject: Unit failed
░░ Defined-By: systemd
░░ Support: https://www.debian.org/support
░░
░░ The unit crowdsec.service has entered the 'failed' state with result 'exit-code'.
Jan 20 07:02:13 piutil01 systemd[1]: Failed to start Crowdsec agent.
4

Hmmm seems you have a new configuration file but the agent is not up to date? what output do you get if you run crowdsec -version

5

which crowsec
thesmashy@system:~ $ which cscli
/usr/local/bin/cscli
thesmashy@system:~ $ cscli version
2023/01/31 12:24:18 version: v1.3.4-freebsd-0483b9c641ff9aa4e04dea4366d33ed65c330036
2023/01/31 12:24:18 Codename: alphaga
2023/01/31 12:24:18 BuildDate: 2022-05-20_18:53:30
2023/01/31 12:24:18 GoVersion: 1.17
2023/01/31 12:24:18 Platform: linux
2023/01/31 12:24:18 Constraint_parser: >= 1.0, <= 2.0
2023/01/31 12:24:18 Constraint_scenario: >= 1.0, < 3.0
2023/01/31 12:24:18 Constraint_api: v1
2023/01/31 12:24:18 Constraint_acquis: >= 1.0, < 2.0

6

Yes, so the cscli binary is not up to date as the latest is 1.4.5. Can you update both crowdsec and cscli to 1.4.5. If you finding it wont update just remove the package see if which cscli still returns a path then rm the paths.