# Is my setup working

**URL:** <https://discourse.crowdsec.net/t/is-my-setup-working/56>\
**Category:** Uncategorized\
**Created:** [November 6, 2020, 9:12am UTC](https://discourse.crowdsec.net/t/is-my-setup-working/56 "2020-11-06T09:12:52Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![amahhou](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/amahhou/32/101_2.png) [@amahhou](https://discourse.crowdsec.net/u/amahhou)\
**Post date:** [November 6, 2020, 9:12am UTC](https://discourse.crowdsec.net/t/is-my-setup-working/56/1 "2020-11-06T09:12:52Z")

</div>

Hi  
I am wondering if my setup is correct as I am not seeing any bans for few days  
 ![image](https://europe1.discourse-cdn.com/flex013/uploads/crowdsec/original/1X/d6b529bbd5c4b73ab9feb3b859cc758c80fb6e6f.png)  
 ![image](https://europe1.discourse-cdn.com/flex013/uploads/crowdsec/original/1X/d7e57afffcdc5e1f7200608d47158ce508759b9a.png)

 ![image](https://europe1.discourse-cdn.com/flex013/uploads/crowdsec/original/1X/7b0fb2925ac058837aee80064c8409f299643b97.png)

![image](https://europe1.discourse-cdn.com/flex013/uploads/crowdsec/original/1X/caf6733c0b61a9978e13ec29129acba5651d0e24.png)

---

<div class="post-metadata">

**Author:** ![amahhou](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/amahhou/32/101_2.png) [@amahhou](https://discourse.crowdsec.net/u/amahhou)\
**Post date:** [November 6, 2020, 9:36am UTC](https://discourse.crowdsec.net/t/is-my-setup-working/56/2 "2020-11-06T09:36:01Z")

</div>

![crowdsec](https://europe1.discourse-cdn.com/flex013/uploads/crowdsec/original/1X/531f073db3394d978e3bd16ca58b1a7c1d496578.jpeg)

---

<div class="post-metadata">

**Author:** ![thibault](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/thibault/32/2_2.png) [@thibault](https://discourse.crowdsec.net/u/thibault)\
**Post date:** [November 6, 2020, 10:01am UTC](https://discourse.crowdsec.net/t/is-my-setup-working/56/3 "2020-11-06T10:01:45Z")

</div>

Hello @amahhou !

> [@amahhou](#):
>
> I am wondering if my setup is correct as I am not seeing any bans for few days

Let’s check your metrics to see what is going on, and we’ll review it in the processing order :

 ![image](https://europe1.discourse-cdn.com/flex013/uploads/crowdsec/original/1X/8874fccc74feaba6db41849224adb1dac8f3be23.png)

From the acquisition point of view:

- You have two `apache` logs : one that produced only 36 lines (probably an error log ?) that haven’t been parsed, and the main one (probably an access log ?) that has produced 4.3K lines. 100% of those lines are parsed (as you can see `LINES PARSED` == `LINES READ`) so this is good. Furthermore, you can see that 2.1K of those lines were poured to bucket. It mean that they are not only parsed, but they even end up being poured to scenarios `LINES BEING POURED TO BUCKET`
- Your `kern.log` and `message.log` is mostly unparsed but it’s ok as you don’t have any specific parsers or scenarios for that
- Then you have your `auth.log` that has a lot of events (68K) but that aren’t parsed. If it’s supposed to be mostly ssh logs, you might have an issue here.

So on the acquisition aspect it seems ok, except the fact that `auth.log` has a lot of unparsed logs.

From the parsers point of view:  
 ![image](https://europe1.discourse-cdn.com/flex013/uploads/crowdsec/original/1X/2001bb3a513abf37636ac3bfb7922a81f53814f9.png)

What is relevant here is to check the ratio of `PARSED` to `UNPARSED`.  
Keep in mind that crowdsec only tries to parse what is relevant to its scenarios, so having `UNPARSED` messages isn’t alarming.

From the buckets point of view:

 ![image](https://europe1.discourse-cdn.com/flex013/uploads/crowdsec/original/1X/10fede0fd40e2c59c9f93844d732ce9df7979480.png)

- What is surprising is that you have so little `ssh-bruteforce` (ssh-bf & ssh-bf\_user-enum), but it might explain as well why there are so many unparsed lines in your auth.log. Any chance that you sshd isn’t publicly exposed ?
- The `http-*` scenarios seems to be ok, you can see that they were instanciated and poured (it means that some events elligible for this happened), they simply didn’t overflow
- Your main source of alerts seems to be postfix-spam

Overall, it seems to be OK from what I see in the metrics, can you just confirm that you don’t expose ssh publicly ?

---

<div class="post-metadata">

**Author:** ![amahhou](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/amahhou/32/101_2.png) [@amahhou](https://discourse.crowdsec.net/u/amahhou)\
**Post date:** [November 6, 2020, 11:21am UTC](https://discourse.crowdsec.net/t/is-my-setup-working/56/4 "2020-11-06T11:21:05Z")

</div>

Thank you for your reply it’s very clear

In my Auth.log I have some entries i wish i could parse

Nov 3 14:51:38 proftpd: pam\_unix(proftpd:auth): authentication failure; logname= uid=0 euid=0 tty=/dev/ftpd27769 ruser=www-data rhost=36.89.55.95 user=www-data

What should I do to fix the statement below  
/etc/systemd/system/crowdsec.service:6: PIDFile= references path below legacy directory /var/run/, updating /var/run/crowdsec.pid → /run/crowdsec.pid; please update the unit file accordingly.

saslauthd[722]: pam\_unix(smtp:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=

---

<div class="post-metadata">

**Author:** ![thibault](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/thibault/32/2_2.png) [@thibault](https://discourse.crowdsec.net/u/thibault)\
**Post date:** [November 6, 2020, 1:19pm UTC](https://discourse.crowdsec.net/t/is-my-setup-working/56/5 "2020-11-06T13:19:47Z")

</div>

Hey,

Glad this helped 🙂

Regarding your question for :

```auto
Nov 3 14:51:38 proftpd: pam_unix(proftpd:auth): authentication failure; logname= uid=0 euid=0 tty=/dev/ftpd27769 ruser=www-data rhost=36.89.55.95 user=www-data

```

We need to create a `proftpd` collection for this, with a parser (for logs) and a scenario (to detect such attacks), it doesn’t exist for now : [https://github.com/crowdsecurity/hub/issues/43](https://github.com/crowdsecurity/hub/issues/43)

If you are looking to create such a collection, please let me know I will gladly give you a hand !

And for :

```auto
/etc/systemd/system/crowdsec.service:6: PIDFile= references path below legacy directory /var/run/, updating /var/run/crowdsec.pid → /run/crowdsec.pid; please update the unit file accordingly.

```

I think it will be fixed in the coming release 🙂