# Parsing of the Vaultwarden logs

**URL:** <https://discourse.crowdsec.net/t/parsing-of-the-vaultwarden-logs/2695>\
**Category:** Uncategorized\
**Created:** [September 27, 2025, 7:56am UTC](https://discourse.crowdsec.net/t/parsing-of-the-vaultwarden-logs/2695 "2025-09-27T07:56:07Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Eirikr70](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/eirikr70/32/382_2.png) [@Eirikr70](https://discourse.crowdsec.net/u/Eirikr70)\
**Post date:** [September 27, 2025, 7:56am UTC](https://discourse.crowdsec.net/t/parsing-of-the-vaultwarden-logs/2695/1 "2025-09-27T07:56:07Z")

</div>

Hello,

I have set up the Vaultwarden scenario by Dominic Wagner. I have set the logging system at the format proposed on the hub. The scenario is active and reads the logs but seems to be unable to parse them.

cscli metrics  
`╭─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮ `  
`│ Acquisition Metrics │ `  
`├───────────────────────────────────────────┬────────────┬──────────────┬────────────────┬────────────────────────┬───────────────────┤ `  
`│ Source │ Lines read │ Lines parsed │ Lines unparsed │ Lines poured to bucket │ Lines whitelisted │ `  
`├───────────────────────────────────────────┼────────────┼──────────────┼────────────────┼────────────────────────┼───────────────────┤ `  
`│ docker:immich_server │ 1.14k │ - │ 1.14k │ - │ - │ `  
`│ file:/var/log/mail.log │ 109 │ 48 │ 61 │ - │ 48 │ `  
`│ file:/var/log/nginx/access.log │ 36.84k │ 36.84k │ 6 │ 1.89k │ 35.80k │ `  
`│ file:/var/log/nginx/error.log │ 1.39k │ 40 │ 1.35k │ 23 │ - │ `  
`│ file:/var/log/nginx/unauthorized.log │ 6 │ 6 │ - │ - │ 6 │ `  
`│ file:/var/log/vaultwarden/vaultwarden.log │ 121 │ - │ 121 │ - │ - │ `  
`╰───────────────────────────────────────────┴────────────┴──────────────┴────────────────┴────────────────────────┴───────────────────╯`

Did I miss something or is it dedicated to parsing only “bad logs” ?

Thank you

---

<div class="post-metadata">

**Author:** ![iiAmLoz](https://dub1.discourse-cdn.com/flex013/user_avatar/discourse.crowdsec.net/iiamloz/32/386_2.png) [@iiAmLoz](https://discourse.crowdsec.net/u/iiAmLoz)\
**Post date:** [September 28, 2025, 6:24am UTC](https://discourse.crowdsec.net/t/parsing-of-the-vaultwarden-logs/2695/2 "2025-09-28T06:24:35Z")

</div>

> [@Eirikr70](#):
>
> is it dedicated to parsing only “bad logs” ?

Yes the [parser](https://app.crowdsec.net/hub/author/Dominic-Wagner/log-parsers/vaultwarden-logs) is only looking for failed auth or failed mfa logins, general logs or valid authentications do not get parsed.