Issue when installing crowdsec on debian

crowdsec
1

When installing crowdsec on debian 12 through the package manager I get several error messages

WARN can’t load CAPI credentials from ‘/etc/crowdsec/online_api_credentials.yaml’ (missing field)
WARN You are using sqlite without WAL, this can have a performance impact. If you do not store the database in a network share, set db_config.use_wal to true. Set explicitly to false to disable this warning.
WARN can’t load CAPI credentials from ‘/etc/crowdsec/online_api_credentials.yaml’ (missing field)
WARN You are using sqlite without WAL, this can have a performance impact. If you do not store the database in a network share, set db_config.use_wal to true. Set explicitly to false to disable this warning
WARN Run ‘sudo systemctl reload crowdsec’ for the new configuration to be effective.
dpkg: error processing package crowdsec (–configure):
installed crowdsec package post-installation script subprocess returned error exit status 1
Errors were encountered while processing:
crowdsec

I have looked for a crowdsec log and there is none. Journalctl only states that the service finished with a failure. Using the systemctl reload command does nothing since the service is not running. I suspect this is an issue that is caused by a previous install on this system, but I cannot figure out how to get it to run again. When I removed it before, I had used a purge flag, so there were no remaining crowsec files on the system. Can anyone help me figure out what I’m doing wrong?

2

My honest opinion would be to purge and delete all files, then reinstall

sudo apt purge crowdsec -y
rm -rf /etc/crowdsec
rm -rf /var/lib/crowdsec/data

Then all files should be removed.

3

I verified that those folders were removed during the uninstall. I just ran those commands again because I am completely stumped, and there is no change.

4

Then there a possibility there are two binaries, can you provide output of

which -a crowdsec
which -a cscli
5

You are correct. the output of
which -a crowdsec is

/usr/bin/crowdsec
/bin/crowdsec

The second time I installed crowdsec, I used the bash script from Linux | CrowdSec.

When I run apt install crowdsec I get both binaries. I tried removing the crowdsec file from /etc/apt/sources.list.d updating apt and re-installing. Despite these steps I’m still getting both binaries when I install crowdsec with apt. It appears to be a hard link between these two locations.

Since removing the apt source file I no longer get warnings when installing crowdsec, however, I cannot get the service to start. If I run the binary from the shell using sudo it seems to run fine. The logs are generated and I can follow them. But when starting the service, there are no logs generated.

6

What is the output of systemctl cat crowdsec.service

7 
# /etc/systemd/system/crowdsec.service
[Unit]
Description=Crowdsec agent
After=syslog.target network.target remote-fs.target nss-lookup.target

[Service]
Type=notify
Environment=LC_ALL=C LANG=C
ExecStartPre=/usr/local/bin/crowdsec -c /etc/crowdsec/config.yaml -t -error
ExecStart=/usr/local/bin/crowdsec -c /etc/crowdsec/config.yaml
#ExecStartPost=/bin/sleep 0.1
ExecReload=/bin/kill -HUP $MAINPID
Restart=always
RestartSec=60

[Install]
WantedBy=multi-user.target
8

Thank you for pointing me in the right direction. I purged crowdsec again and found that the service file for crowdsec was somehow still in /etc/systemd/system. I manually removed the file, ran systemctl daemon-reload, reinstalled, and now the service is running as expected. My trouble shooting skills clearly need work. Thank you for your help.

I ran the install script from Linux | CrowdSec again and it installed crowdsec with the same warnings again but is actually running, as expected, on the latest version.