Failed to yaml decode /etc/crowdsec/acquis.yaml

crowdsec
1

Dear all,
I’m using the ArchLinux package for Crowdsec, yet when I’m launching the process (with systemctl start crowdsec), I got this error:

level=fatal msg=“crowdsec init: while loading acquisition config: failed to yaml decode /etc/crowdsec/acquis.yaml: yaml: unmarshal errors:\n line 21: field labels already set in type configuration.DataSourceCommonCfg”

Here is the content of the acquis.yaml:

filenames:
  - /var/log/nginx/*.log
  - ./tests/nginx/nginx.log
#this is not a syslog log, indicate which kind of logs it is
labels:
  type: nginx
---
filenames:
  - /var/log/auth.log
  - /var/log/syslog
labels:
  type: syslog
---
filename: /var/log/apache2/*.log
labels:
  type: apache2
 #Generated acquisition file - wizard.sh (service: nginx) / files : /var/log/nginx/access.log /var/log/nginx/error.log
filenames:
 - /var/log/nginx/access.log
 - /var/log/nginx/error.log
labels:
  type: nginx
---
#Generated acquisition file - wizard.sh (service: sshd) / files : 
journalctl_filter:
  - _SYSTEMD_UNIT=sshd.service
labels:
   type: syslog
 ---

I didn’t make any change in this file. Do you know why it’s not working?
Have a nice day
Sincerely

2

I edited you initial file since it was hard to read.

So the error happens because there no seperator between apaceh2 and nginx at the bottom

---
filename: /var/log/apache2/*.log
labels:
  type: apache2
--- ## <- THIS LINE IS MISSING
 #Generated acquisition file - wizard.sh (service: nginx) / files : /var/log/nginx/access.log /var/log/nginx/error.log
filenames:
 - /var/log/nginx/access.log
 - /var/log/nginx/error.log
labels:
  type: nginx

However for ease you can just replace the whole contents of the file with this snippet

## If arch is not running rsyslogd you can remove these lines until the '---'
filenames:
  - /var/log/auth.log
  - /var/log/syslog
labels:
  type: syslog
---
filenames:
  - /var/log/apache2/*.log
labels:
  type: apache2
---
#Generated acquisition file - wizard.sh (service: nginx) / files : /var/log/nginx/access.log /var/log/nginx/error.log
filenames:
 - /var/log/nginx/access.log
 - /var/log/nginx/error.log
labels:
  type: nginx
---
#Generated acquisition file - wizard.sh (service: sshd) / files : 
journalctl_filter:
  - _SYSTEMD_UNIT=sshd.service
labels:
   type: syslog
1 Like
3

Thanks @iiAmLoz it does work this way!
Have a nice day
Sincerely