Nextcloud AIO logs wont be parsed

1

Hey,

Trying to setup crowdsec for Nextcloud AIO (GitHub - nextcloud/all-in-one: 📦 The official Nextcloud installation method. Provides easy deployment and maintenance with most features included in this one Nextcloud instance.) where the access log is saved on host /var/lib/docker/volumes/nextcloud_aio_nextcloud/_data/data/nextcloud.log which is owned by www-data.

I set to acquis.yaml but nothing is going to be parsed. Maybe because the directory is accessable to www-data?

---
filenames:
 - /var/lib/docker/volumes/nextcloud_aio_nextcloud/_data/data/nextcloud.log
labels:
  type: Nextcloud
---
2

Where is CrowdSec running on the host in a container or on the host itself?

typically the CrowdSec runs as root so permissions shouldn’t be an issue

edit: I saw this was also raised on nextcloud discourse from the acquisition I can see it most likely a host installation. Could you check /var/log/crowdsec.log and see if it mentions that it finds the file?