root@vaultwarden:/etc/crowdsec/parsers/s01-parse# cscli explain --file /var/lib/vaultwarden/data/access.log --type vaultwarden
WARN Line 0/6 is missing evt.StrTime. It is most likely a mistake as it will prevent your logs to be processed in time-machine/forensic mode.
WARN Line 1/6 is missing evt.StrTime. It is most likely a mistake as it will prevent your logs to be processed in time-machine/forensic mode.
WARN Line 2/6 is missing evt.StrTime. It is most likely a mistake as it will prevent your logs to be processed in time-machine/forensic mode.
WARN Line 3/6 is missing evt.StrTime. It is most likely a mistake as it will prevent your logs to be processed in time-machine/forensic mode.
WARN Line 4/6 is missing evt.StrTime. It is most likely a mistake as it will prevent your logs to be processed in time-machine/forensic mode.
WARN Line 5/6 is missing evt.StrTime. It is most likely a mistake as it will prevent your logs to be processed in time-machine/forensic mode.
line: [2024-08-31 02:10:24.865][vaultwarden::util][WARN] Can’t connect to database, retrying: DieselCon.
├ s00-raw
| ├ 
crowdsecurity/syslog-logs
| └ 
crowdsecurity/non-syslog (+5 ~8)
├ s01-parse
| ├ crowdsecurity/nginx-logs
| ├ crowdsecurity/sshd-logs
| └ Dominic-Wagner/vaultwarden-logs
└-------- parser failure
line: [CAUSE] BadConnection(
├ s00-raw
| ├ crowdsecurity/syslog-logs
| └ crowdsecurity/non-syslog (+5 ~8)
├ s01-parse
| ├ crowdsecurity/nginx-logs
| ├ crowdsecurity/sshd-logs
| └ Dominic-Wagner/vaultwarden-logs
└-------- parser failure
line: “connection to server at “localhost” (::1), port 5432 failed: Connection refused\n\tIs the server running on that host and accepting TCP/IP connections?\nconnection to server at “localhost” (127.0.0.1), port 5432 failed: Connection refused\n\tIs the server running on that host and accepting TCP/IP connections?\n”,
├ s00-raw
| ├ crowdsecurity/syslog-logs
| └ crowdsecurity/non-syslog (+5 ~8)
├ s01-parse
| ├ crowdsecurity/nginx-logs
| ├ crowdsecurity/sshd-logs
| └ Dominic-Wagner/vaultwarden-logs
└-------- parser failure
line: )
├ s00-raw
| ├ crowdsecurity/syslog-logs
| └ crowdsecurity/non-syslog (+5 ~8)
├ s01-parse
| ├ crowdsecurity/nginx-logs
| ├ crowdsecurity/sshd-logs
| └ Dominic-Wagner/vaultwarden-logs
└-------- parser failure
line: [2024-08-31 02:11:22.129][vaultwarden::api::identity][ERROR] Username or password is incorrect. Try again. IP: 80.187.85.94. Username: v@bdnej.de.
├ s00-raw
| ├ crowdsecurity/syslog-logs
| └ crowdsecurity/non-syslog (+5 ~8)
├ s01-parse
| ├ crowdsecurity/nginx-logs
| ├ crowdsecurity/sshd-logs
| └ Dominic-Wagner/vaultwarden-logs
└-------- parser failure
line: [2024-08-31 02:11:28.562][vaultwarden::api::identity][ERROR] Username or password is incorrect. Try again. IP: 80.187.85.94. Username: v@bdnej.de.
├ s00-raw
| ├ crowdsecurity/syslog-logs
| └ crowdsecurity/non-syslog (+5 ~8)
├ s01-parse
| ├ crowdsecurity/nginx-logs
| ├ crowdsecurity/sshd-logs
| └ Dominic-Wagner/vaultwarden-logs
└-------- parser failure
line: [2024-08-30 22:43:43.350][vaultwarden::api::identity][ERROR] Username or password is incorrect. Try again. IP: 109.40.240.81. Username: test@test.de.
├ s00-raw
| ├ crowdsecurity/syslog-logs
| └ crowdsecurity/non-syslog (+5 ~8)
├ s01-parse
| ├ crowdsecurity/nginx-logs
| ├ crowdsecurity/sshd-logs
| └ Dominic-Wagner/vaultwarden-logs (+11 ~2)
├ s02-enrich
| ├ crowdsecurity/dateparse-enrich (+2 ~2)
| ├ crowdsecurity/geoip-enrich (+13)
| ├ crowdsecurity/http-logs
| └ crowdsecurity/whitelists (unchanged)
├-------- parser success
├ Scenarios
├ Dominic-Wagner/vaultwarden-bf
└ Dominic-Wagner/vaultwarden-bf_user-enum
line: [2024-08-30 23:45:08.417][vaultwarden::util][WARN] Can’t connect to database, retrying: DieselCon.
├ s00-raw
| ├ crowdsecurity/syslog-logs
| └ crowdsecurity/non-syslog (+5 ~8)
├ s01-parse
| ├ crowdsecurity/nginx-logs
| ├ crowdsecurity/sshd-logs
| └ Dominic-Wagner/vaultwarden-logs
└-------- parser failure
line: )
├ s00-raw
| ├ crowdsecurity/syslog-logs
| └ crowdsecurity/non-syslog (+5 ~8)
├ s01-parse
| ├ crowdsecurity/nginx-logs
| ├ crowdsecurity/sshd-logs
| └ Dominic-Wagner/vaultwarden-logs
└-------- parser failure
line: [2024-08-31 00:58:28.644][vaultwarden::api::identity][ERROR] Username or password is incorrect. Try again. IP: 80.187.85.83. Username: v@redbbb.de.
├ s00-raw
| ├ crowdsecurity/syslog-logs
| └ crowdsecurity/non-syslog (+5 ~8)
├ s01-parse
| ├ crowdsecurity/nginx-logs
| ├ crowdsecurity/sshd-logs
| └ Dominic-Wagner/vaultwarden-logs
└-------- parser failure