Is my caddy setup missing anything? | CrowdSec | Page 1

shrewd quiver Aug 4, 2025, 12:11 PM

#

Hey again,
When running cscli metrics I can't see any scenario metrics while on my other machines it works just fine.
is this a normal behavior?

I know that caddy bouncer don't have metrics atm, is this why its emtpy?

rain bearBOT Aug 4, 2025, 12:11 PM

#

Important Information

Thank you for getting in touch with your support request. To expedite a swift resolution, could you kindly provide the following information? Rest assured, we will respond promptly, and we greatly appreciate your patience. While you wait, please check the links below to see if this issue has been previously addressed. If you have managed to resolve it, please use run the command /resolve or press the green resolve button below.

Log Files

If you possess any log files that you believe could be beneficial, please include them at this time. By default, CrowdSec logs to /var/log/, where you will discover a corresponding log file for each component.

Guide Followed (CrowdSec Official)

If you have diligently followed one of our guides and hit a roadblock, please share the guide with us. This will help us assess if any adjustments are necessary to assist you further.

Screenshots

Please forward any screenshots depicting errors you encounter. Your visuals will provide us with a clear view of the issues you are facing.

shrewd quiver Aug 4, 2025, 12:13 PM

#

I had my test traefik running for a day and its showing a lot of metrics for different scenarios,

mint basalt Aug 4, 2025, 12:53 PM

#

shrewd quiver Hey again, When running cscli metrics I can't see any scenario metrics while on...

No metrics has no impact on what scenarios match.

Most likely the 300 requests have not matched any other scenarios than http crawl non statics.

shrewd quiver Aug 4, 2025, 4:41 PM

#

the reason im asking is because I been running caddy wiht crowdsec for months, but after 3 days with traefik im getting multiple bans. That's why im curious if my configuration is wrong with caddy 😅

#

I had the same kind of bans running crowdsec on npmplus, but not on caddy since i switched

shrewd quiver Aug 5, 2025, 7:16 PM

#

Any idea? 🙂

mint basalt Aug 6, 2025, 2:30 PM

#

shrewd quiver Any idea? 🙂

no idea without anymore information from what I see, you only got 700 requests and its a rather small set to come to conclusion that something wrong.

try running explain, try see if you have all scenarios installed etc etc

shrewd quiver Aug 6, 2025, 4:39 PM

#

Yes, all collections and scenarios are identical. No idea why it’s acting that way 🤷🏽‍♂️

shrewd quiver Aug 8, 2025, 10:58 AM

#

I went over to Npmplus, after 4 hours i got some bans and scenarios,

#

I think the caddy bouncer can't pars the logs

mint basalt Aug 8, 2025, 11:13 AM

#

shrewd quiver I think the caddy bouncer can't pars the logs

well bouncers dont parse logs, the engine does

shrewd quiver Aug 8, 2025, 11:25 AM

#

sorry. then something else is wrong with my setup on caddy 😅 we can leave it if you don't wanna troubleshoot it

mint basalt Aug 8, 2025, 11:25 AM

#

I rechecked the caddy parser just to see if we missed anything, and everything lines up with the scenarios

shrewd quiver Aug 8, 2025, 11:25 AM

#

thank you for the help as always 🙏🏽

mint basalt Aug 8, 2025, 11:25 AM

#

its not that I dont want to debug it, your just not providing any information to debug

#

cscli metrics only shows limited information, you need to run cscli explain or put the acquisition into debug mode so we can see more information

shrewd quiver Aug 8, 2025, 11:28 AM

#

Like this?
cscli explain --file /var/log/caddy/access.log --type caddy

mint basalt Aug 8, 2025, 11:29 AM

#

Personally just so we dont have to filter it just do this

cscli explain --file /var/log/caddy/access.log --type caddy -v 2>&1 > /tmp/caddy.debug.log

then just DM me the /tmp/caddy.debug.log

shrewd quiver Aug 8, 2025, 11:30 AM

#

sure, thank you

#

you want crowdsec.log and crowdsec-api.log as well?

mint basalt Aug 8, 2025, 11:32 AM

#

nah just the explain for now

shrewd quiver Aug 8, 2025, 11:38 AM

#

oki, its taking some time generate the file, i'll dm it to you when its done, thanks again

shrewd quiver Aug 8, 2025, 12:45 PM

#

my container died with 8 gb ram and 4 cores, let me try that again xD

#

is there any way I can make the log file smaller?

violet crane Aug 8, 2025, 12:57 PM

#

Try
tail /var/log/caddy/access.log | head -n 20 | cscli explain -f- --type caddy -v 2>&1 > /tmp/caddy.debug.log to get only 20 lines of the logfile.
Change the number to anything your system can handle

shrewd quiver Aug 8, 2025, 1:04 PM

#

Hmm, i get some warnings and the log file gets like 15kb only

#

WARNING Line 1/10 is missing evt.StrTime. It is most likely a mistake as it will prevent your logs to be processed in time-machine/forensic mode.  file=/tmp/cscli_explain3542206806/parser-dump.yaml
WARNING Line 2/10 is missing evt.StrTime. It is most likely a mistake as it will prevent your logs to be processed in time-machine/forensic mode.  file=/tmp/cscli_explain3542206806/parser-dump.yaml

violet crane Aug 8, 2025, 1:10 PM

#

Ignore the warning for now.
Like it says: The pearser didn't fill evt.StrTime on lines 1 and 2. These 2 lines would be useless in time-machine/forensic mode.
as for the size: It's a txt file - don't expect it to be huge... depends on how many lines your parsing.
Try increasing the head -n to 100 - cscli explain will take longer and use more resources.

shrewd quiver Aug 8, 2025, 1:12 PM

#

my caddy.log is 26k, I picked 10k , seems to small to me for being a txt file 🤷🏽‍♂️

#

Ill try another way 😄 thanks!!

mint basalt Aug 11, 2025, 10:39 AM

#

so checking through your logs, everything seems fine, the only thing to point out is you have a lot of requests from internal ips like promox and uptime-kuma, so is caddy the only proxy you have or is it a chain of proxies?

#Is my caddy setup missing anything?