# Have CrowdSec container read journald messages from host

**URL:** <https://discourse.crowdsec.net/t/have-crowdsec-container-read-journald-messages-from-host/1334>\
**Category:** crowdsec\
**Created:** [June 30, 2023, 5:16am UTC](https://discourse.crowdsec.net/t/have-crowdsec-container-read-journald-messages-from-host/1334 "2023-06-30T05:16:59Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![glassman](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/glassman/32/637_2.png) [@glassman](https://discourse.crowdsec.net/u/glassman)\
**Post date:** [June 30, 2023, 5:17am UTC](https://discourse.crowdsec.net/t/have-crowdsec-container-read-journald-messages-from-host/1334/1 "2023-06-30T05:17:00Z")

</div>

Since the release of debian 12, it seems you cannot use the usual method to read syslog files from /var/log anymore. Instead, you have to use journalctl, so there’s a support article detailing how to modify `acquis.yaml` to include those logs using the method [here](https://docs.crowdsec.net/docs/data_sources/journald/).

What I’m unsure of is how to bring these logs into the docker container running crowdsec so that they may be read. Is it some sort of bind mount? I already have /var/log mounted to the container, and I thought that’s where the system journal resided. Or is there some other way I’m not aware of?

I probably should also mention that if I add the journalctl section into the acquis.yml file as shown in the link, my reverse proxy (Traefik) will not permit me to any of my sites. I get a 403 error. I assume this has something to do with forwardAuth and the Traefik bouncer, but why that would have anything to do with my acquisition yml, I don’t know:

```auto
source: journalctl
journalctl_filter:
  - "_SYSTEMD_UNIT=ssh.service"
labels:
  type: syslog
---
filenames:
  - /traefik/log/*
labels:
  type: "traefik"
---
filenames:
  - /authelia/log/*

```

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [June 30, 2023, 8:35am UTC](https://discourse.crowdsec.net/t/have-crowdsec-container-read-journald-messages-from-host/1334/2 "2023-06-30T08:35:01Z")

</div>

The reason you are getting 403 from traefik is because if you container isnt the debian one it doesnt have jounalctl binary so it will crash the container and if the bouncer doesnt get a response from CrowdSec it will return 403 by default.

So question is are you using the debian container?

---

<div class="post-metadata">

**Author:** ![glassman](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/glassman/32/637_2.png) [@glassman](https://discourse.crowdsec.net/u/glassman)\
**Post date:** [June 30, 2023, 9:58pm UTC](https://discourse.crowdsec.net/t/have-crowdsec-container-read-journald-messages-from-host/1334/3 "2023-06-30T21:58:20Z")

</div>

You’re absolutely right. I wasn’t aware there was another Debian-based container available, or that the default is Alpine. Thank you.

Edit:

Although @iiAmLoz is correct, it didn’t completely solve my issue. Make sure that if you have your journal file being written to `/var/log`, that you bind mount `/var/log` on your host to `/run/log` inside the container. For the time being, it seems the current image only expects the `system.journal` file to exist in `/run/log/journal/...`

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [July 1, 2023, 1:11pm UTC](https://discourse.crowdsec.net/t/have-crowdsec-container-read-journald-messages-from-host/1334/4 "2023-07-01T13:11:42Z")

</div>

Please find rest of [thread here](https://discord.com/channels/921520481163673640/1124091541519089715)

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [July 1, 2023, 1:11pm UTC](https://discourse.crowdsec.net/t/have-crowdsec-container-read-journald-messages-from-host/1334/5 "2023-07-01T13:11:50Z")

</div>