# Notification another identifiing machine than id

**URL:** <https://discourse.crowdsec.net/t/notification-another-identifiing-machine-than-id/1284>\
**Category:** crowdsec\
**Created:** [May 8, 2023, 10:48am UTC](https://discourse.crowdsec.net/t/notification-another-identifiing-machine-than-id/1284 "2023-05-08T10:48:11Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![Cyrille37](https://avatars.discourse-cdn.com/v4/letter/c/90db22/32.png) [@Cyrille37](https://discourse.crowdsec.net/u/Cyrille37)\
**Post date:** [May 8, 2023, 10:48am UTC](https://discourse.crowdsec.net/t/notification-another-identifiing-machine-than-id/1284/1 "2023-05-08T10:48:11Z")

</div>

Hi there,

Is there another fashion to identify machine in notification with a more human readable way than the MachineID ?

Thanks for your lights 🙂

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [May 9, 2023, 8:41am UTC](https://discourse.crowdsec.net/t/notification-another-identifiing-machine-than-id/1284/2 "2023-05-09T08:41:13Z")

</div>

How many machines do you have? Crowdsec only know machineids but you can create a lookup table and map a machineid to a nicer name

---

<div class="post-metadata">

**Author:** ![Cyrille37](https://avatars.discourse-cdn.com/v4/letter/c/90db22/32.png) [@Cyrille37](https://discourse.crowdsec.net/u/Cyrille37)\
**Post date:** [May 9, 2023, 8:58am UTC](https://discourse.crowdsec.net/t/notification-another-identifiing-machine-than-id/1284/3 "2023-05-09T08:58:18Z")

</div>

Hello @iiAmLoz

I don’t like lookup table, not easy to maintains.

Can we access machine ENV variable from go\_template ?

Cheers

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [May 9, 2023, 9:10am UTC](https://discourse.crowdsec.net/t/notification-another-identifiing-machine-than-id/1284/4 "2023-05-09T09:10:41Z")

</div>

They already do via sprig [OS Functions | sprig](https://masterminds.github.io/sprig/os.html)

However, systemd has a sandbox feature that the service doesn’t have access to all environments so you will have to edit the service file to add the environment key you wish for it to have.

```auto
[Service]
Environment=HOSTNAME=MYHOSTNAME

```

Then inside the template you should be able to do

```auto
{{ env "HOSTNAME" }}

```

---

<div class="post-metadata">

**Author:** ![Cyrille37](https://avatars.discourse-cdn.com/v4/letter/c/90db22/32.png) [@Cyrille37](https://discourse.crowdsec.net/u/Cyrille37)\
**Post date:** [May 9, 2023, 10:42am UTC](https://discourse.crowdsec.net/t/notification-another-identifiing-machine-than-id/1284/5 "2023-05-09T10:42:24Z")

</div>

Argh!  
`HOSTNAME` is not present in system environment (`env |grep HOSTNAME` say nothing) but only present with bash (`echo $HOSTNAME` reply the hostname) ☹

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [May 9, 2023, 10:50am UTC](https://discourse.crowdsec.net/t/notification-another-identifiing-machine-than-id/1284/6 "2023-05-09T10:50:36Z")

</div>

Hence why I said you got to edit the environment within the service to add it.

---

<div class="post-metadata">

**Author:** ![Cyrille37](https://avatars.discourse-cdn.com/v4/letter/c/90db22/32.png) [@Cyrille37](https://discourse.crowdsec.net/u/Cyrille37)\
**Post date:** [May 9, 2023, 11:19am UTC](https://discourse.crowdsec.net/t/notification-another-identifiing-machine-than-id/1284/7 "2023-05-09T11:19:15Z")

</div>

I found a solution, without to modify Crowdsec’s published files 🙂

_(no need to add `Environment=` in the service file)_

Create the file `/etc/systemd/system-environment-generators/99-hostname.sh` with

```bash
#!/bin/sh
HOSTNAME=`hostname -f`
echo "HOSTNAME=${HOSTNAME}"

```

and `chmod +x` it.

_(of course, create folder `/etc/systemd/system-environment-generators` if does not exists)_

then

```auto
sudo systemctl daemon-reload
sudo systemctl restart crowdsec.service

```

Et HOP ! the go\_template directive `{{ env "HOSTNAME" }}` works like a charm 🙂

more info at [systemd.environment-generator](https://www.freedesktop.org/software/systemd/man/systemd.environment-generator.html)

---

<div class="post-metadata">

**Author:** ![Cyrille37](https://avatars.discourse-cdn.com/v4/letter/c/90db22/32.png) [@Cyrille37](https://discourse.crowdsec.net/u/Cyrille37)\
**Post date:** [May 9, 2023, 11:24am UTC](https://discourse.crowdsec.net/t/notification-another-identifiing-machine-than-id/1284/8 "2023-05-09T11:24:28Z")

</div>

My new Slack template is :

```auto
format: |
  from ({{ env "HOSTNAME" }}):
  {{range . -}}
   {{$alert := . -}}
   {{range .Decisions -}}
    {{if $alert.Source.Cn -}}
     :flag-{{$alert.Source.Cn}}: <https://www.whois.com/whois/{{.Value}}|{{.Value}}> ({{ $alert.Source.AsName }}) will>
    {{if not $alert.Source.Cn -}}
     :pirate_flag: <https://www.whois.com/whois/{{.Value}}|{{.Value}}> ({{ $alert.Source.AsName }}) will get {{.Type}}>
   {{end -}}
  {{end -}}

```

I use it to post on Mattermost with [incoming webhook](https://developers.mattermost.com/integrate/webhooks/incoming/).

---

<div class="post-metadata">

**Author:** ![Cyrille37](https://avatars.discourse-cdn.com/v4/letter/c/90db22/32.png) [@Cyrille37](https://discourse.crowdsec.net/u/Cyrille37)\
**Post date:** [May 10, 2023, 5:34pm UTC](https://discourse.crowdsec.net/t/notification-another-identifiing-machine-than-id/1284/9 "2023-05-10T17:34:49Z")

</div>

I came back after some times, more precisely after some reboot and … Grrrr ☹

It seems that the `system-environment-generators` it not run at boot time but only on `systemctl daemon-reload` that is not as expected… I’m searching a reason to make this solution effective.

So I’ll be back here as soon as 😉

---

<div class="post-metadata">

**Author:** ![Cyrille37](https://avatars.discourse-cdn.com/v4/letter/c/90db22/32.png) [@Cyrille37](https://discourse.crowdsec.net/u/Cyrille37)\
**Post date:** [May 10, 2023, 6:24pm UTC](https://discourse.crowdsec.net/t/notification-another-identifiing-machine-than-id/1284/10 "2023-05-10T18:24:45Z")

</div>

Hi @iiAmLoz

My solution with `system-environment-generators` doesn’t work at boot. After many reading I only found that `systemd` defines a “%H” variable, so your proposal can be updated like

```auto
[Service]
Environment=HOSTNAME=%H

```

That works after a reboot.

The mess is that we have to modify an official crowdsec distributed file ☹

---

<div class="post-metadata">

**Author:** ![Cyrille37](https://avatars.discourse-cdn.com/v4/letter/c/90db22/32.png) [@Cyrille37](https://discourse.crowdsec.net/u/Cyrille37)\
**Post date:** [May 10, 2023, 6:41pm UTC](https://discourse.crowdsec.net/t/notification-another-identifiing-machine-than-id/1284/11 "2023-05-10T18:41:36Z")

</div>

I created a pull request 😛

> <https://github.com/crowdsecurity/crowdsec/pull/2190>
>
> systemd define %H as the hostname. The hostname is human readable in notificatio…n message ;-)
> 
> Here is the discussion about different possible solution to make available the hostname in notification go\_template:
> https://discourse.crowdsec.net/t/notification-another-identifiing-machine-than-id/1284/
> 
> After different tries, this commit seems to be the simplest & efficient solution.
> 
> /area configuration
> /kind enhancement

---

<div class="post-metadata">

**Author:** ![Cyrille37](https://avatars.discourse-cdn.com/v4/letter/c/90db22/32.png) [@Cyrille37](https://discourse.crowdsec.net/u/Cyrille37)\
**Post date:** [May 11, 2023, 1:25pm UTC](https://discourse.crowdsec.net/t/notification-another-identifiing-machine-than-id/1284/12 "2023-05-11T13:25:46Z")

</div>

My PR was refused because is too Debian specifics, but devs added a function `Hostname()` helper available in expr and template ! 🙂

> <https://github.com/crowdsecurity/crowdsec/pull/2190#issuecomment-1543926416>
>
> We've merged https://github.com/crowdsecurity/crowdsec/pull/2193, which provides… a new \`Hostname()\` helper in both expr and the notification templates.
> 
> In the meantime, if you still want to get the hostname from the env, you can use \`systemctl edit crowdsec\` to add an override for the unit file and add the env var here (it will stay across upgrades).