# Issue with Apache / modsec - replay

**URL:** <https://discourse.crowdsec.net/t/issue-with-apache-modsec-replay/568>\
**Category:** Uncategorized\
**Created:** [January 24, 2022, 5:59am UTC](https://discourse.crowdsec.net/t/issue-with-apache-modsec-replay/568 "2022-01-24T05:59:47Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![dimmthewitted](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/dimmthewitted/32/266_2.png) [@dimmthewitted](https://discourse.crowdsec.net/u/dimmthewitted)\
**Post date:** [January 24, 2022, 5:59am UTC](https://discourse.crowdsec.net/t/issue-with-apache-modsec-replay/568/1 "2022-01-24T05:59:47Z")

</div>

No matching files for pattern access\_log Trying to replay against old data. Error while loading acquisition config

Trying to import old log files (replay) when website was undergoing authentication brute force attempts with numerous modsec rules flag we can get approval installing Crowdsec to production.

Using Apache with modsecurity on web server.  
I have apache2 and modsecurity latest collections installed.

Apache logs are not in default location.  
crowdsec -dsn file://var/log/httpd/nonStandard/access\_log-20211215 -type apache

FATA[23-01-2022 21:56:28] crowdsec init: Error while loading acquisition config : failed to configure datasource for file://var/log/httpd/nonStandard/access\_log-20211215 : while configuration datasource for file://var/log/httpd/nonStandard/access\_log-20211215 : no matching files for pattern var/log/httpd/nonStandard/access\_log-20211215

Do I need to make a tweak to the Apache and Modsec yaml to look for the log names?  
/etc/crowdsec/collections/apache2.yaml  
/etc/crowdsec/collections/modsecurity.yaml

Do I need to edit the pattern file?  
Looks like:  
/etc/crowdsec/patterns/modsecurity  
Already matches pattern sytntax:  
[https://hub.crowdsec.net/author/crowdsecurity/configurations/modsecurity](https://hub.crowdsec.net/author/crowdsecurity/configurations/modsecurity)

I don’t seem to have an apache / httpd pattern file despite the collections are installed.

 ![image](https://europe1.discourse-cdn.com/flex013/uploads/crowdsec/original/1X/1fceb8cf541d6dc003ba63cf3b8bb31d967389af.jpeg)

Any documentation?

---

<div class="post-metadata">

**Author:** ![alteredCoder](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/alteredcoder/32/44_2.png) [@alteredCoder](https://discourse.crowdsec.net/u/alteredCoder)\
**Post date:** [January 24, 2022, 2:55pm UTC](https://discourse.crowdsec.net/t/issue-with-apache-modsec-replay/568/2 "2022-01-24T14:55:42Z")

</div>

Hello,

The DSN that you provided is not good, you forgot a `/` at the begining of your log file path.  
Can you try with:

```auto
crowdsec -dsn 'file:///var/log/httpd/nonStandard/access_log-20211215' -type apache

```

---

<div class="post-metadata">

**Author:** ![klausagnoletti](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/klausagnoletti/32/201_2.png) [@klausagnoletti](https://discourse.crowdsec.net/u/klausagnoletti)\
**Post date:** [January 26, 2022, 4:38pm UTC](https://discourse.crowdsec.net/t/issue-with-apache-modsec-replay/568/4 "2022-01-26T16:38:21Z")

</div>

Do you still need help on this?

---

<div class="post-metadata">

**Author:** ![dimmthewitted](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/dimmthewitted/32/266_2.png) [@dimmthewitted](https://discourse.crowdsec.net/u/dimmthewitted)\
**Post date:** [January 27, 2022, 11:20pm UTC](https://discourse.crowdsec.net/t/issue-with-apache-modsec-replay/568/5 "2022-01-27T23:20:33Z")

</div>

Thank you.

I see decisions now listed from crowdsecurity/modsecurity

---

<div class="post-metadata">

**Author:** ![klausagnoletti](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/klausagnoletti/32/201_2.png) [@klausagnoletti](https://discourse.crowdsec.net/u/klausagnoletti)\
**Post date:** [January 28, 2022, 9:30am UTC](https://discourse.crowdsec.net/t/issue-with-apache-modsec-replay/568/6 "2022-01-28T09:30:59Z")

</div>

Great! Thanks for posting!