# Decision not listed

**URL:** <https://discourse.crowdsec.net/t/decision-not-listed/1943>\
**Category:** crowdsec\
**Created:** [July 26, 2024, 12:28pm UTC](https://discourse.crowdsec.net/t/decision-not-listed/1943 "2024-07-26T12:28:24Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tammes](https://avatars.discourse-cdn.com/v4/letter/t/b77776/32.png) [@Tammes](https://discourse.crowdsec.net/u/Tammes)\
**Post date:** [July 26, 2024, 12:28pm UTC](https://discourse.crowdsec.net/t/decision-not-listed/1943/1 "2024-07-26T12:28:24Z")

</div>

Hello,  
I have set up crowdsec 1.6.2 as multiserver setup on debian servers and installed the crowdsecurity/linux collection (which includes sshd) and the iptables firewall bouncer. When I try to ssh into a non existent user on a client server often enough, I get banned. However, this ban does not show up in the output of `cscli decisions list` regardless of if I run it on the client server or the lapi server. I also tried using the `--all` flag or `cscli alerts list`, but it showed up in none of these. I always get `No active decisions`.

Am I doing something wrong? is there another way to show active bans?

Thank you in advance  
Tammes

Edit: I temporally removedthis post because I had been banned by fail2ban, not crowdsec. However, I now uninstalled fail2ban and now I am able to get myself banned by crowdsec on the lapi server. Still no decisions or alerts show up, but my IP does in the crowdsec-blacklists ip set. Weirdly, this does not work on the client server. I am not banned together with the lapi server ban and if I do a bunch of invalid login tries, I don’t get banned either. `cscli lapi status` reports that everything is fine though. I am confused…

---

<div class="post-metadata">

**Author:** ![Tammes](https://avatars.discourse-cdn.com/v4/letter/t/b77776/32.png) [@Tammes](https://discourse.crowdsec.net/u/Tammes)\
**Post date:** [July 26, 2024, 2:45pm UTC](https://discourse.crowdsec.net/t/decision-not-listed/1943/2 "2024-07-26T14:45:55Z")

</div>

The failed logins on the client server do show up in its metrics:

```auto
Scenario Metrics:
╭─────────────────────────────────────┬───────────────┬───────────┬──────────────┬────────┬─────────╮
│ Scenario │ Current Count │ Overflows │ Instantiated │ Poured │ Expired │
├─────────────────────────────────────┼───────────────┼───────────┼──────────────┼────────┼─────────┤
│ crowdsecurity/ssh-bf │ 6 │ 30 │ 36 │ 188 │ - │
│ crowdsecurity/ssh-bf_user-enum │ 1 │ - │ 1 │ 1 │ - │
│ crowdsecurity/ssh-slow-bf │ 4 │ 16 │ 20 │ 188 │ - │
│ crowdsecurity/ssh-slow-bf_user-enum │ 1 │ - │ 1 │ 1 │ - │

```

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [July 29, 2024, 8:05am UTC](https://discourse.crowdsec.net/t/decision-not-listed/1943/3 "2024-07-29T08:05:08Z")

</div>

So since updating CrowdSec to point towards another LAPI, did you restart the service?

---

<div class="post-metadata">

**Author:** ![Tammes](https://avatars.discourse-cdn.com/v4/letter/t/b77776/32.png) [@Tammes](https://discourse.crowdsec.net/u/Tammes)\
**Post date:** [July 30, 2024, 1:04pm UTC](https://discourse.crowdsec.net/t/decision-not-listed/1943/4 "2024-07-30T13:04:05Z")

</div>

Yes I did. And I also just looked into my database and in the ‘decisions’ table, there are over 3000 bans for my IP with ‘until’ in the future. But `cscli decisions list` shows nothing.

---

<div class="post-metadata">

**Author:** ![Tammes](https://avatars.discourse-cdn.com/v4/letter/t/b77776/32.png) [@Tammes](https://discourse.crowdsec.net/u/Tammes)\
**Post date:** [July 30, 2024, 1:27pm UTC](https://discourse.crowdsec.net/t/decision-not-listed/1943/5 "2024-07-30T13:27:41Z")

</div>

one server not banning was caused by not restarting the bouncer though. So the only problem that is left now is that the decisions are not being listed.

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [July 30, 2024, 2:07pm UTC](https://discourse.crowdsec.net/t/decision-not-listed/1943/6 "2024-07-30T14:07:21Z")

</div>

> [@Tammes](#):
>
> cscli decisions list

This only shows local decisions by default to show the “rest” you need to pass the `-a` flag

---

<div class="post-metadata">

**Author:** ![Tammes](https://avatars.discourse-cdn.com/v4/letter/t/b77776/32.png) [@Tammes](https://discourse.crowdsec.net/u/Tammes)\
**Post date:** [July 30, 2024, 2:13pm UTC](https://discourse.crowdsec.net/t/decision-not-listed/1943/7 "2024-07-30T14:13:27Z")

</div>

That also shows nothing

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [July 31, 2024, 8:03am UTC](https://discourse.crowdsec.net/t/decision-not-listed/1943/8 "2024-07-31T08:03:44Z")

</div>

And `cscli lapi status` shows the correct URL running it from the machine?

---

<div class="post-metadata">

**Author:** ![Tammes](https://avatars.discourse-cdn.com/v4/letter/t/b77776/32.png) [@Tammes](https://discourse.crowdsec.net/u/Tammes)\
**Post date:** [July 31, 2024, 12:54pm UTC](https://discourse.crowdsec.net/t/decision-not-listed/1943/9 "2024-07-31T12:54:24Z")

</div>

Yes it does, on both machines. The url looks like `https://crowdsec-lapi.my.tld:8080/`

---

<div class="post-metadata">

**Author:** ![Tammes](https://avatars.discourse-cdn.com/v4/letter/t/b77776/32.png) [@Tammes](https://discourse.crowdsec.net/u/Tammes)\
**Post date:** [November 11, 2024, 2:22pm UTC](https://discourse.crowdsec.net/t/decision-not-listed/1943/10 "2024-11-11T14:22:16Z")

</div>

I don’t know what changed, but this is fixed now

---

<div class="post-metadata">

**Author:** ![Tammes](https://avatars.discourse-cdn.com/v4/letter/t/b77776/32.png) [@Tammes](https://discourse.crowdsec.net/u/Tammes)\
**Post date:** [February 19, 2026, 3:36pm UTC](https://discourse.crowdsec.net/t/decision-not-listed/1943/11 "2026-02-19T15:36:53Z")

</div>

Soooo,

after all this time, I have a similar problem again, but slightly different. I am now running crowdsec 1.7.6. in a customized multiserver setup where crowdsec runs on Debian Bookworm as a Systemd DynamicUser and the Lapi talks to an external MariaDB-Cluster. This is combined with the `nftables-firewall-bouncer`. I didn’t really test if decisions worked correctly in the mean time, so they might have been this way since 2024.

If I now trigger Scenarios by failing ssh-logins, the respective IP does show up in `cscli decisions list (-a)` and in the `nft set crowdsec-blacklists-crowdsec`. However, if I then get another IP banned as well, only that one shows up in `cscli decisions list (-a)` and the first one disappears, but stays in the `nft set`(both on the lapi-server and other clients). I took a look into the `decisions` table of the database and noticed that for each Scenario, a db entry gets created every second with the one IP that was banned at last. Is this the intended behaviour? Shouldn’t `cscli decisions list` list all currently active decisions?

---

<div class="post-metadata">

**Author:** ![Tammes](https://avatars.discourse-cdn.com/v4/letter/t/b77776/32.png) [@Tammes](https://discourse.crowdsec.net/u/Tammes)\
**Post date:** [February 23, 2026, 11:55am UTC](https://discourse.crowdsec.net/t/decision-not-listed/1943/12 "2026-02-23T11:55:31Z")

</div>

More Details: `cscli decisions list` still shows nothing. But if I `cscli decisions delete -i <banned IP>`, many decisions (accumulating, approximately one per second per scenario) get deletet, but nftables still banns the IP. And if I delete the decision a few seconds later, there are new decisions that get deletet without effect again.

---

<div class="post-metadata">

**Author:** ![Tammes](https://avatars.discourse-cdn.com/v4/letter/t/b77776/32.png) [@Tammes](https://discourse.crowdsec.net/u/Tammes)\
**Post date:** [June 5, 2026, 12:42pm UTC](https://discourse.crowdsec.net/t/decision-not-listed/1943/13 "2026-06-05T12:42:14Z")

</div>

This was fixed by switching from a remote MariaDB-Cluster to a local SQLite-Database. Idk what is wrong about MariaDB, but it did not work in a stable manner for me.

So I consider this solved by magic now.