Smib666

So I’ve solved it, with a lot of help from Loz over at CrowdSecs Discord. I’ll describe the solution here in case if someone finds themselves in the same situation. So how to make the logs from Traefik accessibly for CrowdSec as docker containers? Well, thanks to Loz I realised how a competent piece of software CrowdSec is. It can read logs directly from stdout. So first give CrowdSec access to the dockers by create a path to /var/run/docker.sock in the container GUI. Then you change the acquis.yaml, in my case Traefik to this: source: docker container_name: - traefik label: traefik Or you can use labels like Traefik. You can read about it here: https://docs.crowdsec.net/docs/next/log_processor/data_sources/docker I’ve not finalised the install yet but the logs look ok. I’m trying to get the dashboard to connect to its database, but there is a permission issue I’ll have solve. Probably is it yet another Unraid speciality. But CrowdSec can read the logs of Traefik. Not bad for a noob if I may say so myself.

So I kind of figured out why this messes me up. 1: I do not use docker compose. 2: When I compare how the logs volumes are defined in Ubuntu vs Unraid they do look different. In Ibrocorps docker compose for Traefik there are no volume for logs, they are insted defined like this: # Logging - --log.level=INFO - --accesslog=true and in the static configuration the logs are just defined like this: log: level: INFO format: json accessLog: format: json 3. By default Unraid containers store their logs in /var/lib/docker/containers/ and when I look in some of my other containers none of them have the log volumes defined in the container gui. 4. I can get logs in the folder for Traefik by creating a folder /logs: Name: Logs Container Path: /logs Host Path: /mnt/user/appdata/traefik/logs And change accordingly in the traefik.yaml: log: level: "INFO" filePath: ”/logs/traefik.log" accessLog: filePath: "/logs/access.log" But that means that the logviewer in th dropdown under the Traefik logo looses the connection to the logs (and so do Dozzle) because I guess they are set up to fetch the logs from /var/lib/docker/containers? And isn't a point to not have the logs stored in the Traefik folder? I havent solved it yet and I wouldn't try do do this but I want to use CrowdSec and it needs the Traefik logs. If someone has a clever idea how to do so without breaking the connection to the built in logviewer I would very much apriciate it. Best regards

Hello, thanks for the reply. Would you kindly clarify. What do you mean by ”has nothing do with those containers”. Do you mean that there is nothing wrong with the Traefik folder in /var/log/ or that the paths are wrong?

Hey, So I was happy too soon. I knew it. It would’ve been to easy. I just wanted to try an idea before I finished the installation of CrowdSec and added a port to Traefik. Well, it crashed. When I restarted it and began the continuation of the install of CrowdSec I just couldn’t get CrowdSecs GUI to connect. So I started to check logs and I realized that CrowdSec had lost the connection to the Traefik logs. Why? So I looked in static yaml, and for some unholy reason it had reverted back to the ”original” settings I had before I wanted to connect with CrowdSec. So I changed it back to: log: level: "INFO" filePath: "/var/log/traefik/traefik.log" accessLog: filePath: ”/var/log/traefik/access.log" And made sure that the path in Traefik was: Name: Logs Container Path: /var/log/traefik/ Host Path: /mnt/user/appdata/traefik/logs/ And so I waited, patiently. No logs from Traefik. And for some reason I no longer had permission to edit the acquis.yaml in CrowdSec. So to make sure I uninstalled everything to do CrowdSec and restarted the server. Still no logs. Can there be a permission issue somewhere? I’m starting to wonder if I should remove the Traefik folder in /var log/ and create a new one. Unfortunately I’m not CLI user and I don’t use Linux commands unless I have the full string to copy and paste. And doing things in /var/log/ does make me nervous. If you think this would be a good idea to make a new folder for the Traefik logs I really would appreciate if you could help me with that. I attach a screenshot from when I ”ls -l” into /var/log/ if you can see anything wrong. This is very confusing. Any idea or suggestion is highly appriciated. Best regards

Thanks @MowMdown for your reply. It kind of appears to have solved itself. I got annoyed and shut down CrowdSec and watched TV with my dog for couple of hours and decided to look at Traefiks log. It was there, out of the blue. Like it needed time to realign the paths. So I started CrowdSec today when I got home and it seems to work according to the log. I’ll try to finish the install tomorrow. lessoned learned sometimes things just need a little time.😉

Hello, I’m trying figure out if the mapping is wrong or if it is the permissions that are wrong. I’m going to use my specific use case to illustrate my problem. I want to set up Traefik with Crowdsec which need the Traefik logs to work, but unfortunately I can’t seem to do it in the correct way. I have to admit that this is not my forte, to put it bluntly I’m a noob. I’m using Unraid with docker containers so no docker compose. I like to use the containers because it has been easy for me to wrap my head around and I really like the dropdown were I reach shortcuts to important functions by clicking on the apps icon. My installation of Traefik is based on Ibracorps instruction and is since Monday updated to the latest version and Traefik appears to more or less run as a clock (I have an unrelated warning in the logs that I’ll try to fix when I’m done with this). I also looked at Ibracorps old clip for Crowdsec, Jims garage and techno Tims which is for the updated version of Traefik and his Crowdsec installation to find some guidance. I installed CrowdSec and added a path to /var/log/traefik: Name: Traefik Logs Container Path: /var/log/traefik/ Host Path: /mnt/user/appdata/traefik/logs/ I also created a path in Traefik: Name: Logs Container Path: /var/log/traefik/ Host Path: /mnt/user/appdata/traefik/logs/ To make the logs from traefik accessible for CrowdsSec you have specify the file path:: log: level: "INFO" filePath: "/var/log/traefik/traefik.log" accessLog: filePath: ”/var/log/traefik/access.log" If I’m understanding it correctly this places the logs in /var/log/traefik. But after the restart when I ls in to the /var/log/traefik there are no files (and nothing in the /logs folder in Traefik, and the access to the logs from the dropdown is gone, as in Dozzle. When I’m instead did it like this, just to see if it would work: Name: Logs Container Path: /logs Host Path: /mnt/user/appdata/traefik/logs And change accordingly in the traefik.yaml: log: level: "INFO" filePath: ”/logs/traefik.log" accessLog: filePath: "/logs/access.log" It produces logs in the referenced folder, but tas above I loose access to the logs via the dropdown. After that I’ve tried a lot permutations of this; removed the paths and then added them back in (it’s a lot of restarts). I also have of course added per instruction the path in acquis.yaml, but obviously it will not find anything: "No matching files for pattern /var/log/traefik/*" So I get feeling that I doing a stupid, stupid noob misstake with the paths or it might be a permission issue (how would I fix that in /var/log/?). What I want to accomplish is just to make Traefiks logs accessible to CrowdSec without breaking the link to the logs in Traefiks dropdown (and in Dozzle). There is something I’m missing and I hope someone would like to help me a bit… Best regards

Hello, I hope this is the correct forum, if not I apologize. I also apologize if this is a stupid question, but I'm a noob and I'm trying to just understand. Im might add that I use containers and not docker compose. I'm trying to set up Crowdsec with Traefik and I can't put the Traefik logs in /var/log/traefik. I have the latest Traefik up and running. In the docs on Ibracorp.io the logs are defined as: log: level: INFO format: json accessLog: format: json So I have put the following in the traefik.yaml as per every description I've found (but that are for docker compose, so I don't know if it should be the same in the container) log: level: "INFO" filePath: "/var/log/traefik/traefik.log" accessLog: filePath: "/var/log/traefik/access.log" But there is no files in /var/log/traefik and of course there are an error in CrowdSec: level=warning msg="No matching files for pattern /var/log/traefik/*.log" module=acquisition.file type=file Just to verify I tried to create a new log folder in the Traefik appfolder for the logs and changed the path in Traefik.yaml to: filePath: "/mnt/user/appdata/traefik/logs" and voila there was the log files (it makes me wonder if it some permission issue). But that means that I break the link to the log viewer and if I try to put /mnt/user/appdata/traefik/logs/*.log in the acquis.yaml for CrowdSec it gives me the same error as when /var/log/traefik/. While I've been investigating and trying stuff I also can say that the CrowdSec container setup reference to folders that do not exist in /var/log/ (screenshot attached). There is no folder named crowdsec or syslog, there is a folder named auth.log, but it sound as if it should be a file? Are thes folders necessary ie do they need to be created or can these be erased? Is this container made for Unraid? As I said I'm a noob and right now I just don't understand. Maybe I'm just misunderstanding something fundamental about routing in docker. Most I've learned I've done thanks to YouTube so my knowledge about docker and such is at best spotty. I would very much appreciate some guidance. Thank you! Best regards

Hello, Let me introduce you to my latest family member the server Gadamer: Intel Core i7 10700K 3,8GHz (+ Noctua NH-D15) Gigabyte W480M Vision W BEYIMEI PCIE 4X SATA Card 16 Ports, 6 Gbit / s SATA 3.0 PCI Express Kort Corsair Vengeance LPX Black DDR4 2666MHz 2x16GB Western Digital Red Pro and Seagate Ironwolf Pro 2x 10 TB in the parity 12x 6 TB + 3x 10 TB in the array (room for 3 more) 1 Seagate IronWolf 1 TB for ZFS backup Samsung 980 500 GB x2 mirrored (pool for the Apps, system and the VM:s) Samsung 850 500 GB (pool for the cache, downloads and stuff, will change to 2 Samsung 870 EVO 500GB and RAID them) Fractal Design Ion+ Platinum 760W Noctua NF-A14 5V PWM 140mm (3 in the front and 1 in the back) Fractal Design Define 7 XL Hey. This is my very first build. I’ve have been an Apple user since 1997 and haven’t been tinkering a lot with with software and “programming” before. It will mostly handle my Media and the heart of it all will be Plex and the …arrs. I’ve never done anything like this before, which of course means that I’ve f*cked up a couple of times and started over completely. In retrospect some of the times it might have been an overreaction (but I’ve been dealing with both McOS and Windows during the 90s, where I learned that if you get into problems then format and start over). I have learned so much and I have now a very clear picture of how I want things to work. But I wouldn't have gotten this far without Ibracorp, Spaceinvader One and Trash guides. I think that’s all for now. Bye!