Hello, I’ve been testing crowdsec for a while now, it’s working without problems, I just have a question about a warning log that appears only for internal traffic from 192.168.0.0/16 Since I have a lot of internal traffic, the log is quite large The log tells me this: time=“2024-06-06T13:46:10-0…

[image] dieg0nob: it’s normal this log ? Yes as its a private IP range the geo database doesnt have ranges for these IP’s

Can this warning be disabled somewhere? For context, these warnings make up 92% of my crowdsec.log.

Currently not as it written to logger which doesnt know the context. if it pains you lots you can download the pending updated parser to update it locally for now. Depending on where you run CrowdSec you can do the following curl -s https://raw.githubusercontent.com/crowdsecurity/hub/35fe453e8edc3…

I’m on 1.6.2 on pfSense. I am now bombarded by this kind of log entries non-stop. Is there any setting to make it go away? Sep 30 04:34:00 pfSense newsyslog[96306]: logfile turned over due to size>500K time=“2024-09-30T04:34:01+07:00” level=warning msg=“No range found for ip ‘fe80::1089:d2b5:4e7a:…

[image] europacafe: ‘fe80::1089:d2b5:4e7a:9a25’” id=cold-moon method=IpToRange name=crowdsecurity/geoip-enrich stage=s02-enrich Sep 30 04:34:00 pfSense newsyslog[96306]: logfile turned over due to size>500K time=“2024-09-30T04:33:55+07:00” level=warning msg=“No range found for ip ‘fe80::8be:14…

I’m seeing similar messages : time="2025-07-15T20:29:53+02:00" level=error msg="Unable to enrich ip '10.0.10.2, 10.0.10.71, 10.0.10.40'" id=icy-fog method=IpToRange name=crowdsecurity/geoip-enrich stage=s02-enrich time="2025-07-15T20:29:53+02:00" level=error msg="Unable to enrich ip '10.0.10.2, 10.…

Yes it seems the application that is producing those isn’t setting just a single IP, we expect in logs to only have a single address. Are you using traefik with an upstream proxy?

Oh, so it’s a different error, thanks, I didn’t even notice there was several IP addresses. I’m not really using another proxy, my traefik runs in docker on a bridge network, and is bound to a VIP I have setup using keepalived. My router also does port forwarding to the VIP. Indeed in these logs 1…

Logs crowdsec crowdsecurity/geoip-enrich

crowdsec

iiAmLoz June 7, 2024, 8:22am 2

Yes as its a private IP range the geo database doesnt have ranges for these IP’s

Topic		Replies	Views
Log-Files filled with "Unable to enrich ip '-'" crowdsec	1	110	August 27, 2024
No decisions for the scope crowdsec	9	1296	December 8, 2021
New to crowdSec, some questions crowdsec	11	3650	March 18, 2021
Ten thousands of log entries in crowdsec.log crowdsec	1	65	October 27, 2024
Nginx-proxy-manager+crowdsec (Docker) ban only local crowdsec	26	1826	February 6, 2024

Logs crowdsec crowdsecurity/geoip-enrich

Related topics