# It works with a delay and doesn't ban

**URL:** <https://discourse.crowdsec.net/t/it-works-with-a-delay-and-doesnt-ban/1297>\
**Category:** crowdsec\
**Created:** [May 22, 2023, 3:12am UTC](https://discourse.crowdsec.net/t/it-works-with-a-delay-and-doesnt-ban/1297 "2023-05-22T03:12:40Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![ScreN](https://avatars.discourse-cdn.com/v4/letter/s/b77776/32.png) [@ScreN](https://discourse.crowdsec.net/u/ScreN)\
**Post date:** [May 22, 2023, 3:12am UTC](https://discourse.crowdsec.net/t/it-works-with-a-delay-and-doesnt-ban/1297/1 "2023-05-22T03:12:40Z")

</div>

Hi.

The docker has traefik, crowdsec, traefik-bouncer. The collections crowdsecurity/http-cve crowdsecurity/traefik LePresidente/authelia Dominic-Wagner/vaultwarden are installed. Logs are connected, crowdsec reads them correctly. But… It reads the logs, but it blocks not everyone and not always. I checked it on myself, it always blocks me at different intervals, sometimes with 6 tries, sometimes with 10, sometimes with 15.

Today I was looking through the logs, and this is what I saw

 ![1EvqOkMMwl](https://europe1.discourse-cdn.com/flex013/uploads/crowdsec/original/1X/c32a29f358f4bf34c031f8838556e35731dd9313.png)

 ![AQ7qA4tBv0](https://europe1.discourse-cdn.com/flex013/uploads/crowdsec/original/1X/6f09caf528496b658867e126ce9772332602b607.png)

 ![image_2023-05-22_11-21-44](https://europe1.discourse-cdn.com/flex013/uploads/crowdsec/original/1X/916a2d7223e0e94ec5f7bad7c54a77c7959977ea.png)

Is it normal that crowdsec misses this? Can it be configured more aggressively?

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [May 22, 2023, 8:50am UTC](https://discourse.crowdsec.net/t/it-works-with-a-delay-and-doesnt-ban/1297/2 "2023-05-22T08:50:38Z")

</div>

This is the concept of the leaky bucket, that events will pour over time so depending on how aggressive the “bad actor” is, is how fastthey will be banned. Not only that depending on how the bouncer is configured (Anything traefik is third party) will either have an internal timer or will be live. (Live is always faster than internal timer)

> Is it normal that crowdsec misses this?

What has CrowdSec missed? you can configured the scenarios to be more aggressive, however, this will likely increase your false positive rate.

> **[Format | CrowdSec](https://docs.crowdsec.net/docs/next/scenarios/format/)**
>
> Scenario configuration example

---

<div class="post-metadata">

**Author:** ![ScreN](https://avatars.discourse-cdn.com/v4/letter/s/b77776/32.png) [@ScreN](https://discourse.crowdsec.net/u/ScreN)\
**Post date:** [May 22, 2023, 9:12am UTC](https://discourse.crowdsec.net/t/it-works-with-a-delay-and-doesnt-ban/1297/3 "2023-05-22T09:12:41Z")

</div>

> [@iiAmLoz](#):
>
> What has CrowdSec missed? you can configured the scenarios to be more aggressive, however, this will likely increase your false positive rate.

CrowdSec seems to ban it. It’s some kind of smart scanner, even geoblock doesn’t catch it, and fail2ban 🙂

Nothing to worry about in principle? Is everything working as it should?

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [May 22, 2023, 9:18am UTC](https://discourse.crowdsec.net/t/it-works-with-a-delay-and-doesnt-ban/1297/4 "2023-05-22T09:18:48Z")

</div>

> Nothing to worry about in principle? Is everything working as it should?

Yes it seems so, Since you are using the traefik bouncer you will most likely see multiple alerts anyways since the connection is not dropped it just get a 401 or 403 (cant remember) status code

---

<div class="post-metadata">

**Author:** ![ScreN](https://avatars.discourse-cdn.com/v4/letter/s/b77776/32.png) [@ScreN](https://discourse.crowdsec.net/u/ScreN)\
**Post date:** [May 22, 2023, 9:23am UTC](https://discourse.crowdsec.net/t/it-works-with-a-delay-and-doesnt-ban/1297/5 "2023-05-22T09:23:33Z")

</div>

> [@iiAmLoz](#):
>
> Yes it seems so, Since you are using the traefik bouncer you will most likely see multiple alerts anyways since the connection is not dropped it just get a 401 or 403 (cant remember) status code

Thank you.

You still haven’t been able to reproduce the problem with the notification not working in Telegram?

[https://discourse.crowdsec.net/t/telegram-notification-bug/1268/17](https://discourse.crowdsec.net/t/telegram-notification-bug/1268/17)

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [May 22, 2023, 10:29am UTC](https://discourse.crowdsec.net/t/it-works-with-a-delay-and-doesnt-ban/1297/6 "2023-05-22T10:29:15Z")

</div>

Honestly no, but I can try replicate it now.

---

<div class="post-metadata">

**Author:** ![ScreN](https://avatars.discourse-cdn.com/v4/letter/s/b77776/32.png) [@ScreN](https://discourse.crowdsec.net/u/ScreN)\
**Post date:** [May 22, 2023, 10:31am UTC](https://discourse.crowdsec.net/t/it-works-with-a-delay-and-doesnt-ban/1297/7 "2023-05-22T10:31:39Z")

</div>

I still don’t understand why my notifications don’t work. I really don’t know where to look. I would really like to be able to keep track of bans

---

<div class="post-metadata">

**Author:** ![ScreN](https://avatars.discourse-cdn.com/v4/letter/s/b77776/32.png) [@ScreN](https://discourse.crowdsec.net/u/ScreN)\
**Post date:** [May 22, 2023, 11:57am UTC](https://discourse.crowdsec.net/t/it-works-with-a-delay-and-doesnt-ban/1297/8 "2023-05-22T11:57:37Z")

</div>

> [@iiAmLoz](#):
>
> Honestly no, but I can try replicate it now.

 ![8oHVnlIYmh](https://europe1.discourse-cdn.com/flex013/uploads/crowdsec/original/1X/02d60fbb83e93e73f875a138d620c8209360d31e.png)

Why an unsupported protocol scheme 😭

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [May 22, 2023, 1:03pm UTC](https://discourse.crowdsec.net/t/it-works-with-a-delay-and-doesnt-ban/1297/9 "2023-05-22T13:03:58Z")

</div>

I replied in other thread closing this.