Hi all,
I cannot get the email plugin to run properly. I have created the folder /etc/crowdsec/notifications and added email.yaml according to the documentation. I also enabled the email plugin in the profiles.yaml
When I try to restart the crowdsec service it throws the following error
level=info msg="Crowdsec v1.4.6-6~deb12u1-linux-debian"
level=info msg="Loading prometheus collectors"
level=info msg="Loading CAPI pusher"
level=info msg="initiating plugin broker"
level=fatal msg="api server init: unable to run local API: while loading plugin: plugin name /usr/lib/crowdsec/plugins/dummy is invalid. Name should be like {type-name}"
cat /etc/apt/sources.list.d/crowdsec_crowdsec.list
# this file was generated by packagecloud.io for
# the repository at https://packagecloud.io/crowdsec/crowdsec
deb [signed-by=/etc/apt/keyrings/crowdsec_crowdsec-archive-keyring.gpg] https://packagecloud.io/crowdsec/crowdsec/debian/ bookworm main
deb-src [signed-by=/etc/apt/keyrings/crowdsec_crowdsec-archive-keyring.gpg] https://packagecloud.io/crowdsec/crowdsec/debian/ bookworm main
So I think you may have downloaded via the debian repositories. And yeah /var/lib/crowdsec/hub/parsers/ is debian repositories that means if you have an updated config.yaml you will stop receiving updates to your parsers
ls -la /etc/crowdsec/parsers/s01-parse/
total 28
drwxr-xr-x 2 root root 4096 Aug 17 08:45 .
drwxr-xr-x 5 root root 4096 Aug 15 08:15 ..
lrwxrwxrwx 1 root root 71 Aug 17 08:34 jellyfin-logs.yaml -> /var/lib/crowdsec/hub/parsers/s01-parse/LePresidente/jellyfin-logs.yaml
lrwxrwxrwx 1 root root 73 Aug 15 08:19 nextcloud-logs.yaml -> /var/lib/crowdsec/hub/parsers/s01-parse/crowdsecurity/nextcloud-logs.yaml
lrwxrwxrwx 1 root root 69 Aug 15 08:15 nginx-logs.yaml -> /var/lib/crowdsec/hub/parsers/s01-parse/crowdsecurity/nginx-logs.yaml
lrwxrwxrwx 1 root root 68 Aug 15 08:15 sshd-logs.yaml -> /var/lib/crowdsec/hub/parsers/s01-parse/crowdsecurity/sshd-logs.yaml
lrwxrwxrwx 1 root root 76 Aug 17 08:12 vaultwarden-logs.yaml -> /var/lib/crowdsec/hub/parsers/s01-parse/Dominic-Wagner/vaultwarden-logs.yaml
parsers look good to me. Bouncers also working. It’s just the notifications that were throwing errors.
I renamed all the plugins now with the notification prefix. The error is gone
Ok I see. Then it would be better to manually install crowdsec without apt currently.
Here my config.yaml and config.yaml.local:
common:
daemonize: true
log_media: file
log_level: info
log_dir: /var/log/
log_max_size: 20
compress_logs: true
log_max_files: 10
working_dir: .
config_paths:
config_dir: /etc/crowdsec/
data_dir: /var/lib/crowdsec/data/
simulation_path: /etc/crowdsec/simulation.yaml
hub_dir: /var/lib/crowdsec/hub/
index_path: /var/lib/crowdsec/hub/.index.json
notification_dir: /etc/crowdsec/notifications/
plugin_dir: /usr/lib/crowdsec/plugins/
crowdsec_service:
acquisition_path: /etc/crowdsec/acquis.yaml
acquisition_dir: /etc/crowdsec/acquis.d
parser_routines: 1
cscli:
output: human
color: auto
db_config:
log_level: info
type: sqlite
db_path: /var/lib/crowdsec/data/crowdsec.db
#max_open_conns: 100
#user:
#password:
#db_name:
#host:
#port:
flush:
max_items: 5000
max_age: 7d
plugin_config:
user: nobody # plugin process would be ran on behalf of this user
group: nogroup # plugin process would be ran on behalf of this group
api:
client:
insecure_skip_verify: false
credentials_path: /etc/crowdsec/local_api_credentials.yaml
server:
log_level: info
listen_uri: 127.0.0.1:8080
profiles_path: /etc/crowdsec/profiles.yaml
console_path: /etc/crowdsec/console.yaml
online_client: # Central API credentials (to push signals and receive bad IPs)
credentials_path: /etc/crowdsec/online_api_credentials.yaml
trusted_ips: # IP ranges, or IPs which can have admin API access
- 127.0.0.1
- ::1
# tls:
# cert_file: /etc/crowdsec/ssl/cert.pem
# key_file: /etc/crowdsec/ssl/key.pem
prometheus:
enabled: true
level: full
listen_addr: 127.0.0.1
listen_port: 6060
and config.yaml.local
# Optimization for sqlite, see README.Debian:
db_config:
use_wal: true
Perfect, I see no issues in your config.yaml just for context sake if your
hub_dir: /var/lib/crowdsec/hub/
Was
hub_dir: /etc/crowdsec/hub/
Then you will have issues as cscli will update the hub but your symlinks are pointing to wrong location (Hence why I asked you to ls -la earlier)
I created this fix script that will automatically dump all local configuration parser,scenarios,collections and fix the symlinks but you dont need to run it as you dont have the issue