# File notification plugin on k8s

**URL:** <https://discourse.crowdsec.net/t/file-notification-plugin-on-k8s/1748>\
**Category:** crowdsec\
**Created:** [April 5, 2024, 9:55am UTC](https://discourse.crowdsec.net/t/file-notification-plugin-on-k8s/1748 "2024-04-05T09:55:51Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![rainbow](https://avatars.discourse-cdn.com/v4/letter/r/7993a0/32.png) [@rainbow](https://discourse.crowdsec.net/u/rainbow)\
**Post date:** [April 5, 2024, 9:55am UTC](https://discourse.crowdsec.net/t/file-notification-plugin-on-k8s/1748/1 "2024-04-05T09:55:51Z")

</div>

Hello,

I got some issue on installing the file notification plugin lastly ☹ .  
So first of all i rechecked all my config:

I’m running amd64 so i downloaded the plugin with :

wget -qO- [https://github.com/zbalkan/notification-file/releases/download/0.1.1/notification-file\_0.1.1\_linux\_amd64.tar.gz](https://github.com/zbalkan/notification-file/releases/download/0.1.1/notification-file_0.1.1_linux_amd64.tar.gz) | tar -xz

and i deleted the Readme ( rm README.md )

I got my rights well tuned:

 ![image](https://europe1.discourse-cdn.com/flex013/uploads/crowdsec/original/1X/b46c0928e72fd2cf2bd5b99a3d7bbf7057f8c300.png)

I registered the plugin in my profile.yaml:

 ![image](https://europe1.discourse-cdn.com/flex013/uploads/crowdsec/original/1X/ba6bbd004caa8d021cbbc530e0034baf9f7ad1f6.png)

I got my configuration file:

 ![image](https://europe1.discourse-cdn.com/flex013/uploads/crowdsec/original/1X/9eba537445f30bf88d439ecf5a5fe9fe027c7fbc.png)

BUT i got this error when i restart the service (BTW i’m not sure if this is the good way to restart the service) :

 ![image](https://europe1.discourse-cdn.com/flex013/uploads/crowdsec/original/1X/979c75020fea3828447fe182988f93b95712a3f8.png)

What am I missing ?

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [April 5, 2024, 10:06am UTC](https://discourse.crowdsec.net/t/file-notification-plugin-on-k8s/1748/2 "2024-04-05T10:06:13Z")

</div>

if you restart the container unless you are persisting that folder it will be lost. You have to build a custom container image for that to work or create a persistent storage.

why do you want to write these alerts to a file contained within an container?

---

<div class="post-metadata">

**Author:** ![rainbow](https://avatars.discourse-cdn.com/v4/letter/r/7993a0/32.png) [@rainbow](https://discourse.crowdsec.net/u/rainbow)\
**Post date:** [April 5, 2024, 10:19am UTC](https://discourse.crowdsec.net/t/file-notification-plugin-on-k8s/1748/3 "2024-04-05T10:19:48Z")

</div>

Ok i see i’m just doing some test and i wanted to avoid the part where i mess around with a custom image and the helm chart 🙂

The finality of installing the file notification plugin is to write the alerts on /dev/stdout in order to pick them with vector.

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [April 8, 2024, 11:36am UTC](https://discourse.crowdsec.net/t/file-notification-plugin-on-k8s/1748/4 "2024-04-08T11:36:53Z")

</div>

Just a quick fyi, I made an “official” file plugin [feat: File notification plugin by LaurenceJJones · Pull Request #2932 · crowdsecurity/crowdsec · GitHub](https://github.com/crowdsecurity/crowdsec/pull/2932) that should be shipped by default

---

<div class="post-metadata">

**Author:** ![rainbow](https://avatars.discourse-cdn.com/v4/letter/r/7993a0/32.png) [@rainbow](https://discourse.crowdsec.net/u/rainbow)\
**Post date:** [April 24, 2024, 8:44am UTC](https://discourse.crowdsec.net/t/file-notification-plugin-on-k8s/1748/5 "2024-04-24T08:44:02Z")

</div>

hooo that’s awsome !

I just checked if the last version of crowdsec is shipped with the new “official” plugin but i didn’t find it yet.

i found that my version is 1.6.1  
 ![image](https://europe1.discourse-cdn.com/flex013/uploads/crowdsec/original/1X/ea8a985d8d5cbf6e71c0fd36cd1beb5025c0466d.png)

And i’m guessing that th new official plugin will be out on the 1.6.2

![image](https://europe1.discourse-cdn.com/flex013/uploads/crowdsec/original/1X/ad1592e155c572f4c352ea93f72cf0e199cc6801.png)

If i’m right, do you know when this version will be out ? i’m just thrilled to check that ! 🙂

Thank’s a lot for your work !!!

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [April 24, 2024, 1:59pm UTC](https://discourse.crowdsec.net/t/file-notification-plugin-on-k8s/1748/6 "2024-04-24T13:59:37Z")

</div>

Yes, however, once it is merged you can point to the `dev` tag whilst we do the release cycle.

---

<div class="post-metadata">

**Author:** ![rainbow](https://avatars.discourse-cdn.com/v4/letter/r/7993a0/32.png) [@rainbow](https://discourse.crowdsec.net/u/rainbow)\
**Post date:** [June 3, 2024, 8:29am UTC](https://discourse.crowdsec.net/t/file-notification-plugin-on-k8s/1748/7 "2024-06-03T08:29:39Z")

</div>

Hello !

First of all, thanks for your work, my setup works and I’m just coming back to share what I did (maybe it can help someone else who knows).

So I’m using the crowdsec/crowdsec helm chart in order to deploy crowdsec on kubernetes and I just needed to redirect the alerts to the standard output of the lapi pod in order to retrieve them with a log collector (vector).

Here’s the values.yaml I’m using:

```auto
image:
  # -- docker image repository name
  repository: crowdsecurity/crowdsec
  # -- pullPolicy
  pullPolicy: IfNotPresent
  # -- docker image tag
  tag: "dev"

container_runtime: containerd
agent:
  # To specify each pod you want to process it logs (pods present in the node)
  additionalAcquisition: []
    # - source: kinesis
    # stream_name: my-stream
    # labels:
    # type: mytype
    # - source: syslog
    # listen_addr: 127.0.0.1
    # listen_port: 4242
    # labels:
    # type: syslog

  acquisition:
    # The namespace where the pod is located
    - namespace: crowd-test
      # The pod name
      podName: ingress-crowd-test-ingress-nginx-controller-*
      # as in crowdsec configuration, we need to specify the program name so the parser will match and parse logs
      program: nginx
    - namespace: crowd-test
      # The pod name
      podName: ingress-crowd-test-ingress-nginx-controller-*

  # Those are ENV variables
  env:
  # As it's a test, we don't want to share signals with CrowdSec so disable the Online API.
  - name: DISABLE_ONLINE_API
    value: "true"
  # As we are running Nginx, we want to install the Nginx collection
  - name: COLLECTIONS
    value: "crowdsecurity/nginx"
  - name: DISABLE_PARSERS
    value: "crowdsecurity/whitelists"
lapi:
  env:
    # As it's a test, we don't want to share signals with CrowdSec, so disable the Online API.
    - name: DISABLE_ONLINE_API
      value: "true"
config:
  config.yaml.local: |
# here I needed to run the plugin with root privilege in order to write in /proc/1/fd/1
    plugin_config:
      user: "root"
      group: "root"
    # db_config:
    # type: postgresql
    # user: crowdsec
    # password: ${DB_PASSWORD}
    # db_name: crowdsec
    # host: 192.168.0.2
    # port: 5432
    # sslmode: require

    # -- notifications configuration (https://docs.crowdsec.net/docs/next/notification_plugins/intro)
  notifications: 
    files.yaml: |
      type: file
      name: file_default # this must match with the registered plugin in the profile
      log_level: info # Options include: trace, debug, info, warn, error, off
      # This template render all events as ndjson
      format: |
        {{range . -}}
        { "time": "{{.StopAt}}", "program": "crowdsec", "alert": {{. | toJson }} }
        {{ end -}}
      # you can't write on /dev/stdout because only the process with PID 1 will give output on k8s
      log_path: "/proc/1/fd/1"
      rotate:
        enabled: false # Change to false if you want to handle log rotate on system basis
        max_size: 500
        max_files: 5
        max_age: 5
        compress: true
      log_format:
        custom_format: "%msg%" # https://github.com/t-tomalak/logrus-easy-formatter
  profiles.yaml:
     |
    name: default_ip_remediation
    #debug: true
    filters:
    - Alert.Remediation == true && Alert.GetScope() == "Ip"
    decisions:
    - type: ban
      duration: 4h
    duration_expr: Sprintf('%dh', (GetDecisionsCount(Alert.GetValue()) + 1) * 4)
    notifications:
      - file_default
    on_success: break

```

I’m aware that it’s a bit of a messy solution but at the moment I haven’t found another way to do it, if you have any suggestions I’m open to that.