Http-plugin configuration (group_wait and group_threshold) problem

crowdsec
1

Hi !

I have problem with it. Maybe I don’t understand it well (or documentation is not clear…)

In my understanding :

# group_wait: # duration to wait collecting alerts before sending to this plugin, eg "30s"

It will send any “stored” alerts every 30s to the notification plugin (sending every x seconds)

# group_threshold: # if alerts exceed this, then the plugin will be sent the message. eg "10"

If we reach 10 alerts, it will send the alerts. (sending every x alerts)

But when I check my debug log, I see the http post is done after each alert !

(obviously I do a crowdsec restart after each modification)

I was hoping to group send the alerts, to bypass the too many open files issue (see other thread Too many open files on http-plugin - #2 by Foxinou35)

2

Hello @Foxinou35

How often do the alerts happen ? I think the grouping is “either of the two conditions is matched first”

3

3s, 6s, 8s, etc etc I mean I tried to set

group_threshold: 50 # if alerts exceed this, then the plugin will be sent the message. eg "10"

but I got notification on each alert… so it seems it is not working…

edit : group_wait seems to work but not group_theshhold

image
image666×654 34.5 KB

Can you confirm what I said in my first post ? Do I understand well ?

4

@Foxinou35 thanks for finding this issue. I’ve created a PR at Fix plugin default config to support group threshold by sbs2001 · Pull Request #1424 · crowdsecurity/crowdsec · GitHub to fix this.