Service Crowdsec cant start on Windows

crowdsec
1

i can not start services Crowdsec on Windows. How can start it ??

image

2

Hello,

Can you paste the crowdsec logs please?
They are located in C:\ProgramData\CrowdSec\log

3

Hi, AlteredCoder

If use default config acquis.yaml. i can start service crowdsec. But i add more config for iis so it cant start

source: wineventlog
event_channel: Application
event_ids:

  • 18456
    event_level: information
    labels:
    type: eventlog

use_time_machine: true
filenames:

  • C:\inetpub\logs\LogFiles\\.log
    labels:
    type: iis
4

Hello,

Can you show me the crowdsec logs please? Without this i can’t see what error is occuring

5

Hi AlteredCoder,

I so sorry about my late

This is error log

image
image1385×145 4.84 KB

What wrong is my config ?

6

Hello, can you paste your acquis.yaml file in a block code please? so we can see that is the formatting error

7

Hi AlteredCoder,

My acquis.yml :
source: wineventlog
event_channel: Microsoft-IIS-Logging/Logs
event_ids:

  • 6200
    event_level: information
    labels:
    type: iis

use_time_machine: true
filenames:

  • C:\inetpub\logs\LogFiles\\.log
    labels:
    type: iis

image

8

Hello,

Can you try to put only --- as a separator please?

9

Hi,

I tried 2 options:

  • remove "---- " —> not working :frowning:
  • remove “----” and space —> not working :frowning:

image
image1570×544 56.7 KB

10

In yaml, the separator is --- so can you please use --- to separe the 2 yaml blocs ?

11

Hi AlteredCoder,

I solved the problem. Before “—” have a white space, i copy/paste from blog but don’t paying this attention.

Thanks your supporting