Cscli metrics unparsed logs

crowdsec
#1

Hello,
I installed crowdsec to test but when I run cscli metrics I see that all the logs are unparsed.
I set crowdsec with apache2,ssh and linux services.
sudo cscli metrics :

Capture d’écran de 2020-12-13 15-06-26
Capture d’écran de 2020-12-13 15-06-261033×623 69.2 KB

sudo cscli parsers list :
Capture d’écran de 2020-12-13 15-07-52
Capture d’écran de 2020-12-13 15-07-52998×184 32.7 KB

sudo cscli collections list :
Capture d’écran de 2020-12-13 15-14-07
Capture d’écran de 2020-12-13 15-14-07974×127 19.2 KB

sudo systemctl status crowdsec.service :
Capture d’écran de 2020-12-13 15-08-43
Capture d’écran de 2020-12-13 15-08-431244×325 84.6 KB

I tried to restart and reinstall but the result is the same. Is it normal ?
Thanks

#2

Hello,

The screenshot you provided shows a perfectly working installation except for this unparsed logs metrics.

We would lokie to check there isn’t anything weird going on with your logs. Can you share with us an excerpt of the content of your logs (for example /var/log/auth.log). you can either anonymize them, or send them crypted to support@crowdsec.net with the key displayed at https://docs.crowdsec.net/contributing/

Thanks for you message, and we are looking forward to look into it, we really want the tool to work for everyone !

#3

Hello,
Sorry I forgot to install gettext (too eager to test crowdsec :slight_smile: ). I restarted crowdsec and now the logs are parsed :

Capture d’écran de 2020-12-14 15-10-07
Capture d’écran de 2020-12-14 15-10-071002×379 42.4 KB

Maybe you can add this check in the install script :wink:
thank you.

#4

Hello,

I’m not sure to follow you :smiley:

Would you mind to elaborate or the error you had or the changes you made so that we can take it into account ?

#5

Hello,
Yes I have read the documentation again and seen I haven’t installed all dependencies. So I run apt-get install gettext and restart crowdsec and now I see the logs parsed.