Crowdsecurity/http-logs debug

crowdsec
1

Constanty seeing this in my crowdsec.log as debug and don’t know what to do about it. It is when i go to all of my proxied websites that i use connected to a cloudfare tunnel / authelia /traefik. My links work and i tested it blocking ips which it does so idk.

time=“2024-04-23T11:51:11-05:00” level=debug msg=“dbg(result=false): evt.Meta.service == ‘http’ and evt.Meta.log_type in [‘http_access-log’, ‘http_error-log’] and evt.Meta.http_status in [‘404’, ‘403’] and Lower(evt.Meta.http_path) contains "/wp-" and Lower(evt.Meta.http_path) endsWith ".php"” cfg=silent-resonance name=crowdsecurity/http-wordpress-scan

time=“2024-04-23T11:51:11-05:00” level=debug msg=" [== ‘http’] "http" == "http" → [true]" cfg=silent-resonance name=crowdsecurity/http-wordpress-scan

time=“2024-04-23T11:51:11-05:00” level=debug msg=" [and] AND → true" cfg=silent-resonance name=crowdsecurity/http-wordpress-scan

time=“2024-04-23T11:51:11-05:00” level=debug msg=" [in [‘http_access-log’, ‘http_error-log’]] "http_access-log" in map[http_access-log:{} http_error-log:{}] → [true]" cfg=silent-resonance name=crowdsecurity/http-wordpress-scan

time=“2024-04-23T11:51:11-05:00” level=debug msg=" [and] AND → true" cfg=silent-resonance name=crowdsecurity/http-wordpress-scan

time=“2024-04-23T11:51:11-05:00” level=debug msg=" [in [‘404’, ‘403’]] "403" in map[403:{} 404:{}] → [true]" cfg=silent-resonance name=crowdsecurity/http-wordpress-scan

time=“2024-04-23T11:51:11-05:00” level=debug msg=" [and] AND → true" cfg=silent-resonance name=crowdsecurity/http-wordpress-scan

time=“2024-04-23T11:51:11-05:00” level=debug msg=" [Lower(evt.Meta.http_path)] Lower("/?rd=https%3A%2F%2Fredated…") = "/?rd=https%3a%2f%2fmoviesearch…"" cfg=silent-resonance name=crowdsecurity/http-wordpress-scan

time=“2024-04-23T11:51:11-05:00” level=debug msg=" [contains "/wp-"] "/?rd=https%3a%2f%2fmoviesearch…" contains "/wp-" → [false]" cfg=silent-resonance name=crowdsecurity/http-wordpress-scan

time=“2024-04-23T11:51:11-05:00” level=debug msg=" [and] AND → false" cfg=silent-resonance name=crowdsecurity/http-wordpress-scan

time=“2024-04-23T11:51:11-05:00” level=debug msg=“Event leaving node : ko (filter mismatch)” cfg=silent-resonance name=crowdsecurity/http-wordpress-scan

parse 2
parse 22561×885 58.2 KB

2

parse1
parse12561×1334 116 KB

3

Edit Solved … For anyone that runs into this in the future. I uninstalled and reinstalled crowdsec but didnt work. I though i deleted all configs on unistall but maybe i didnt folders were still there. The fix for me was uninstalling the paser. “cscli parsers remove crowdsecurity/http-logs --force”. Then reinstalling “cscli parsers install crowdsecurity/http-logs”. Link to docs cscli parsers remove | CrowdSec. Sorry for this post i spent a whole day trying to fix it and i felt like it was unsolvable but definitely was an easy fix.