Hi
I started to use Crowdsec a week ago to secure my hosted services. During the first week I got about 20 decisions from my configuration. All those decisions came from my NPMPlus (Nginx Proxy manager fork) collection and it’s logs.
After wednesday all the decisions from LAPI stopped. Logs are still being read and parsed, but I get no alerts or decisions. My configuration has not changed since the decisions stopped and everything seems perfectly functional.
So my question is mainly that what is the probable cause for this? All probing suddenly stopped? Those IPs were updated to CAPI and they are still blocked, but just not visible to me? My only real concern is that I just want to validate that my Crowdsec is still doing something and (as a newbie) I find it hard to validate. Only thing I really figured to do was set a manual block for one minute and it worked fine.
Additional info below:
LAPI
INFO Loaded credentials from /etc/crowdsec/local_api_credentials.yaml
INFO Trying to authenticate with username xxxxxxxxxxxxxxx on http://127.0.0.1:8080/
INFO You can successfully interact with Local API (LAPI)
CAPI
INFO Loaded credentials from /etc/crowdsec/online_api_credentials.yaml
INFO Trying to authenticate with username xxxxxxxxxxxxxxx on https://api.crowdsec.net/
INFO You can successfully interact with Central API (CAPI)
INFO Your instance is enrolled in the console
Bouncer Metrics
╭────────────────────────────┬──────────────────┬───────────────────┬───────────────────────╮
│ Origin │ active_decisions │ dropped │ processed │
│ │ IPs │ bytes │ packets │ bytes │ packets │
├────────────────────────────┼──────────────────┼─────────┼─────────┼───────────┼───────────┤
│ CAPI (community blocklist) │ 49.09k │ 1.12k │ 25 │ - │ - │
│ crowdsec (security engine) │ 0 │ 0 │ 0 │ - │ - │
│ cscli (manual decisions) │ 0 │ 300 │ 5 │ - │ - │
├────────────────────────────┼──────────────────┼─────────┼─────────┼───────────┼───────────┤
│ Total │ 49.09k │ 1.42k │ 30 │ 319.95M │ 402.43k │
╰────────────────────────────┴──────────────────┴─────────┴─────────┴───────────┴───────────╯